DITEKSHEN_MALWARE_Win_Agnianestealer

rule DITEKSHEN_MALWARE_Win_Agnianestealer : FILE
{
	meta:
		description = "Detects Agniane infostealer"
		author = "ditekSHen"
		id = "fcbbf748-dc01-579f-a6f8-37e0f3dea35e"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11088-L11114"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0031fbe6d76868819cbcfc638433d60a50e8f5cfd14ff25af88ed3dffefd7d62"
		score = 75
		quality = 75
		tags = "FILE"
		snort = "923828001"
		clamav = "ditekSHen.MALWARE.Win.AgnianeStealer"

	strings:
		$x1 = "Agniane.pdb" ascii
		$x2 = "IEnumerable<Agniane.Classes.LogRecord>." ascii
		$x3 = "Agniane Stealer" wide
		$x4 = "cinoshibot" wide
		$x5 = "yqbiguuno2zp5jxsmqbev4rwckvy27bqws5cgm3hiid7xolt65j72kqd.onion" wide
		$s1 = "<Pass encoding=\"base64\">" wide
		$s2 = "Domain Detect: detected {0}" wide
		$s3 = "DOMAINDETECTCOOKIES" ascii
		$s4 = /(Opera|Edge|Chrome|Brave|Vivaldi|Blink|Universal|Gecko|OperaGx|Firefox)Grabber/ fullword ascii
		$u1 = "/antivm.php?id=" wide
		$u2 = "/ferr.php?id=" wide
		$u3 = ".php?ownerid=" wide
		$u4 = "&buildid=" wide
		$u5 = "&username=" wide
		$u6 = "&BSSID=" wide
		$u7 = "&rndtoken=" wide
		$u8 = "&domaindetects=" wide

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 3 of ( $u* ) ) ) or ( all of ( $s* ) and 3 of ( $u* ) ) or ( 7 of ( $u* ) ) )
}