DITEKSHEN_MALWARE_Win_Krakenstealer

rule DITEKSHEN_MALWARE_Win_Krakenstealer : FILE
{
	meta:
		description = "Detect Kraken infostealer"
		author = "ditekSHen"
		id = "460eb574-99c9-5f78-9efa-7a8808aaaae7"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11009-L11030"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "7f15823db706e6e51d8ea58fb026efb49f42234255d2f448614dc645d12648bb"
		score = 75
		quality = 73
		tags = "FILE"
		snort = "923828002"

	strings:
		$x1 = /Kraken(_)?(Stub|Keyboard|Clipboard|GeneratorMachine|PostLogs|Screenshot|Keylogs|Password)/ ascii wide
		$s1 = /(get|set)_(Clipboard|Keyboard|Screen)Recorder/ fullword ascii
		$s2 = /Dumping(FileZilla|360_China|Opera|Epic|CocCoc|Thunderbird|Brave)/ fullword ascii
		$s3 = "ScreenPostData" fullword ascii
		$s4 = "encrypt_data" fullword ascii
		$s5 = "KeyboardProc" fullword ascii
		$s6 = "UploadsKeyboard" fullword ascii
		$s7 = "ClpUploader" fullword ascii
		$s8 = "StartKeylogger" fullword ascii
		$s9 = "ClipoDetectedRemover" fullword ascii
		$s10 = "Disable_Regis" fullword ascii
		$s11 = "RecordedClips" fullword ascii
		$s12 = "HoneyPotStatus" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( 1 of ( $x* ) and 2 of ( $s* ) ) or 9 of ( $s* ) )
}