/*
   TAG-150 / NightshadeC2, deux mecanismes de livraison distincts identifies
   (voir writeup.md) :

     - TAG150_wmsgapi_sideload : kit de DLL sideloading (vrai consent.exe
       Windows renomme + fausse wmsgapi.dll qui proxy vers la vraie DLL
       systeme). S'applique a la fausse wmsgapi.dll elle-meme.

     - TAG150_GoLoader_wordsalad : loaders Go dont les symboles/metadonnees
       de version sont generes par un outil de mots-salade anglais/pseudo-
       scientifiques, embarquant un chargeur PE manuel en memoire et
       potentiellement une chaine de certificat EV falsifiee (signature
       Authenticode invalide, voir writeup.md §4).

   Validees sur les 7 echantillons de ce dossier, pas testees sur un corpus
   TAG-150 plus large.

   Auteur : Gordon PEIRS (@ozer0x777)
   TLP:CLEAR
*/

rule TAG150_wmsgapi_sideload
{
    meta:
        description = "TAG-150 : fausse wmsgapi.dll utilisee pour sideloader le vrai consent.exe de Windows"
        author      = "Gordon PEIRS (@ozer0x777)"
        date        = "2026-08-03"
        malware     = "NightshadeC2 (TAG-150 / GrayBravo)"
        family      = "Loader (DLL sideloading)"
        tlp         = "CLEAR"

    strings:
        $exp1 = "WmsgBroadcastMessage" ascii
        $exp2 = "WmsgSendMessage" ascii
        $exp3 = "WmsgPostMessage" ascii
        $forward = "wmsgapi.Wmsg" ascii nocase

        $mz = "MZ"

    condition:
        $mz at 0 and filesize < 700MB and 2 of ($exp*, $forward)
}

rule TAG150_GoLoader_wordsalad
{
    meta:
        description = "TAG-150 : loader Go avec symboles/version PE generes par mots-salade, chargeur PE manuel en memoire (voir writeup.md §3-5)"
        author      = "Gordon PEIRS (@ozer0x777)"
        date        = "2026-08-03"
        malware     = "NightshadeC2 loader (TAG-150 / GrayBravo)"
        family      = "Loader (Go, chargement reflexif)"
        tlp         = "CLEAR"

    strings:
        $go_runtime = "runtime: panic before malloc heap initialized" ascii
        $ntunmap = "NtUnmapViewOfSection" ascii wide
        $deepl_lure = "Bootstrapper for DeepL" ascii wide
        $zero_install = "zero-install" ascii wide nocase

        $mz = "MZ"

    condition:
        $mz at 0 and filesize < 20MB and $go_runtime and ($ntunmap or $deepl_lure or $zero_install)
}

rule TAG150_NightshadeC2_payload
{
    meta:
        description = "TAG-150 : payload natif NightshadeC2 (persistance JAVA_V3, C2 85.208.84.115:7777, voir writeup.md §5bis-6bis)"
        author      = "Gordon PEIRS (@ozer0x777)"
        date        = "2026-08-03"
        malware     = "NightshadeC2 (TAG-150 / GrayBravo)"
        family      = "RAT natif"
        sample1     = "e32b50f1b9ab8ccda64e4046780e002b350ece9c93ff4fa245fe0526ada14a1a"
        sample2     = "90ff2daaa3b7748bf9a742da22766c321f4b1b0df9949c86e0e2ae10cda21238"
        tlp         = "CLEAR"

    strings:
        $c2_ip = "85.208.84.115" ascii wide
        $c2_handshake = "RandOmKey322666B" ascii wide
        $persist_task = "JAVA_V3" ascii wide
        $geo_check = "ip-api.com" ascii wide nocase
        $keylog_path1 = "JavaFilee6" ascii wide
        $keylog_path2 = "PythonFilee6" ascii wide

        $mz = "MZ"

    condition:
        $mz at 0 and filesize < 20MB and 2 of them
}