SEKOIA_Infostealer_Win_Titan

rule SEKOIA_Infostealer_Win_Titan : FILE
{
	meta:
		description = "Finds samples of the Titan Stealer"
		author = "Sekoia.io"
		id = "0adbe616-0d91-4b05-b7a8-812cd79f9252"
		date = "2023-01-12"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_titan.yar#L1-L25"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "996dc320c83f57c47afe50ad032bac43ad1fbfbbd5a86e517089a062b0382993"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str0 = "/sendlog" ascii
		$str1 = "/stealer/grabfiles.go" ascii
		$str2 = "/stealer/installedsoft.go" ascii
		$str3 = "/stealer/screenshot.go" ascii
		$str4 = "/stealer/sendlog.go" ascii
		$str5 = "/stealer/userinformation.go" ascii
		$str6 = "C:/Program Files (x86)/Steam/config/" ascii
		$str7 = "/com.liberty.jaxx/IndexedDB/file__0.indexeddb.leveldb/" ascii
		$str8 = "MAC Adresses:" ascii
		$str9 = "/Coowon/Coowon/" ascii
		$str10 = "_/C_/Users/admin/Desktop/stealer_v7/stealer" ascii

	condition:
		uint16( 0 ) == 0x5A4D and 5 of them
}