DITEKSHEN_MALWARE_Win_Qulab

rule DITEKSHEN_MALWARE_Win_Qulab
{
	meta:
		description = "Qulab information stealer payload or artifacts"
		author = "ditekSHen"
		id = "6ae24c67-5700-5330-a3bd-d542162faebb"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L959-L983"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "659d828cbef38c6362b612be9bdc05ae820f49c23684e77af6462ea677133284"
		score = 75
		quality = 75
		tags = ""
		clamav_sig = "MALWARE.Win.Trojan.QulabZ-Stealer"

	strings:
		$x1 = "QULAB CLIPPER + STEALER" ascii wide
		$x2 = "MASAD CLIPPER + STEALER" ascii wide
		$x3 = "http://teleg.run/Qulab" ascii wide
		$x4 = "http://teleg.run/jew_seller" ascii wide
		$x5 = "BUY CLIPPER + STEALER" ascii wide
		$s1 = "\\Screen.jpg" ascii wide
		$s2 = "attrib +s +h \"" ascii wide
		$s3 = "\\x86_microsoft-windows-" ascii wide
		$s4 = "\\amd64_microsoft-windows-" ascii wide
		$s5 = "Desktop TXT File" ascii wide
		$s6 = "\\AutoFills.txt" ascii wide
		$s7 = "\\CreditCards.txt" ascii wide
		$s8 = "a -y -mx9 -ssw" ascii wide
		$s9 = "\\Passwords.txt" ascii wide
		$s10 = "\\Information.txt" ascii wide
		$s11 = "\\getMe" ascii wide

	condition:
		9 of them or ( ( 1 of ( $x* ) and 4 of ( $s* ) ) or 1 of ( $x* ) )
}