Skip to content
yararules.org
Menu

YARA · SEKOIA.IO Community

SEKOIA_Infostealer_Win_Redline_Strings

Finds Redline samples based on characteristic strings

MalwareRedLineSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X
Author
Sekoia.io
Date
2022-09-07
Modified
2024-12-19
Score / Quality
75 / 78

What this rule detects

Finds Redline samples based on characteristic strings

Associated malware family: RedLine.

Targets: Windows PE.

It defines 31 patterns (31 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
infostealer-win-redline-strings.yarDetection Rule License 1.1
rule SEKOIA_Infostealer_Win_Redline_Strings : FILE
{
	meta:
		description = "Finds Redline samples based on characteristic strings"
		author = "Sekoia.io"
		id = "0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e"
		date = "2022-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_redline_strings.yar#L1-L47"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "44443e16b788231b3f256b4d1e91c458c33963d5737d69fc5850f6b0efa7726b"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$gen01 = "ChromeGetRoamingName" ascii
		$gen02 = "ChromeGetLocalName" ascii
		$gen03 = "get_UserDomainName" ascii
		$gen04 = "get_encrypted_key" ascii
		$gen05 = "browserPaths" ascii
		$gen06 = "GetBrowsers" ascii
		$gen07 = "get_InstalledInputLanguages" ascii
		$gen08 = "BCRYPT_INIT_AUTH_MODE_INFO_VERSION" ascii
		$spe0 = "Profile_encrypted_value" wide
		$spe1 = "[AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}" wide
		$spe2 = "AFileSystemntivFileSystemirusPrFileSystemoduFileSystemct|AntiFileSystemSpyWFileSystemareProFileSystemduct|FireFileSystemwallProdFileSystemuct" wide
		$spe3 = "OpHandlerenVPHandlerN ConHandlernect%DSK_23%Opera GXcookies" wide
		$spe4 = "//settinString.Removeg[@name=\\PasswString.Removeord\\]/valuString.RemoveeROOT\\SecurityCenter" wide
		$spe5 = "ROOT\\SecurityCenter2Web DataSteamPath" wide
		$spe6 = "windows-1251, CommandLine:" wide
		$spe7 = "OFileInfopeFileInfora GFileInfoX StabFileInfole" wide
		$spe8 = "ApGenericpDaGenericta\\RGenericoamiGenericng\\" wide
		$spe9 = "*wallet*" wide
		$typ01 = "359A00EF6C789FD4C18644F56C5D3F97453FFF20" ascii
		$typ02 = "F413CEA9BAA458730567FE47F57CC3C94DDF63C0" ascii
		$typ03 = "A937C899247696B6565665BE3BD09607F49A2042" ascii
		$typ04 = "D67333042BFFC20116BF01BC556566EC76C6F7E2" ascii
		$typ05 = "4E3D7F188A5F5102BEC5B820632BBAEC26839E63" ascii
		$typ06 = "FB10FF1AD09FE8F5CA3A85B06BC96596AF83B350" ascii
		$typ07 = "77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60" ascii
		$typ08 = "A8F9B62160DF085B926D5ED70E2B0F6C95A25280" ascii
		$typ09 = "718D1294A5C2D3F3D70E09F2F473155C4F567201" ascii
		$typ10 = "2FBDC611D3D91C142C969071EA8A7D3D10FF6301" ascii
		$typ11 = "2A19BFD7333718195216588A698752C517111B02" ascii
		$typ12 = "EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2" ascii
		$typ13 = "04EC68A0FC7D9B6A255684F330C28A4DCAB91F13" ascii

	condition:
		uint16( 0 ) == 0x5A4D and ( 7 of ( $gen* ) or 3 of ( $spe* ) or 2 of ( $typ* ) )
}

Strings (31 patterns)

IdentifierTypeValueModifiers
$gen01text"ChromeGetRoamingName"ascii
$gen02text"ChromeGetLocalName"ascii
$gen03text"get_UserDomainName"ascii
$gen04text"get_encrypted_key"ascii
$gen05text"browserPaths"ascii
$gen06text"GetBrowsers"ascii
$gen07text"get_InstalledInputLanguages"ascii
$gen08text"BCRYPT_INIT_AUTH_MODE_INFO_VERSION"ascii
$spe0text"Profile_encrypted_value"wide
$spe1text"[AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}"wide
$spe2text"AFileSystemntivFileSystemirusPrFileSystemoduFileSystemct|AntiFileSystemSpyWFileSystemareProFileSystemduct|FireFileSystemwallProdFileSystemuct"wide
$spe3text"OpHandlerenVPHandlerN ConHandlernect%DSK_23%Opera GXcookies"wide
$spe4text"//settinString.Removeg[@name=\\PasswString.Removeord\\]/valuString.RemoveeROOT\\SecurityCenter"wide
$spe5text"ROOT\\SecurityCenter2Web DataSteamPath"wide
$spe6text"windows-1251, CommandLine:"wide
$spe7text"OFileInfopeFileInfora GFileInfoX StabFileInfole"wide
$spe8text"ApGenericpDaGenericta\\RGenericoamiGenericng\\"wide
$spe9text"*wallet*"wide
$typ01text"359A00EF6C789FD4C18644F56C5D3F97453FFF20"ascii
$typ02text"F413CEA9BAA458730567FE47F57CC3C94DDF63C0"ascii
$typ03text"A937C899247696B6565665BE3BD09607F49A2042"ascii
$typ04text"D67333042BFFC20116BF01BC556566EC76C6F7E2"ascii
$typ05text"4E3D7F188A5F5102BEC5B820632BBAEC26839E63"ascii
$typ06text"FB10FF1AD09FE8F5CA3A85B06BC96596AF83B350"ascii
$typ07text"77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60"ascii
$typ08text"A8F9B62160DF085B926D5ED70E2B0F6C95A25280"ascii
$typ09text"718D1294A5C2D3F3D70E09F2F473155C4F567201"ascii
$typ10text"2FBDC611D3D91C142C969071EA8A7D3D10FF6301"ascii
$typ11text"2A19BFD7333718195216588A698752C517111B02"ascii
$typ12text"EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2"ascii
$typ13text"04EC68A0FC7D9B6A255684F330C28A4DCAB91F13"ascii

Condition

uint16( 0 ) == 0x5A4D and ( 7 of ( $gen* ) or 3 of ( $spe* ) or 2 of ( $typ* ) )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 7 patterns in ( $gen* ) must match.
  • At least 3 patterns in ( $spe* ) must match.
  • At least 2 patterns in ( $typ* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Metadata

version1.0
classificationTLP:CLEAR

Tags:FILE

Related rules

More RedLine rules