SEKOIA_Pe_Stealer_Axilestealer_Strings

rule SEKOIA_Pe_Stealer_Axilestealer_Strings : FILE
{
	meta:
		description = "AxileStealer strings"
		author = "Sekoia.io"
		id = "412bfc3e-6bb7-4b0d-8bb3-96eae0cc9782"
		date = "2023-12-13"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/pe_stealer_axilestealer_strings.yar#L1-L28"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "829b80c07ed4d9439d66956dbb106aa0cc9961dd2e5c05ffbe6c67e516613590"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "http://ip-api.com/line/?fields=query,country,countryCode,city,regionName,zip,isp" wide
		$s2 = "Axile.su" wide
		$s3 = "Unknown Tokens.txt" wide
		$a1 = "[ <b>General</b> ]" wide
		$a2 = "[ <b>Browsers</b> ]" wide
		$a3 = "[ <b>Wallets</b> ]" wide
		$a4 = "[ <b>Messengers</b> ]" wide
		$a5 = "[ <b>Applications</b> ]" wide
		$a6 = "[ <b>Games</b> ]" wide
		$a7 = "[ <b>Mails</b> ]" wide
		$a8 = "[ <b>VPNs</b> ]" wide
		$a9 = "[ <b>FTPs</b> ]" wide

	condition:
		uint16be( 0 ) == 0x4d5a and filesize > 50KB and filesize < 200KB and 2 of ( $s* ) and 7 of ( $a* )
}