DITEKSHEN_MALWARE_Win_Lummastealer

rule DITEKSHEN_MALWARE_Win_Lummastealer : FILE
{
	meta:
		description = "Detects Lumma Stealer"
		author = "ditekSHen"
		id = "b54521ab-4a31-5c1c-8ef2-b08b0f713693"
		date = "2034-02-17"
		date = "2034-02-17"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9829-L9854"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "74014c5bcc85977b90faed93b348c34e47ee033b06c2f145348ca9c54c27bda5"
		score = 75
		quality = 73
		tags = "FILE"
		clamav1 = "MALWARE.Win.Trojan.LummaStealer"

	strings:
		$x1 = /Lum[0-9]{3}xedmaC2,\sBuild/ ascii
		$x2 = /LID\(Lu[0-9]{3}xedmma\sID\):/ ascii
		$s1 = /os_c[0-9]{3}xedrypt\.encry[0-9]{3}xedpted_key/ fullword ascii
		$s2 = "c2sock" wide
		$s3 = "c2conf" wide
		$s4 = "TeslaBrowser/" wide
		$s5 = "Software.txt" fullword wide
		$s6 = "SysmonDrv" fullword
		$s7 = "*.eml" fullword wide nocase
		$s8 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall" wide
		$s9 = "- Screen Resoluton:" ascii
		$s10 = "lid=%s" ascii
		$s11 = "&ver=" ascii
		$s12 = "769cb9aa22f4ccc412f9cbc81feedd" fullword wide
		$s13 = "gapi-node.io" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) or 5 of ( $s* ) or 7 of them )
}