SEKOIA_Suspicious_Users_Dev

rule SEKOIA_Suspicious_Users_Dev : FILE
{
	meta:
		description = "Nirscord stealer"
		author = "Sekoia.io"
		id = "9e8af456-6f84-4922-a262-20b8f5c8a1eb"
		date = "2022-12-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/suspicious_users_dev.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "6084b319efb7b4137517c63dd2ed1023a4b25513b7ac50e95154bbac0fea0af7"
		score = 65
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$user1 = "\\Users\\raghus1\\" ascii
		$user2 = "\\Users\\drill\\" ascii
		$key = {58 69 b3 5f b3 87 74 f6 65 eb 96 e7 6f 4d 16 83 }

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 6MB and 1 of ( $user* ) and $key
}