SEKOIA_Loader_Amadey_Stealer_Plugin

rule SEKOIA_Loader_Amadey_Stealer_Plugin : FILE
{
	meta:
		description = "Finds Amadey's stealer plugin based on characteristic strings"
		author = "Sekoia.io"
		id = "50154e39-98b3-40e5-8986-18bbb7b15647"
		date = "2023-05-16"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/loader_amadey_stealer_plugin.yar#L1-L27"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "0410492f9424797b670a14f43ce063458e59d7958e213c07c3d488a40bf370e6"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "STEALERDLL.dll" ascii
		$str02 = "?wal=1" fullword ascii
		$str03 = "Content-Disposition: form-data; name=\"data\"; filename=\"" ascii
		$str04 = "tar.exe -cf \"" ascii
		$str05 = "SELECT origin_url, username_value, password_value FROM logins" ascii
		$str06 = "\\Google\\Chrome\\User Data\\Default\\Login Data" ascii
		$str07 = "\\SputnikLab\\Sputnik\\User Data\\Default\\Login Data" ascii
		$str08 = "\\Mozilla\\Firefox\\Profiles\\" ascii
		$str09 = "\"hostname\":\"([^\"]+)\"" ascii
		$str10 = "\"encryptedUsername\":\"([^\"]+)\"" ascii
		$str11 = "\"encryptedPassword\":\"([^\"]+)\"" ascii
		$str12 = "&cred=" fullword ascii
		$str13 = "D:\\Mktmp\\Amadey\\StealerDLL\\x64\\Release\\STEALERDLL.pdb" ascii

	condition:
		uint16( 0 ) == 0x5A4D and 7 of them
}