SEKOIA_Infostealer_Win_Phoenixwave

rule SEKOIA_Infostealer_Win_Phoenixwave : FILE
{
	meta:
		description = "Detect the PhoenixWave infostealer based on specific strings"
		author = "Sekoia.io"
		id = "67c05ea8-2f1b-4c60-b108-e05d7d0c6508"
		date = "2022-04-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_phoenixwave.yar#L1-L35"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "efeffb2f0df4c2f8156c401bac5f44c415c4c3e02e84e8db55dad68488f39fea"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str0 = "##################################################\n                  Information\n##################################################\n" wide
		$str1 = "Specify a single character: either D or F" wide
		$str2 = "// This SFX source file was generated by DotNetZip " wide
		$str3 = "aHR0cDovL2lwLWFwaS5jb20vanNvbg==" wide
		$str4 = "TG9jYWxBcHBEYXRh" wide
		$str5 = "UGhvZW5peFdhdmU=" wide
		$str6 = "virustotal" wide
		$str7 = "SELECT * FROM win32_operatingsystem" wide
		$str8 = "SELECT * FROM Win32_VideoController" wide
		$app0 = "\\discordcanary\\Local Storage\\leveldb" wide
		$app1 = "\\discordptb\\Local Storage\\leveldb" wide
		$app2 = "\\discorddevelopment\\Local Storage\\leveldb" wide
		$app3 = "\\D877F783D5D3EF8C\\" wide
		$app4 = "\\IndexedDB\\file__0.indexeddb.leveldb" wide
		$app5 = "\\Steam\\Games.txt" wide
		$app6 = "nkbihfbeogaeaoehlefnkodbefgpgknn" wide
		$app7 = "fhbohimaelbohpjbbldcngcnapndodjp" wide
		$app8 = "fnjhmkhhmkbjkkabndcnnogagogbneec" wide
		$app9 = "\\Opera Software\\Opera GX Stable" wide

	condition:
		uint16( 0 ) == 0x5A4D and 7 of ( $str* ) and 8 of ( $app* )
}