SEKOIA_Infostealer_Win_Agrat

rule SEKOIA_Infostealer_Win_Agrat : FILE
{
	meta:
		description = "No description has been set in the source file - SEKOIA"
		author = "Sekoia.io"
		id = "472effe8-5044-4ca1-88e0-3e19d445b9d1"
		date = "2022-06-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_agrat.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "5b02880dbc75d9e4d95ec55c8e8630a47198ee4cc25e3ff79c93e9fe634fadca"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str00 = "Vault.txt" wide
		$str01 = "Credman.txt" wide
		$str02 = "[Networks] {0}" wide
		$str03 = "[Screenshot] {0}" wide
		$str04 = "[Twitch] {0}" wide
		$str05 = "Servers.txt" wide
		$str06 = "[WindscribeVPN] {0}" wide
		$str07 = "[{0}] Thread finished!" wide
		$str08 = "[ERROR] Unable to enumerate vaults. Error (0x" wide
		$str09 = "snowflake-ssh" wide
		$str10 = "//setting[@name='Password']/value" wide
		$str11 = "MakeScreenshot" ascii
		$sys = "System.Collections.Generic.IEnumerator<Stealer." ascii

	condition:
		uint16( 0 ) == 0x5A4D and all of them and #sys > 10
}