SEKOIA_Stealer_Win_Luca

import "pe"

rule SEKOIA_Stealer_Win_Luca : FILE
{
	meta:
		description = "Detect Luca stealer. Open source Rust stealer."
		author = "Sekoia.io"
		id = "d2cc1442-0ba5-4e81-9fea-e9e078903eed"
		date = "2022-07-26"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/stealer_win_luca.yar#L3-L49"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "3694db49d84f92c70c51e4fe6f126fd56b3d7d8ed26619137fd55b0adb97865e"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "cookies"
		$ = "creditcards"
		$ = "/Default/Network/CookiesUser Data/Default/Network/Cookies_cookies"
		$ = "/Default/Web DataUser Data/Default/Web Data_webdata"
		$ = "SELECT action_url, username_value, password_value FROM loginsSELECT card_number_encrypted, name_on_card, expiration_month, expiration_year FROM credit_cardsSELECT host_key, name, encrypted_value, path, expires_utc, is_secure FROM cookiesLOCALAPPDATA"
		$ = "\\logsxc\\passwords_.txt"
		$ = " Name:"
		$ = "User: "
		$ = "Installed Languages:  "
		$ = "Operating System: "
		$ = "Used/Installed RAM:  GB "
		$ = "Cores available: "
		$ = "\\screen-.png"
		$ = "Username: "
		$ = "Computer name: "
		$ = "OS: "
		$ = "Language: "
		$ = "Hostname: "
		$ = "=> networks: B"
		$ = "=> system:total memory:  KB"
		$ = "used memory : "
		$ = "total swap  : "
		$ = "used swap   : "
		$ = "NB CPUs: "
		$ = "Passwords: "
		$ = "Wallets: "
		$ = "Files: "
		$ = "Credit Cards: "
		$ = "sensfiles.zip"

	condition:
		uint16( 0 ) == 0x5A4D and filesize > 4000KB and pe.rich_signature.toolid ( 0 , 0 ) and pe.number_of_resources == 0 and 15 of them
}