/*
   SL-ADV-2026-WP-001 v15.1 — Remus Stealer (WP-002)
   ClickFix / EtherHiding delivery chain
   Dispensight / SecureLeaf — secureleaf.dispensight.com — TLP:CLEAR
   2026-09-02
*/

import "hash"

rule WP002_Remus_IExpress_SFX_dropper
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v15.1"
        description = "IExpress SFX wrapping AutoIt3.exe + compiled a3x"
        sha256 = "2a1d78fb02d047605ac2400b18e4bc902fe752bde24ccee0aa5c46def9787680"
        tlp = "CLEAR"
    strings:
        $sfx1 = "IntroductionChassis.exe" ascii
        $sfx2 = "Corpus.a3x" ascii
        $sfx3 = "AutoIt3.exe" ascii
        $cab  = "MSCF" ascii
    condition:
        uint16(0) == 0x5A4D and $cab and 2 of ($sfx*)
}

rule WP002_Remus_compiled_AutoIt_a3x
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v15.1"
        description = "Compiled AutoIt payload (AU3!EA06), packed"
        sha256 = "74a517b6b24b47a45101af70b9c5ca3572502e3e027fd69badc8dc3757a4a67f"
    strings:
        $au3 = "AU3!EA06" ascii
    condition:
        $au3 at 176 or (uint32be(0)==0xca087e26 and $au3)
}

rule WP002_Remus_ClickFix_stage2_config
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v15.1"
        description = "asseload ClickFix stage-2 XOR/base64 loader"
    strings:
        $xorkey = "oipCQd0DIbeF" ascii
        $fn     = "_442b" ascii
        $atob   = ".charCodeAt(i%" ascii
    condition:
        2 of them
}

rule WP002_EtherHiding_BSC_injector
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v15.1"
        description = "BSC-testnet EtherHiding retrieval of asseload injector"
    strings:
        $contract = "ae5d8eec6ea8366e7922c93abc908ff96eb08034" ascii nocase
        $selector = "0xe2179b8e" ascii nocase
        $rpc      = "data-seed-prebsc-1-s1.binance.org" ascii
    condition:
        any of them
}

rule WP002_Remus_C2_exfil_beacon
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v15.1"
        description = "Remus stealer HTTP exfil — POST /invoices, github.com host spoof, both param schemas"
    strings:
        $p   = "POST /invoices" ascii
        $h   = "Host: github.com" ascii
        $v1a = "access_token=" ascii
        $v1b = "&debug=" ascii
        $v2a = "tag=" ascii
        $v2b = "&exp=" ascii
        $v2c = "&hwid=" ascii
        $dom = "cdire.shop" ascii nocase
    condition:
        ($p and $h and (all of ($v1*) or all of ($v2*))) or $dom
}

rule WP002_Remus_native_core_hint
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v15.1"
        description = "Terminal native x64 Remus core (fileless, injected @0x140000000). The 'chunk-' C2 frame prefix is assembled at runtime (strncpy) and is NOT a static string; identify a dumped image by its .text SHA-256."
        text_sha256 = "eba3f014bd57d992c69a56854c0f8ac07b665d2721053edd88db144e5814c138"
        image_base = "0x140000000"
    strings:
        // entry-point prologue observed at EP (0x1400021c0): lea ecx,[rax+8]; jmp
        $ep = { 8D 48 08 E9 }
    condition:
        uint16(0) == 0x5A4D and $ep
}

rule WP002_durable_RSA1024_C2_key
{
    meta:
        author = "Dispensight/SecureLeaf"
        advisory = "SL-ADV-2026-WP-001 v15.1"
        description = "Durable WP-002 RSA-1024 CAPI PUBLICKEYBLOB (e=65537). Runtime-resolved in PowerShell stage; modulus SHA-256 dc4cb858…febfac6f. Scan process memory dumps."
    strings:
        // CAPI PUBLICKEYBLOB header: bType=06 bVer=02 reserved=0000 aiKeyAlg=0000a400 "RSA1" bitlen=0400 exp=00010001
        $blob = { 06 02 00 00 00 24 00 00 52 53 41 31 00 04 00 00 01 00 01 00 }
    condition:
        $blob
}