SEKOIA_Infostealer_Win_Lighting

rule SEKOIA_Infostealer_Win_Lighting : FILE
{
	meta:
		description = "Detect the Lighting infostealer based on specific strings"
		author = "Sekoia.io"
		id = "3c160c16-f417-4fa2-aa44-fb7b981fb2b3"
		date = "2022-04-07"
		modified = "2024-12-19"
		reference = "https://blog.cyble.com/2022/04/05/inside-lightning-stealer/"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_lighting.yar#L1-L40"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "1c1d39ce886a433a352c55bf436b959ef528ad7ce38027243ed5b5f1ac79822f"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str0 = "\\logins.json" wide
		$str1 = "key3.db" wide
		$str2 = "\\key4.db" wide
		$str3 = "cert9.db" wide
		$str4 = "\\places.sqlite" wide
		$str5 = "7D78CB380BF5EFB7B851409CA6A875F77DECF09D19B9149DA17A3EBF674BC0F9" ascii
		$str6 = "potentiallyVulnerablePasswords" wide
		$dll0 = "\\mozglue.dll" wide
		$dll1 = "\\nss3.dll" wide
		$dll2 = "SbieDll.dll" wide
		$app00 = "\\discord\\Local Storage\\leveldb\\" wide
		$app01 = "Software\\Valve\\Steam" wide
		$app02 = "Telegram Desktop\\tdata" wide
		$app03 = "\\Wallets\\Armory\\" wide
		$app04 = "\\Wallets\\Atomic\\Local Storage\\leveldb\\" wide
		$app05 = "\\Exodus\\exodus.wallet\\" wide
		$app06 = "\\Wallets\\Zcash\\" wide
		$app07 = "uCozMedia\\Uran" wide
		$app08 = "Comodo\\IceDragon" wide
		$app09 = "8pecxstudios\\Cyberfox" wide
		$app10 = "NETGATE Technologies\\BlackHaw" wide
		$app11 = "Moonchild Productions\\Pale Moon" wide

	condition:
		uint16( 0 ) == 0x5A4D and 6 of ( $str* ) and all of ( $dll* ) and 10 of ( $app* )
}