YARA · SEKOIA.IO Community

SEKOIA_Suspicious_Users_Dev

Nirscord stealer

Suspicious / huntingSEKOIA.IO CommunityDetection Rule License 1.1Compiles with YARA-X

Author: Sekoia.io
Date: 2022-12-22
Modified: 2024-12-19
Score / Quality: 65 / 80

What this rule detects

Nirscord stealer

Targets: Windows PE.

It defines 3 patterns (2 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

suspicious-users-dev.yarDetection Rule License 1.1

rule SEKOIA_Suspicious_Users_Dev : FILE
{
	meta:
		description = "Nirscord stealer"
		author = "Sekoia.io"
		id = "9e8af456-6f84-4922-a262-20b8f5c8a1eb"
		date = "2022-12-22"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/suspicious_users_dev.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "6084b319efb7b4137517c63dd2ed1023a4b25513b7ac50e95154bbac0fea0af7"
		score = 65
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$user1 = "\\Users\\raghus1\\" ascii
		$user2 = "\\Users\\drill\\" ascii
		$key = {58 69 b3 5f b3 87 74 f6 65 eb 96 e7 6f 4d 16 83 }

	condition:
		uint16be( 0 ) == 0x4d5a and filesize < 6MB and 1 of ( $user* ) and $key
}

Strings (3 patterns)

Identifier	Type	Value	Modifiers
$user1	text	"\\Users\\raghus1\\"	ascii
$user2	text	"\\Users\\drill\\"	ascii
$key	hex	{58 69 b3 5f b3 87 74 f6 65 eb 96 e7 6f 4d 16 83 }

Condition

uint16be( 0 ) == 0x4d5a and filesize < 6MB and 1 of ( $user* ) and $key

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 6MB (a cheap guard that skips large files).
At least 1 patterns in ( $user* ) must match.
Pattern $key must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/SEKOIA-IO/Community

Licence & attribution

Author: Sekoia.io

Source repository: SEKOIA.IO Community @ a438a5901a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 9e8af456-6f84-4922-a262-20b8f5c8a1eb

Metadata

version	1.0
classification	TLP:CLEAR

Tags:FILE

SEKOIA_Guloader_Unpacker
Suspicious / huntingSEKOIA.IO Community· Sekoia.io· 2024-02-07
SEKOIA_Guloader_Unpacker_Decoded
Suspicious / huntingSEKOIA.IO Community· Sekoia.io· 2024-02-07
SEKOIA_Koi_Powershell_Loading_Obfuscatednet
Suspicious / huntingSEKOIA.IO Community· Sekoia.io· 2024-03-20
SEKOIA_Infostealer_Win_Blackcap
Suspicious / huntingSEKOIA.IO Community· Sekoia.io· 2023-03-06
SEKOIA_Ta410_Control_Flow_Obfuscation
Suspicious / huntingSEKOIA.IO Community· Sekoia.io· 2022-10-11
SEKOIA_Apt_Gobrat_2
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-09-10
SEKOIA_Apt_Icepeony_Icecache
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21
SEKOIA_Apt_Icepeony_Iceevent
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2024-10-21