DITEKSHEN_MALWARE_Win_Clipbanker02

rule DITEKSHEN_MALWARE_Win_Clipbanker02 : FILE
{
	meta:
		description = "Detects ClipBanker infostealer"
		author = "ditekSHen"
		id = "c2a480cf-e81b-53a2-999a-80209050e0cf"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8789-L8814"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "51a43245b1e0b6fea874302b73bf552012c54c3f7c12b8c447c96c2ffdcc1dcb"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$x1 = "\\Allcome\\Source code\\Clipper\\" ascii nocase
		$x2 = "\\cleaper\\Release\\cleaper.pdb" ascii nocase
		$v1_1 = "&username=" fullword ascii
		$v1_2 = "/card.php?data=" fullword ascii
		$v1_3 = "/Create /tn MicrosoftDriver /sc MINUTE /tr" fullword ascii
		$v1_4 = "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0" fullword ascii
		$v1_5 = "/API/Clipper/ykesqk0o.php?cf6zrlhn=" fullword ascii
		$v1_6 = "&di7ztth6=" fullword ascii
		$v1_7 = "/API/Clipper/hr627gzk.php?v6etwxo5=" fullword ascii
		$v2_1 = "bitcoincash:" fullword ascii
		$v2_2 = "\\Microsoft\\Windows\\Start Menu\\Programs\\Startup" ascii
		$re1 = "^[0-9]{16}$" fullword ascii
		$re2 = "^[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}\\s[0-9]{4}" fullword ascii
		$re3 = "^\\d{2}\\D\\d{2}" fullword ascii
		$re4 = "^[0-9]{3}" fullword ascii
		$re5 = "([\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?[0-9]{4}[\\W]?)" fullword ascii
		$re6 = "(\\d{2}\\D\\d{2})" fullword ascii
		$re7 = "(\\d{3})" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 5 of ( $v1* ) or all of ( $v2* ) ) ) or ( 3 of ( $re* ) and ( 2 of ( $v1* ) or 2 of ( $v2* ) ) ) )
}