APT_MAL_RANSOM_ViceSociety_PolyVice_Jan23_1

rule APT_MAL_RANSOM_ViceSociety_PolyVice_Jan23_1 {
   meta:
      description = "Detects NTRU-ChaChaPoly (PolyVice) malware used by Vice Society"
      author = "Florian Roth (Nextron Systems)"
      reference = "https://www.sentinelone.com/labs/custom-branded-ransomware-the-vice-society-group-and-the-threat-of-outsourced-development/"
      date = "2023-01-12"
      modified = "2023-01-13"
      score = 75
      hash1 = "326a159fc2e7f29ca1a4c9a64d45b76a4a072bc39ba864c49d804229c5f6d796"
      hash2 = "8c8cb887b081e0d92856fb68a7df0dabf0b26ed8f0a6c8ed22d785e596ce87f4"
      hash3 = "9d9e949ecd72d7a7c4ae9deae4c035dcae826260ff3b6e8a156240e28d7dbfef"
      id = "e450407c-6c21-56bf-aedf-8e7f3890abe2"
   strings:
      $x1 = "C:\\Users\\root\\Desktop\\niX\\CB\\libntru\\" ascii
      
      $s1 = "C:\\Users\\root" ascii fullword
      $s2 = "#DBG: target = %s" ascii fullword
      $s3 = "# ./%s [-p <path>]/[-f <file> ] [-e <enc.extension>] [-m <requirements file name>]" ascii fullword
      $s4 = "### ################# ###" ascii fullword

      $op1 = { 89 ca 41 01 fa 89 ef 8b 6c 24 24 44 89 c9 09 d1 44 31 e6 89 c8 }
      $op2 = { bd 02 00 00 00 29 cd 48 0f bf d1 8b 44 46 02 01 44 53 02 8d 54 0d 00 83 c1 02 48 0f bf c2 }
      $op3 = { 48 29 c4 4c 8d 74 24 30 4c 89 f1 e8 46 3c 00 00 84 c0 41 89 c4 0f 85 2b 02 00 00 0f b7 45 f2 }
   condition:
      uint16(0) == 0x5a4d and
      filesize < 400KB and (
         1 of ($x*) 
         or 2 of them
      ) or 4 of them
}