DITEKSHEN_MALWARE_Win_Multi_Family_Infostealer

rule DITEKSHEN_MALWARE_Win_Multi_Family_Infostealer : FILE
{
	meta:
		description = "Detects Prynt, WorldWind, DarkEye, Stealerium and ToxicEye / TelegramRAT infostealers"
		author = "ditekSHen"
		id = "960830ba-df0d-539d-be2a-7778229f79bd"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9681-L9703"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "0fdd1cdc4f2e5bee6c763e6e6b2e79d85285e44e2b5e3168a56d7d360252ee99"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$n1 = /Prynt|WorldWind|DarkEye(\s)?Stealer/ ascii wide
		$n2 = "Stealerium" ascii wide
		$x1 = "@FlatLineStealer" ascii wide
		$x2 = "@CashOutGangTalk" ascii wide
		$x3 = /\.Target\.(Passwords|Messengers|Browsers|VPN|Gaming)\./ ascii
		$x4 = /\.Modules\.(Keylogger|Implant|Passwords|Messengers|Browsers|VPN|Gaming|Clipper)\./ ascii
		$s1 = "Timeout /T 2 /Nobreak" fullword wide
		$s2 = /---\s(AntiAnalysis|WebcamScreenshot|Keylogger|Clipper)/ wide
		$s3 = "Downloading file: \"{file}\"" wide
		$s4 = "/bot{0}/getUpdates?offset={1}" wide
		$s5 = "send command to bot!" wide
		$s6 = " *Keylogger " fullword wide
		$s7 = "*Stealer" wide
		$s8 = "Bot connected" wide
		$s9 = "### {0} ### ({1})" wide

	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}