SEKOIA_Radx_Stealer

rule SEKOIA_Radx_Stealer : FILE
{
	meta:
		description = "detection of RADX stealer based on function named in the .NET payload"
		author = "Sekoia.io"
		id = "bf2aae08-169c-4bc9-a1ac-80f4b79ef6d7"
		date = "2023-12-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/radx_stealer.yar#L1-L20"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "b83ca089bb0ea7ad8b0f372de9a95ea9d35514f6a063b63986e6fd25bdc07095"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$s1 = "get_FileName" ascii fullword
		$s2 = "set_FileName" ascii fullword
		$f1 = "TripleDESCryptoServiceProvider" ascii fullword
		$f2 = "SendBase64ToServer" ascii fullword
		$f3 = "SendCommandOutputToServer" ascii fullword

	condition:
		( uint32be( 0 ) == 0x7f454c46 or uint16be( 0 ) == 0x4d5a ) and filesize > 500KB and all of them
}