SEKOIA_Infostealer_Win_Irontiger_Chrome_Stealer

import "pe"

rule SEKOIA_Infostealer_Win_Irontiger_Chrome_Stealer : FILE
{
	meta:
		description = "Detect the chrome_stealer malware"
		author = "Sekoia.io"
		id = "8c5c3ed0-e1ea-4079-b330-ace8724bff2a"
		date = "2023-03-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_irontiger_chrome_stealer.yar#L3-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "dfddebf9623661508e993541106d4dcbb2270b311b2902567bd309810aff58dd"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "passwords.txt"
		$ = "CryptUnprotectData: 0x%08x"
		$ = "cookies.txt"
		$ = "decrypt to %s"
		$ = ".\\chromedb_tmp" wide ascii
		$ = "SELECT ORIGIN_URL,USERNAME_VALUE,PASSWORD_VALUE FROM LOGINS;"
		$ = "decrypt successful!"
		$ = "url: %s"
		$ = "user: %s"
		$ = "pass: %s"
		$ = "aes key:"
		$ = "\\Google\\Chrome\\User Data\\Default\\Login Data" wide
		$ = "password file %s" wide
		$ = "cookies file %s" wide
		$ = "keyfile: %s" wide

	condition:
		( uint16( 0 ) == 0x5A4D and all of them ) or pe.imphash ( ) == "e862f5a6671f9dbd6f53d3d557e568f0"
}