DITEKSHEN_MALWARE_Win_Darkeye

rule DITEKSHEN_MALWARE_Win_Darkeye : FILE
{
	meta:
		description = "Detects DarkEye infostealer"
		author = "ditekSHen"
		id = "5296fe28-b54e-5d0f-aa2f-2050db585d82"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9751-L9770"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5496dcbfe075a4030a446027765186e9dd1931561a29a481139281e1708ce87d"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$c1 = /Prynt(\s)?Stealer/ ascii wide
		$c2 = /WorldWind(\s)?Stealer/ ascii wide
		$c3 = "ToxicEye" ascii wide
		$x2 = "@FlatLineStealer" ascii wide
		$x3 = "@CashOutGangTalk" ascii wide
		$s1 = "--- Clipper" wide
		$s2 = "Downloading file: \"{file}\"" wide
		$s3 = "/bot{0}/getUpdates?offset={1}" wide
		$s4 = "send command to bot!" wide
		$s5 = " *Keylogger " fullword wide
		$s6 = "*Stealer" wide
		$s7 = "Bot connected" wide

	condition:
		uint16( 0 ) == 0x5a4d and not any of ( $c* ) and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) ) )
}