DITEKSHEN_MALWARE_Win_Stealerium

rule DITEKSHEN_MALWARE_Win_Stealerium : FILE
{
	meta:
		description = "Detects Stealerium infostealer"
		author = "ditekSHen"
		id = "ea137900-3add-54b4-9ce9-bc7e98f86d41"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10027-L10042"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a2834e7fe26ad0197a9e490ab517029ceed2e09506fcc37e6ddf0c1804fa6cb9"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$x1 = "Stealerium" ascii wide
		$x2 = /\.Target\.(Passwords|Messengers|Browsers|VPN|Gaming)\./ ascii
		$x3 = /\.Modules\.(Keylogger|Implant|Passwords|Messengers|Browsers|VPN|Gaming|Clipper)\./ ascii
		$s1 = "Timeout /T 2 /Nobreak" fullword wide
		$s2 = "Directory not exists" wide
		$s3 = "### {0} ### ({1})" wide
		$s4 = /---\s(AntiAnalysis|WebcamScreenshot|Keylogger|Clipper)/ wide
		$s5 = " *Keylogger " fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $x* ) or ( 2 of ( $x* ) and all of ( $s* ) ) )
}