Cobaltbaltstrike_RAW_Payload_https_stager_x86

rule Cobaltbaltstrike_RAW_Payload_https_stager_x86
{
  meta:
    author = "Avast Threat Intel Team"
    description = "Detects CobaltStrike payloads"
    reference = "https://github.com/avast/ioc"
    id = "f1d7e939-92b5-5441-8014-b2390854d059"
  strings:
    // x86 default eop
    $h01 = { FC E8 89 00 00 00 60 89 E5 31 D2 64 8B 52 30 8B 52 0C 8B 52 14 8B 72 28 }
  condition:
    /*
    Payload API list:
    Offset  | Hash value  | API name
    0x009c  | 0x0726774c  | kernel32.dll_LoadLibraryA
    0x00af  | 0xa779563a  | wininet.dll_InternetOpenA
    0x00cb  | 0xc69f8957  | wininet.dll_InternetConnectA
    0x00e7  | 0x3b2e55eb  | wininet.dll_HttpOpenRequestA
    0x0100  | 0x869e4675  | wininet.dll_InternetSetOptionA
    0x0110  | 0x7b18062d  | wininet.dll_HttpSendRequestA
    0x0129  | 0x5de2c5aa  | kernel32.dll_GetLastError
    0x0132  | 0x315e2145  | user32.dll_GetDesktopWindow
    0x0141  | 0x0be057b7  | wininet.dll_InternetErrorDlg
    0x02e9  | 0x56a2b5f0  | kernel32.dll_ExitProcess
    0x02fd  | 0xe553a458  | kernel32.dll_VirtualAlloc
    0x0318  | 0xe2899612  | wininet.dll_InternetReadFile
    */
    uint32(@h01+0x009c) == 0x0726774c and
    uint32(@h01+0x00af) == 0xa779563a and
    uint32(@h01+0x00cb) == 0xc69f8957 and
    uint32(@h01+0x00e7) == 0x3b2e55eb and
    uint32(@h01+0x0100) == 0x869e4675 and
    uint32(@h01+0x0110) == 0x7b18062d and
    uint32(@h01+0x0129) == 0x5de2c5aa and
    uint32(@h01+0x0132) == 0x315e2145 and
    uint32(@h01+0x0141) == 0x0be057b7 and
    uint32(@h01+0x02e9) == 0x56a2b5f0 and
    uint32(@h01+0x02fd) == 0xe553a458 and
    uint32(@h01+0x0318) == 0xe2899612
}