SEKOIA_Infostealer_Win_Nosu

rule SEKOIA_Infostealer_Win_Nosu : FILE
{
	meta:
		description = "Finds Nosu samples based on characteristic strings"
		author = "Sekoia.io"
		id = "9823af25-e30b-4514-a59c-02dd19fe368d"
		date = "2022-12-15"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_nosu.yar#L1-L17"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "f18db2008aa9175fc423133fd6d5872c5750d011aad73c373505347443d5032c"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str0 = "C:\\xampp\\htdocs\\nosu\\core\\release\\lilly.pdb" ascii
		$str1 = "{\"gp\":\"%s\",\"app\":\"%S\"," ascii
		$str2 = "stored in zip:\\%s" wide

	condition:
		uint16( 0 ) == 0x5A4D and 1 of them and filesize < 1MB
}