SEKOIA_Infostealer_Win_Stormkitty

rule SEKOIA_Infostealer_Win_Stormkitty : FILE
{
	meta:
		description = "Finds StormKitty samples (or their variants) based on specific strings"
		author = "Sekoia.io"
		id = "5014d2e5-af5c-4800-ab1e-b57de37a2450"
		date = "2023-03-29"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_stormkitty.yar#L1-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "57a4603faf6af9742db79f9bc8751f3a5c091b6271998434f0a3b9f5c30cb1e8"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$sk01 = "LimerBoy/StormKitty" ascii wide
		$sk02 = "StormKitty-Latest.log" wide
		$sk03 = "StormKitty.exe" ascii
		$sk04 = "Debug\\StormKitty.pdb" ascii
		$sk05 = "StormKitty.Implant" ascii
		$str01 = "set_sUsername" ascii
		$str02 = "set_sIsSecure" ascii
		$str03 = "set_sExpMonth" ascii
		$str04 = "WritePasswords" ascii
		$str05 = "WriteCookies" ascii
		$str06 = "sChromiumPswPaths" ascii
		$str07 = "sGeckoBrowserPaths" ascii
		$str08 = "Username: {1}" wide
		$str09 = "Password: {2}" wide
		$str10 = "encrypted_key\":\"(.*?)\"" wide

	condition:
		uint16( 0 ) == 0x5A4D and ( ( 1 of ( $sk* ) and 3 of ( $str* ) ) or 7 of ( $str* ) )
}