DITEKSHEN_MALWARE_Win_Metastealer

rule DITEKSHEN_MALWARE_Win_Metastealer : FILE
{
	meta:
		description = "Detects MetaStealer infostealer"
		author = "ditekSHen"
		id = "46aa30c1-12c2-56df-8c65-0b96147f9051"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11400-L11423"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "260c6d90a89ddb6219a5cbad18058e41611ae2dc68a8d4e589fa6ca81853752f"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "! #\"'&(&*)>=@?POQOROSOTOUOVOWOXOYOZO[O^]{z|z}z~z" fullword wide
		$s2 = "{0}{1}{2}" fullword wide
		$s3 = "localhost" fullword wide
		$s4 = "\\tdata" fullword wide
		$s5 = "DecryptBlob" fullword ascii
		$s6 = "GetMac" fullword ascii
		$s7 = "GetHdc" fullword ascii
		$s8 = "FindProc" fullword ascii
		$s9 = "targetPid" fullword ascii
		$s10 = "MessageSecurityOverTcp" fullword ascii
		$s11 = "ListOfProcesses" fullword ascii
		$s12 = "ListOfPrograms" fullword ascii
		$s13 = "browserPaths" fullword ascii
		$s14 = "configs" fullword ascii
		$s15 = "scanners" fullword ascii
		$s16 = "FileScannerRule" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and 7 of ( $s* )
}