SEKOIA_Apt_Gamaredon_Flash_Infostealer

rule SEKOIA_Apt_Gamaredon_Flash_Infostealer : FILE
{
	meta:
		description = "Detects the Gamaredon's Flash InfoStealer"
		author = "Sekoia.io"
		id = "f060fe4b-74fd-4ef3-ac86-916e2113ff24"
		date = "2023-01-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/apt_gamaredon_flash_infostealer.yar#L1-L21"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "5a3ee8c2c3c377bea7de1993e5ef744796130643575bcce1b6181d68190aafb7"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$a1 = "Content-Type: multipart/form-data; boundary=----%s" ascii
		$a2 = "Content-Disposition: form-data; name=\"p\"" ascii
		$a3 = "Content-Type: application/octet-stream"
		$w1 = "%s||%s||%s||%s" wide
		$w2 = "Pragma: no-cache" wide
		$w3 = { 64 00 6F 00 63 00 00 00 00 00 2E 00 64 00 6F 00 63 00 78 00 }

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 500KB and 2 of ( $a* ) and 2 of ( $w* )
}