SEKOIA_Infostealer_Win_Mars_Stealer_Xor_Routine

rule SEKOIA_Infostealer_Win_Mars_Stealer_Xor_Routine : FILE
{
	meta:
		description = "Detect Mars Stealer based on a specific XOR routine"
		author = "Sekoia.io"
		id = "3e2c7440b2fc9e4b039e6fa8152ac8ff"
		date = "2022-04-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_mars_stealer_xor_routine.yar#L1-L15"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "c7e65550a225431552e8a81bbce81dd66350021b6444c94fe7a37aa96712e9b1"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$xor = {8b 4d ?? 03 4d ?? 0f be 19 8b 55 ?? 52 e8 ?? ?? ?? ?? 83 c4 ?? 8b c8 8b 45 ?? 33 d2 f7 f1 8b 45 ?? 0f be 0c 10 33 d9 8b 55 ?? 03 55 ?? 88 1a eb be}

	condition:
		uint16( 0 ) == 0x5A4D and $xor
}