SEKOIA_Infostealer_Win_Ginzostealer_Str

rule SEKOIA_Infostealer_Win_Ginzostealer_Str : FILE
{
	meta:
		description = "Finds samples of the Ginzo Stealer"
		author = "Sekoia.io"
		id = "ef87e94b-9c53-44b4-b8a1-87d371a6d2cb"
		date = "2022-04-21"
		modified = "2024-12-19"
		reference = "https://blog.talosintelligence.com/2022/04/haskers-gang-zingostealer.html"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_ginzostealer_str.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "b1c811a13cf0f632ac839b6a6de050fc59ffe3ed0704545feff02e13521ea53f"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str0 = "Ginzo.pdb" ascii
		$str1 = "Ginzo.exe" wide
		$str2 = "SELECT creation_utc,top_frame_site_key,host_key,name,value,encrypted_value,path,expires_utc,is_secure,is_httponly,last_access_utc,has_expires,is_persistent,priority,samesite,source_scheme,source_port,is_same_party FROM cookies" wide
		$str3 = "SELECT origin_url,action_url,username_element,username_value,password_element,password_value,submit_element,signon_realm,date_created,blacklisted_by_user,scheme,password_type,times_used,form_data,display_name,icon_url,federation_url,skip_zero_click,generation_upload_status,possible_username_pairs,id,date_last_used,moving_blocked_for,date_password_modified FROM logins" wide
		$str4 = "SELECT id,originAttributes,name,value,host,path,expiry,lastAccessed,creationTime,isSecure,isHttpOnly,inBrowserElement,sameSite,rawSameSite,schemeMap FROM moz_cookies" wide

	condition:
		uint16( 0 ) == 0x5A4D and 4 of them
}