SEKOIA_Apt_Implant_Xdealer_Stealer_Strings

rule SEKOIA_Apt_Implant_Xdealer_Stealer_Strings : FILE
{
	meta:
		description = "Detects stealer module of XDealer"
		author = "Sekoia.io"
		id = "6314cf6c-2c3b-4e9a-87a1-b56ee148474c"
		date = "2024-03-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_implant_xdealer_stealer_strings.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "79ba2fd14cd2eb73848026f79ce6115df813e0fda3a071ab26659874e04e2201"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "%sbmp.tmp"
		$ = "%sjgp.tmp"
		$ = "%sma_%s_%05u_%u."
		$ = "%s%s_%05u_%u."

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 500KB and all of them
}