Dohdoor Malware Indicators Behavioral Markers
This rule detects files associated with Dohdoor activity. It uses two primary detection methods: matching known SHA256 file hashes and identifying distinctive text markers. The text markers include strings related to DoH request construction (e.g., 'insomnia/11.3.0', 'Accept: applications/dns-json'), staging path patterns (e.g., '/111111?sub=s'), DLLs and LOLBins used for disguise (e.g., 'propsys.dll', 'Fondue.exe'), and obfuscated infrastructure patterns (e.g., 'MswInSofTUpDloAd', '.DeSigN'). A hash match indicates a strong lead, while text marker matches suggest potential activity requiring further investigation.
YARA
