[[ fm.text ]] Click here

apt_win_powerstar_memonly

YARA detection rule by threatintel@volexity.com · See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt

Detects the initial stage of the memory only variant of PowerStar.

rule apt_win_powerstar_memonly : CharmingKitten
{
    meta:
        author = "threatintel@volexity.com"
        date = "2023-05-16"
        description = "Detects the initial stage of the memory only variant of PowerStar."
        hash1 = "977cf5cc1d0c61b7364edcf397e5c67d910fac628c6c9a41cf9c73b3720ce67f"
        memory_suitable = 1
        license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"

    strings:
        $s_1 = "[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String($in.substring(3)))"
        $s_2 = "[Convert]::ToByte(([Convert]::ToString(-bnot ($text_bytes[$i])"
        $s_3 = "$Exec=[System.Text.Encoding]::UTF8.GetString($text_bytes)"
        $s_4 = "((65..90) + (97..122) | Get-Random -Count 16 | % {[char]$_})"
        $f_1 = "function Gorjol{"
        $f_2 = "Borjol \"$"
        $f_3 = "Gorjol -text"
        $f_4 = "function Borjoly{"
        $f_6 = "$filename = $env:APPDATA+\"\\Microsoft\\Windows\\DocumentPreview.pdf\";"
        $f_7 = "$env:APPDATA+\"\\Microsoft\\Windows\\npv.txt\""
        $f_8 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\brt8ts74e.bat"
        $f_9 = "\\Microsoft\\Windows\\s7qe52.txt"
        $f_10 = "$yeolsoe2 = $yeolsoe"
        $f_11 = "setRequestHeader(\"Content-DPR\""
        $f_12 = "getResponseHeader(\"Content-DPR\")"
        $f_13 = {24 43 6f 6d 6d 61 6e 64 50 61 72 74 73 20 3d 24 53 65 73 73 69 6f 6e 52 65 73 70 6f 6e 73 65 2e 53 70 6c 69 74 28 22 b6 22 29}
        $f_14 = "$language -like \"*shar*\""
        $f_15 = "$language -like \"*owers*\""
        $alias_1 = "(gcm *v????E?P?e*)"
        $alias_2 = "&(gcm *ke-e*) $Command"
        $key = "T2r0y1M1e1n1o0w1"
        $args_1 = "$sem.Close()"
        $args_2 = "$cem.Close()"
        $args_3 = "$mem.Close()"
        $command_1 = "_____numone_____"
        $command_2 = "_____mac2_____"
        $command_3 = "_____yeolsoe_____"
    condition:
        2 of ($s_*) or
        any of ($f_*) or
        2 of ($alias_*) or
        $key or
        all of ($args_*) or
        any of ($command_*)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

2767d6ad-0a4b-4f8f-98f0-fc792eb9af35

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion