[[ fm.text ]] Click here

VOLEXITY_Apt_Win_Powerstar_Decrypt_Function

YARA detection rule by threatintel@volexity.com · See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt

Detects PowerStar decrypt function, potentially downloaded standalone and then injected.

rule VOLEXITY_Apt_Win_Powerstar_Decrypt_Function: CHARMINGKITTEN {
  meta:
    description     = "Detects PowerStar decrypt function, potentially downloaded standalone and then injected."
    author          = "threatintel@volexity.com"
    id              = "1fbc2689-8169-53b1-b581-c41ab2b3a16f"
    date            = "2023-05-16"
    modified        = "2023-09-20"
    reference       = "https://github.com/volexity/threat-intel"
    source_url      = "https://github.com/volexity/threat-intel/blob/62e031ea574efde68dac7d38dc23438466a5302b/2023/2023-06-28 POWERSTAR/indicators/rules.yar#L98-L121"
    license_url     = "https://github.com/volexity/threat-intel/blob/62e031ea574efde68dac7d38dc23438466a5302b/LICENSE.txt"
    logic_hash      = "d022e363464488836a1c161f2b9c7463ac91ae6f60f14dfd574189233201c9aa"
    score           = 75
    quality         = 80
    tags            = "CHARMINGKITTEN"
    hash1           = "b79d28fe5e3c988bb5aadb12ce442d53291dbb9ede0c7d9d64eec078beba5585"
    memory_suitable = 1
    license         = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"

  strings:
    $f_1 = "function Borjol{"
    $s_1 = "$global:Domain = \""
    $s_2 = "$global:IP = \""
    $s_3 = "$global:yeolsoe"
    $s_4 = "$semii.Close()"
    $s_5 = "$cemii.Close()"
    $s_6 = "$memii.Close()"

  condition:
    any of ($f_*) or 2 of ($s_*)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0b010e55-4984-426c-9435-ac31c31c68a6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion