/*
    mc-yara-rules: static ruleset (bundled)
    version 2026.11.11+ccafe1e
    Generated by tools/bundle.py from static/index.yar - do not edit.
*/

import "hash"

// ---- nul_dispatcher.yar ----------------------------------------------------
/*
    Static (sample-specific) rules: "nul-dispatcher" family.

    A plugin disguised as a metrics library that beacons server details over HTTPS, runs OS commands and
    deletes files. Its classes live in NUL-prefixed packages (hidden from tools that cut names
    at NUL) and every call is routed through invokedynamic "Dispatcher" bootstraps backed by a
    Base64 lookup table.

    *_Jar rules match the raw .jar (zip names / whole-file hash, no extraction needed).
    *_Class rules match extracted .class files.
*/

rule MC_Static_NulDispatcher_Jar
{
    meta:
        author = "mc-yara-rules"
        description = "nul-dispatcher plugin: NUL-prefixed obfuscator package names in the zip directory, or the exact sample hash"
        severity = "critical"
        family = "nul-dispatcher"
        sample_sha256 = "f3e4ccd9eaa42a8ff90791fa0a62101bf1aaac5c69f5e314fc91f59f236c068f"
        date = "2026-11-06"
    strings:
        $dispatcher_cd = { 00 73 2F 63 2F 73 2F 44 69 73 70 61 74 63 68 65 72 2E 63 6C 61 73 73 }   // "\0s/c/s/Dispatcher.class"
        $pkg_s_c_s = { 00 73 2F 63 2F 73 2F }      // "\0s/c/s/"
        $pkg_s_a_w_m = { 00 73 2F 61 2F 77 2F 6D 2F }   // "\0s/a/w/m/"
    condition:
        uint32(0) == 0x04034B50 and
        (
            hash.sha256(0, filesize) == "f3e4ccd9eaa42a8ff90791fa0a62101bf1aaac5c69f5e314fc91f59f236c068f" or
            ($dispatcher_cd and #pkg_s_c_s > 3 and $pkg_s_a_w_m)
        )
}

rule MC_Static_NulDispatcher_Class
{
    meta:
        author = "mc-yara-rules"
        description = "nul-dispatcher classes: invokedynamic 'Dispatcher' bootstraps in NUL-prefixed packages and the Base64 lookup table"
        severity = "critical"
        family = "nul-dispatcher"
        sample_sha256 = "f3e4ccd9eaa42a8ff90791fa0a62101bf1aaac5c69f5e314fc91f59f236c068f"
        date = "2026-11-06"
    strings:
        // modified UTF-8: C0 80 = NUL
        $disp1 = { C0 80 73 2F 63 2F 73 2F 44 69 73 70 61 74 63 68 65 72 }   // "\0s/c/s/Dispatcher"
        $disp2 = { C0 80 73 2F 61 2F 77 2F 6D 2F 44 69 73 70 61 74 63 68 65 72 EF B8 8F }   // "\0s/a/w/m/Dispatcher️"
        $b64_table = "AAAHTgAtvIgAAAABAASqyYTTAAHcr2NQfQAAAAIACKrLhMmE" ascii
    condition:
        uint32be(0) == 0xCAFEBABE and any of them
}

// ---- lmx_injector.yar ------------------------------------------------------
/*
    Static (sample-specific) rules: "l/M/x" injector.

    A trojanised BlueMap-Towny 2.4.0: the real main class was patched to call l/M/x/__v3_,
    an injected 79-class package with encrypted strings that contains a remote shell over
    TCP/UDP and a zip-filesystem jar infector. The package name may change between builds;
    these rules identify this build.

    *_Jar rules match the raw .jar (zip names / whole-file hash, no extraction needed).
    *_Class rules match extracted .class files.
*/

rule MC_Static_LMX_Injector_Jar
{
    meta:
        author = "mc-yara-rules"
        description = "Jar carrying the injected l/M/x package (entry point __v3_ and string table µv56), or the exact BlueMap-Towny 2.4.0 trojan"
        severity = "critical"
        family = "lmx-injector"
        sample_sha256 = "93cb1112cfebe85ec9549e43c7a076e817f4bdc458adfab68b355379be4f0b26"
        trojanised_plugin = "BlueMap-Towny 2.4.0"
        date = "2026-11-06"
    strings:
        $entry_cd = "l/M/x/__v3_.class" ascii
        $table_cd = { 6C 2F 4D 2F 78 2F C2 B5 76 35 36 2E 63 6C 61 73 73 }   // "l/M/x/µv56.class"
        $pkg = "l/M/x/" ascii
    condition:
        uint32(0) == 0x04034B50 and
        (
            hash.sha256(0, filesize) == "93cb1112cfebe85ec9549e43c7a076e817f4bdc458adfab68b355379be4f0b26" or
            ($entry_cd and $table_cd and #pkg > 40)
        )
}

rule MC_Static_LMX_Injector_Class
{
    meta:
        author = "mc-yara-rules"
        description = "Hook into or classes of the injected l/M/x package: reference to the entry class l/M/x/__v3_ or its encrypted string constants"
        severity = "critical"
        family = "lmx-injector"
        sample_sha256 = "93cb1112cfebe85ec9549e43c7a076e817f4bdc458adfab68b355379be4f0b26"
        date = "2026-11-06"
    strings:
        $hook = "l/M/x/__v3_" ascii   // present in the patched plugin main class and in the entry class itself
        // encrypted string constants (modified UTF-8 bytes) from l/M/x/µv56 and l/M/x/µv
        $enc1 = { EF B7 9A EF BE 87 C7 A4 EF BF B9 EF B6 9F EF BE 8A C7 B3 EF BF B6 EF B7 97 EF BF 89 C7 91 }
        $enc2 = { EF B7 9A EF BE 87 C7 A4 EF BF A6 EF B6 9F EF BE 8A C7 B3 EF BF A9 EF B7 97 EF BF 89 C7 81 }
        $enc3 = { EF BC BA EF BF A8 C6 8A EF BE 88 EF BC 81 EF BF 85 C6 88 EF BE 8C EF BC 80 EF BF B5 C6 81 }
        $enc4 = { EF BC B6 EF BF A8 C6 87 EF BE 82 EF BC 9C EF BF B5 C6 8D EF BE 80 EF BC 94 EF BF 8B C6 81 }
    condition:
        uint32be(0) == 0xCAFEBABE and any of them
}