VOLEXITY_Malware_Js_Xeskimmer

rule VOLEXITY_Malware_Js_Xeskimmer : WHEELEDASH FILE
{
	meta:
		description = "Detects JScript code using in skimming credit card details."
		author = "threatintel@volexity.com"
		id = "2c0911cf-a679-5d4e-baad-777745a28e27"
		date = "2021-11-17"
		modified = "2023-11-14"
		reference = "https://github.com/MBThreatIntel/skimmers/blob/master/null_gif_skimmer.js"
		source_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/2021/2021-12-06 - XEGroup/indicators/yara.yar#L79-L114"
		license_url = "https://github.com/volexity/threat-intel/blob/3a9d0b52459877ee866a9a0ba06e60059b778c77/LICENSE.txt"
		hash = "92f9593cfa0a28951cae36755d54de63631377f1b954a4cb0474fa0b6193c537"
		logic_hash = "cc46e9fab5f408fde13c3897d378a1a2e4acb448f40ca4935c19024ebdc252d7"
		score = 75
		quality = 80
		tags = "WHEELEDASH, FILE"
		os = "win"
		os_arch = "all"
		scan_context = "file"
		severity = "critical"
		license = "See license at https://github.com/volexity/threat-intel/blob/main/LICENSE.txt"
		rule_id = 6144
		version = 4

	strings:
		$s1 = ".match(/^([3456]\\d{14,15})$/g" ascii
		$s2 = "^(p(wd|ass(code|wd|word)))" ascii
		$b1 = "c('686569676874')" ascii
		$b2 = "c('7769647468')" ascii
		$c1 = "('696D67')" ascii
		$c2 = "('737263')" ascii
		$magic = "d=c.charCodeAt(b),a+=d.toString(16);"

	condition:
		all of ( $s* ) or all of ( $b* ) or all of ( $c* ) or $magic
}