SEKOIA_Keylogger_Win_Donot

rule SEKOIA_Keylogger_Win_Donot
{
	meta:
		description = "Detect the DoNot's keylogger malware"
		author = "Sekoia.io"
		id = "4f67dda7-da68-4496-a8b4-a8a769ddd763"
		date = "2023-03-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/keylogger_win_donot.yar#L1-L16"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "eb935f84335e934346511b4108f70df469deef6ecaaba809c144197c04a28f64"
		score = 75
		quality = 80
		tags = ""
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "iwrct2mTFAu0ew1nyqQgoaNtNo0+52R0XiTKbwy1W48Bn1b2YcNt0+tptyY6oGoAeLDGekM/yHcdikNGi8bLqkUQ8CIdkWeT3QiympOTfjs="
		$ = "ZmVwZW9kbWZ2c24ucHMuZ3h4LngweXBvdWpkYm1qcXE7YnFmVXp1LmZvb3VEcA=="

	condition:
		1 of them
}