SEKOIA_Rat_Win_Millenium

rule SEKOIA_Rat_Win_Millenium : FILE
{
	meta:
		description = "Finds MilleniumRAT samples based on the specific strings"
		author = "Sekoia.io"
		id = "91320924-5c74-457a-8601-29c4e4034761"
		date = "2023-11-16"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/rat_win_millenium.yar#L1-L30"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "bcf4158b9bfee65cd9bd74163ac108ea1de8ec0e9ad066e77bec788ae6fb7283"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "Millenium RAT, version:" wide
		$str02 = "Coded by @shinyenigma" wide
		$str03 = "*gift*<NEW TOKEN>*<NEW CHAT ID>*<message> - gift this bot to another user, his telegram bot has to be started" wide
		$str04 = "*historyForce - grab more browser history by killing browser processes, use carefully" wide
		$str05 = "*download - victim`s PC downloads a file attached to this message, if it is a picture it should also be attached as a file" wide
		$str06 = "No keylogs recorded!" wide
		$str07 = "Successfully added RAT to startup" wide
		$str08 = "You`ve gifted gifted a bot:" wide
		$str09 = "Incorrect agrument, please enter 0/90/180/270" wide
		$str10 = "SELECT action_url, username_value, password_value FROM logins" wide
		$str11 = "Yandex\\YandexBrowser\\User Data\\Default" wide
		$str12 = "Millenium-rat-CSharp (main project)" ascii
		$str13 = "get_BatteryLifePercent" ascii
		$str14 = "get_ExpirationMonth" ascii
		$str15 = "sqlite3_extension_init " ascii

	condition:
		uint16( 0 ) == 0x5A4D and 10 of ( $str* )
}