SEKOIA_Infostealer_Win_Nekostealer

rule SEKOIA_Infostealer_Win_Nekostealer : FILE
{
	meta:
		description = "Detect the NekoStealer infostealer based on specific strings"
		author = "Sekoia.io"
		id = "8b7d2708-9d33-4855-8e02-f6afedb7dda8"
		date = "2023-01-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_nekostealer.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "f027775bebb48ceb128392040ec2ac8ad84f2a2009760c040e4d376c2f06b663"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$nek = "NekoStealer.Stealing" ascii
		$str01 = "\\Local Storage\\leveldb" wide
		$str02 = "======================= Discord Tokens =======================" wide
		$str03 = "======================== IP Information ========================" wide
		$str04 = "https://ipapi.co/" wide

	condition:
		uint16( 0 ) == 0x5A4D and ( #nek > 10 or all of ( $str* ) )
}