/*
   Qilin (Agenda) ransomware, variante Rust (build de 2025).
   Detection basee sur la concatenation des champs serde du struct de
   configuration de la famille et sur l'auto-branding "Qilin" de la note.
   Chaines verifiees dans l'echantillon
   61f7aa918b55238278a1666cb723df9e3639d229d1027611e02ae3808ede33ed.

   Auteur : Gordon PEIRS (@ozer0x777)
   TLP:CLEAR
*/

rule Qilin_Agenda_Rust_config
{
    meta:
        description = "Qilin (Agenda) ransomware Rust : struct de config serde (black_lists, company_id, password_hash) et note auto-brandee Qilin"
        author      = "Gordon PEIRS (@ozer0x777)"
        date        = "2026-07-21"
        malware     = "Qilin / Agenda"
        family      = "Ransomware (Rust)"
        tlp         = "CLEAR"

    strings:
        // Champs serde du struct Config de la famille (presents separement dans les builds recents)
        $b1 = "directory_black_list" ascii
        $b2 = "file_pattern_black_list" ascii
        $b3 = "win_services_black_list" ascii
        $b4 = "process_black_list" ascii
        $company = "company_id" ascii
        $pwhash  = "password_hash" ascii
        $priv    = "private_rsa_pem" ascii
        $brand   = "-- Qilin" ascii

    condition:
        filesize < 20MB and $brand and 3 of ($b1, $b2, $b3, $b4, $company, $pwhash, $priv)
}

rule Qilin_Rust_sample_2025
{
    meta:
        description = "IOC : build Qilin 2025, affilie yd9Ca9y5RN, onions de negociation ; build embarquant sa cle privee RSA"
        author      = "Gordon PEIRS (@ozer0x777)"
        date        = "2026-07-21"
        hash_sha256 = "61f7aa918b55238278a1666cb723df9e3639d229d1027611e02ae3808ede33ed"
        tlp         = "CLEAR"

    strings:
        $o1  = "7xwr35xboy7s6phm2peywe3qbdybhtgaf7puys47mty4jrh4wnq2llad.onion" ascii
        $o2  = "ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion" ascii
        $o3  = "kbsqoivihgdmwczmxkbovk7ss2dcynitwhhfu5yw725dboqo5kthfaad.onion" ascii
        $cid = "yd9Ca9y5RN" ascii

    condition:
        any of them
}