Add DCRat V3 and V4 detection rules

Added private rules for DCRat V3 and V4 indicators, including common strings and specific conditions for detection.

Author: doomedraven

src/rat_king_parser/yara_utils/rules.yar

@@ -121,3 +121,120 @@ rule venomrat {
     condition:
         5 of them and #patt_config >= 10
  }
+
+
+private rule DCRat_Common_Strings {
+    meta:
+        description = "Contains strings shared between DCRat V3 and V4"
+    strings:
+        // DCRat Common
+        $dc_all_1 = "ICBfX18gICAgICAgICAgIF8gICAgICBfX18gICAgICAgICAgICAgXyAgICAgICAgXyAgIF9fXyAgICBfIF9fX19fIA0KIHwgICBcIF9fIF8gXyBffCB8X18gIC8gX198XyBfIF8gIF8gX198IHxfIF9fIF98IHwgfCBfIFwgIC9fXF8gICBffA0KIHwgfCkgLyBfYCB8ICdffCAvIC8gfCAoX198ICdffCB8fCAoXy08ICBfLyBfYCB8IHwgfCAgIC8gLyBfIFx8IHwgIA0KIHxfX18vXF9fLF98X3wgfF9cX1wgIFxfX198X3wgIFxfLCAvX18vXF9fXF9fLF98X3wgfF98X1wvXy8gXF9cX3wgIA0KICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIHxfXy8gICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIA==" wide
+        $dc_all_2 = "DCRat-Log#" wide
+
+        // GeoIP Common
+        $geoip_all_1 = "geoplugin_city" wide fullword
+        $geoip_all_2 = "geoplugin_countryName" wide fullword
+        $geoip_all_3 = "geoplugin_countryCode" wide fullword
+        $geoip_all_4 = "geoplugin_latitude" wide fullword
+        $geoip_all_5 = "geoplugin_longitude" wide fullword
+        $geoip_all_6 = "geoplugin_request" wide fullword
+
+        // Plugins Common
+        $plugin_all_1 = "Processing other information..." wide fullword
+
+        // GUI Common
+        $gui_all_1 = "Clipboard [Text].txt" wide fullword
+        $gui_all_2 = "Clipboard [Files].txt" wide fullword
+        $gui_all_3 = "[Clipboard] Saving information..." wide fullword
+        $gui_all_4 = "[SystemInfromation] Saving information..." wide fullword
+        $gui_all_5 = "~Work.log" wide fullword
+        $gui_all_6 = "Done! Elapsed time: " wide fullword
+        $gui_all_7 = "[Screenshot] Saving screenshots from " wide fullword
+
+        // Steal Common
+        $steal_all_1 = "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" wide fullword 
+        $steal_all_2 = "SOFTWARE\\Valve\\Steam" wide fullword
+        $steal_all_3 = "SteamPath" wide fullword 
+        $steal_all_4 = "/config/loginusers.vdf" wide fullword 
+        $steal_all_5 = "/steamapps/common" wide fullword
+        $steal_all_6 = "TelegramPath" wide fullword
+        $steal_all_7 = "Telegram" wide fullword
+        $steal_all_8 = "Kotatogram" wide fullword
+        $steal_all_9 = "Unigram" wide fullword
+        $steal_all_10 = "Telefuel" wide fullword
+        $steal_all_11 = "/tdata" wide fullword
+        $steal_all_12 = "DiscordPath" wide fullword
+
+    condition:
+        uint16(0) == 0x5a4d and 
+        (
+            (2 of ($dc_all*)) or 
+            (
+                (3 of ($geoip_all*)) and 
+                (1 of ($plugin_all*)) and 
+                (2 of ($gui_all*)) and 
+                (5 of ($steal_all*))
+            )
+        )
+}
+
+private rule DCRat_V3_Indicators {
+    meta:
+        description = "Indicators specific to V3 (GZIP+B64)"
+    strings:
+        $dc_v1_1 = "DCRat.Code" wide
+        $geoip_v1_1 = "geoplugin_timezone" wide fullword
+        $geoip_v1_2 = "geoplugin_regionName" wide fullword
+        $plugin_v1_1 = "Processing stealer plugins [" wide fullword
+        $plugin_v1_2 = "Unknown command! Maybe a plugin is required?" wide fullword
+        $steal_v1_1 = "\\discord\\Local Storage\\leveldb\\" wide fullword
+    condition:
+        any of them
+}
+
+private rule DCRat_V4_Indicators {
+    meta:
+        description = "Indicators specific to V4 (AES+PBKDF2)"
+    strings:
+        $dc_v2_1 = "DarkCrystal RAT" wide
+        $geoip_v2_1 = "geoplugin_region" wide fullword
+        $plugin_v2_1 = "[Plugin] Execute: " wide fullword
+        $plugin_v2_2 = "Processing plugins [" wide fullword
+        $steal_v2_1 = "discordcanary" wide fullword
+        $steal_v2_2 = "Lightcord" wide fullword
+        $steal_v2_3 = "discordptb" wide fullword
+    condition:
+        any of them
+}
+
+rule DCRatV3 {
+    meta:
+        author = "ClaudioWayne"
+        description = "DCRat V3 (GZIP+B64 String Decryption) Payload"
+        cape_type = "DCRatV3 Payload"        
+    condition:
+        DCRat_Common_Strings 
+        and DCRat_V3_Indicators 
+        and not DCRat_V4_Indicators
+}
+
+rule DCRatV4 {
+    meta:
+        author = "ClaudioWayne"
+        description = "DCRat V4 (AES+PBKDF2 String Decryption) Payload"
+        cape_type = "DCRatV4 Payload"        
+    condition:
+        DCRat_Common_Strings 
+        and DCRat_V4_Indicators 
+        and not DCRat_V3_Indicators
+}
+
+rule DCRat_Generic_V3_V4 {
+    meta:
+        author = "ClaudioWayne"
+        description = "DCRat Generic (V3/V4) Payload - Matches common fingerprint"
+        cape_type = "DCRatV3V4 Payload"        
+    condition:
+        DCRat_Common_Strings 
+        and not (DCRatV3 or DCRatV4) // Optional: avoid duplicate alerts if V3 or V4 matched
+}