APT28_SkinnyBoy_Dropper

rule APT28_SkinnyBoy_Dropper: RUSSIA {
   meta:
      description = "Detects APT28 SkinnyBoy droppers"
      author = "Cluster25"
      date = "2021-05-24"
      reference = "https://cluster25.io/wp-content/uploads/2021/05/2021-05_FancyBear.pdf"
      hash1 = "12331809c3e03d84498f428a37a28cf6cbb1dafe98c36463593ad12898c588c9"
      id = "ed0b2d2b-f820-57b5-9654-c24734d81996"
   strings:
      $ = "cmd /c DEL " ascii
      /* $ = " \"" ascii */ /* slowing down scanning */
      $ = {8a 08 40 84 c9 75 f9}
      $ = {0f b7 84 0d fc fe ff ff 66 31 84 0d fc fd ff ff}
   condition:
      (uint16(0) == 0x5A4D and all of them)
}