DITEKSHEN_MALWARE_Win_Orion

rule DITEKSHEN_MALWARE_Win_Orion : FILE
{
	meta:
		description = "Orion Keylogger payload"
		author = "ditekSHen"
		id = "b380b93b-6ceb-5244-aeca-b1f8f9a5b553"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L985-L1005"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9e5521ebaf9bdef6dadd2a2a093bd6f87ded023d9a74db126ac8ec9a5f1f9744"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$s1 = "\\Ranger.BrowserLogging" ascii wide nocase
		$s2 = "GrabAccounts" fullword ascii
		$s3 = "DownloadFile" fullword ascii
		$s4 = "Internet Explorer Recovery" wide
		$s5 = "Outlook Recovery" wide
		$s6 = "Thunderbird Recovery" wide
		$s7 = "Keylogs -" wide
		$s8 = "WebCam_Capture.dll" wide
		$s9 = " is not installed on this computer!" wide
		$s10 = "cmd /c bfsvc.exe \"" wide
		$s11 = "/Keylogs - PC:" fullword wide
		$s12 = "/PC:" fullword wide
		$s13 = "<p style=\"color:#CC7A00\">[" wide

	condition:
		( uint16( 0 ) == 0x5a4d and 5 of ( $s* ) ) or ( 6 of ( $s* ) )
}