DITEKSHEN_MALWARE_Win_Cyberstealer

rule DITEKSHEN_MALWARE_Win_Cyberstealer : FILE
{
	meta:
		description = "Detects CyberStealer infostealer"
		author = "ditekSHen"
		id = "cb02013f-ffb2-5a17-9d6e-1d19b0e98fb8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9920-L9941"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "72413b68fa1381656202165dcd878761727e7caf0f15ccd65f3f2f842243a1f6"
		score = 75
		quality = 71
		tags = "FILE"

	strings:
		$x1 = "\\Cyber Stealer\\" ascii
		$s1 = "[Virtualization]" fullword wide
		$s2 = "\"encryptedPassword\":\"([^\"]+)\"" fullword wide
		$s3 = "CreditCard" fullword ascii
		$s4 = "DecryptPassword" fullword ascii
		$s5 = "_modTime" fullword ascii
		$s6 = "_pathname" fullword ascii
		$s7 = "_pathnameInZip" fullword ascii
		$s8 = "GetBookmarksDBPath" fullword ascii
		$s9 = "GrabberImages" fullword ascii
		$r1 = "^1[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide
		$r2 = "^3[a-km-zA-HJ-NP-Z1-9]{25,34}$" wide
		$r3 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide
		$r4 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide

	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and ( 2 of ( $s* ) or 2 of ( $r* ) ) ) or 7 of ( $s* ) or ( 5 of ( $s* ) and 2 of ( $r* ) ) or ( all of ( $r* ) and 4 of ( $s* ) ) )
}