title: Suspicious Encoded Obfuscated LOAD String
id: 9c0295ce-d60d-40bd-bd74-84673b7592b1
status: test
description: Detects suspicious base64 encoded and obbfuscated LOAD string often used for reflection.assembly load
author: pH-T
related:
  - id: 62b7ccc9-23b4-471e-aa15-6da3663c4d59
    type: similar
date: 2022/03/01
modified: 2022/05/20
tags:
    - attack.execution
    - attack.t1059.001
    - attack.defense_evasion
    - attack.t1027
references:
    - https://github.com/Neo23x0/Raccine/blob/main/yara/mal_revil.yar
    - https://thedfirreport.com/2022/05/09/seo-poisoning-a-gootloader-story/
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      # ::("L"+"oad")
      - 'OgA6ACgAIgBMACIAKwAiAG8AYQBkACIAKQ'
      - 'oAOgAoACIATAAiACsAIgBvAGEAZAAiACkA'
      - '6ADoAKAAiAEwAIgArACIAbwBhAGQAIgApA'
      # ::("Lo"+"ad")
      - 'OgA6ACgAIgBMAG8AIgArACIAYQBkACIAKQ'
      - 'oAOgAoACIATABvACIAKwAiAGEAZAAiACkA'
      - '6ADoAKAAiAEwAbwAiACsAIgBhAGQAIgApA'
      # ::("Loa"+"d")
      - 'OgA6ACgAIgBMAG8AYQAiACsAIgBkACIAKQ'
      - 'oAOgAoACIATABvAGEAIgArACIAZAAiACkA'
      - '6ADoAKAAiAEwAbwBhACIAKwAiAGQAIgApA'
      # ::('L'+'oad')
      - 'OgA6ACgAJwBMACcAKwAnAG8AYQBkACcAKQ'
      - 'oAOgAoACcATAAnACsAJwBvAGEAZAAnACkA'
      - '6ADoAKAAnAEwAJwArACcAbwBhAGQAJwApA'
      # ::('Lo'+'ad')
      - 'OgA6ACgAJwBMAG8AJwArACcAYQBkACcAKQ'
      - 'oAOgAoACcATABvACcAKwAnAGEAZAAnACkA'
      - '6ADoAKAAnAEwAbwAnACsAJwBhAGQAJwApA'
      # ::('Loa'+'d')
      - 'OgA6ACgAJwBMAG8AYQAnACsAJwBkACcAKQ'
      - 'oAOgAoACcATABvAGEAJwArACcAZAAnACkA'
      - '6ADoAKAAnAEwAbwBhACcAKwAnAGQAJwApA'
  condition: selection
fields:
  - CommandLine
falsepositives:
  - Unlikely
level: high
