SEKOIA_Infostealer_Win_Eternity

import "pe"

rule SEKOIA_Infostealer_Win_Eternity : FILE
{
	meta:
		description = "Detect the Eternity infostealer based on specific strings"
		author = "Sekoia.io"
		id = "0ed8d4bd-d57f-40a8-a709-d69531d59847"
		date = "2022-03-23"
		modified = "2024-12-19"
		reference = "hxxp://xssforumv3isucukbxhdhwz67hoa5e2voakcfkuieq4ch257vsburuid.]onion/threads/62331/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_eternity.yar#L3-L31"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "06f0f7f51100278160f5bc4f588bb6a9d749be308f879bd5704666bf90764bf9"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str0 = "Sending info to Eternity.." wide
		$str1 = "Debug mode, dont share this stealer anywhere." wide
		$str2 = "\\Growtopia.exe" wide
		$str3 = "Software\\Growtopia" wide
		$str4 = "Corrupting Growtopia.." wide
		$str5 = "Disabling Task Manager.." wide
		$str6 = "Deleting previous file from startup and copying new one." wide
		$str7 = "Hiding file in Startup folder.." wide
		$str8 = "Initializing File watcher.." wide
		$str9 = "Decoder: Failed to delete temp login. No problem, continuing.." wide
		$str10 = "dcd.exe" wide

	condition:
		uint16( 0 ) == 0x5A4D and ( for any i in ( 0 .. pe.number_of_sections -1 ) : ( pe.sections [ i ] . name == ".eter0" ) and for any i in ( 0 .. pe.number_of_sections -1 ) : ( pe.sections [ i ] . name == ".eter1" ) ) or 4 of ( $str* )
}