SEKOIA_Trojan_Win_Grandoreiro

rule SEKOIA_Trojan_Win_Grandoreiro : FILE
{
	meta:
		description = "Finds Grandorerio samples based on the specific strings"
		author = "Sekoia.io"
		id = "e48c86a1-e34f-4945-817a-9c85198a77bb"
		date = "2022-08-24"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/trojan_win_grandoreiro.yar#L1-L26"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "7424478b0cdfe922c2f98bf42e505f22fb0700cfeb54912630ce404c59b05c5e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$mut = "ZTP@11" wide
		$reg01 = "Software\\Embarcadero\\Locales" wide
		$reg02 = "Software\\CodeGear\\Locales" wide
		$reg03 = "Software\\Borland\\Locales" wide
		$reg04 = "Software\\Borland\\Delphi\\Locale" wide
		$reg05 = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\FontSubstitutes" wide
		$str01 = "SELECT * FROM AntiVirusProduct" wide
		$str02 = "GetTickCount64" wide
		$str03 = "C:\\Program Files (x86)\\Embarcadero\\Studio\\20.0\\lib\\Clever Internet Suite" wide
		$str04 = "{43826D1E-E718-42EE-BC55-A1E261C37BFE}" wide

	condition:
		uint16( 0 ) == 0x5A4D and all of them
}