DITEKSHEN_MALWARE_Win_Hawkeyev9

rule DITEKSHEN_MALWARE_Win_Hawkeyev9
{
	meta:
		description = "Detects HawkEyeV9 payload"
		author = "ditekshen"
		id = "ca59aa45-fb55-5f9a-a224-8bd2b72ce5ac"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2768-L2793"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "d24111930dd0230c01963a90c9fbbc0a0a71df170c2ca116bb329e6158cb681c"
		score = 75
		quality = 75
		tags = ""
		clamav_sig = "MALWARE.Win.Trojan.HawkEyeV9"

	strings:
		$id1 = "HawkEye Keylogger - Reborn v9 - {0} Logs - {1} \\ {2}" wide
		$id2 = "HawkEye Keylogger - Reborn v9{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" wide
		$str1 = "_PasswordStealer" ascii
		$str2 = "_KeyStrokeLogger" ascii
		$str3 = "_ScreenshotLogger" ascii
		$str4 = "_ClipboardLogger" ascii
		$str5 = "_WebCamLogger" ascii
		$str6 = "_AntiVirusKiller" ascii
		$str7 = "_ProcessElevation" ascii
		$str8 = "_DisableCommandPrompt" ascii
		$str9 = "_WebsiteBlocker" ascii
		$str10 = "_DisableTaskManager" ascii
		$str11 = "_AntiDebugger" ascii
		$str12 = "_WebsiteVisitorSites" ascii
		$str13 = "_DisableRegEdit" ascii
		$str14 = "_ExecutionDelay" ascii
		$str15 = "_InstallStartupPersistance" ascii

	condition:
		int16 ( 0 ) == 0x5a4d and ( 1 of ( $id* ) or 5 of ( $str* ) )
}