SEKOIA_Infostealer_Win_Enigma_Stealer_Module

rule SEKOIA_Infostealer_Win_Enigma_Stealer_Module : FILE
{
	meta:
		description = "Find stealer module of Enigma Stealer based on specific strings"
		author = "Sekoia.io"
		id = "664fe8de-b406-4d63-9a4b-1c350b444f02"
		date = "2023-01-30"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_enigma_stealer_module.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		hash = "4d2fb518c9e23c5c70e70095ba3b63580cafc4b03f7e6dce2931c54895f13b2c"
		logic_hash = "0a6615d65867a160e1c87fbcfe30090d44d7f5c25b3a904f8719be7b385b14bb"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$eni01 = "enigma.common" nocase ascii wide
		$eni02 = "--ENIGMA STEALER--" wide
		$str01 = "SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')" wide
		$str02 = "/C chcp 65001 && netsh wlan show profile | findstr All" wide
		$str03 = "/C chcp 65001 && netsh wlan show networks mode=bssid" wide
		$str04 = "[Open google maps]" wide
		$str05 = "Stealerium.Target." ascii
		$str06 = "--- ClipperBCH ---" wide
		$str07 = "//setting[@name='Username']/value" wide
		$str08 = "Stealer >> Failed recursive remove directory with passwords" wide
		$str09 = "[a-zA-Z0-9]{24}\\.[a-zA-Z0-9]{6}\\.[a-zA-Z0-9_\\-]{27}|mfa\\.[a-zA-Z0-9_\\-]{84}" wide
		$str10 = "^(5018|5020|5038|6304|6759|6761|6763)[0-9]{8,15}$" wide

	condition:
		uint16( 0 ) == 0x5A4D and 1 of ( $eni* ) and 4 of ( $str* )
}