BLACKBERRY_Mal_Infostealer_Win32_Jupyter_Main_Module

import "pe"

rule BLACKBERRY_Mal_Infostealer_Win32_Jupyter_Main_Module
{
	meta:
		description = "Detects Jupter main module"
		author = "BlackBerry Threat Research Team"
		id = "b6c51dcc-bdf4-5960-b407-70379b948dc1"
		date = "2021-11-23"
		modified = "2022-07-06"
		reference = "https://blogs.blackberry.com/en/2022/01/threat-thursday-jupyter-infostealer-is-a-master-of-disguise"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_Win32_Jupyter_Main_Module.yar#L3-L42"
		license_url = "N/A"
		logic_hash = "bf14defaa9b0c514ddbdd4ed09b69a670d432dd30a3bbe4895ad7f9a796c1897"
		score = 75
		quality = 83
		tags = ""
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

	strings:
		$g1 = { 68 00 74 00 74 00 70 00 3A 00 2F 00 2F 00 }
		$g2 = { 5C 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 5C 00 52 00 4F 00 41 00 4D 00 49 00 4E 00 47 }
		$g3 = { 63 00 68 00 61 00 6E 00 67 00 65 00 5F 00 73 00 74 00 61 00 74 00 75 00 73 }
		$g4 = { 50 00 4F 00 53 00 54 }
		$g5 = { 69 00 73 00 5F 00 73 00 75 00 63 00 63 00 65 00 73 00 73 }
		$g6 = { 75 00 73 00 65 00 72 00 70 00 72 00 6F 00 66 00 69 00 6C 00 65 }
		$g7 = { 44 00 45 00 53 00 4B 00 54 00 4F 00 50 00 2D }
		$g8 = { 4C 00 41 00 50 00 54 00 4F 00 50 00 2D }
		$g9 = { 78 00 38 00 36}
		$g10 = { 78 00 36 00 34 }
		$g11 = { 41 00 64 00 6D 00 69 00 6E }
		$g12 = { 56 00 69 00 73 00 74 00 61 }
		$g13 = { 64 00 6E 00 73 }
		$g14 = { 64 00 7A 00 6B 00 61 00 62 72 }
		$g15 = { 78 00 7A 00 6B 00 61 00 62 00 73 00 72 }
		$g16 = { 64 00 7A 00 6B 00 61 00 62 00 73 00 72 }
		$h1 = { 4F 00 43 00 2D }
		$h2 = { 4E 00 56 00 2D }
		$h3 = { 53 00 50 00 2D }
		$h4 = { 49 00 4E 00 2D }
		$i = "System.Net"

	condition:
		10 of ( $g* ) and 1 of ( $h* ) and ( pe.imports ( "mscoree.dll" , "_CorDllMain" ) or $i )
}