rule win_scavenger_w0 {

    meta:
        author = "Malware Utkonos"
        date = "2025-07-19"
        description = "Matches Scavenger DLLs related to the ones found in the Prettier NPM supply chain compromise."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.scavenger"
        malpedia_rule_date = "20250719"
        malpedia_hash = ""
        malpedia_version = "20250719"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $op = { b9c4c58fcd 483bc1 75 }
            // 18000d555  b9c4c58fcd         mov     ecx, 0xcd8fc5c4
            // 18000d55a  483bc1             cmp     rax, rcx
            // 18000d55d  7514               jne     0x18000d573

    condition:
        uint16(0) == 0x5a4d and uint32(uint32(0x3c)) == 0x00004550 and $op
}