Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1

Detects typical stealer output files as created by RedLine or Racoon stealer

Suspicious / huntingRedLineSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Florian Roth (Nextron Systems)
Date
2022-09-17
Modified
2023-12-05
Score / Quality
70 / 85

What this rule detects

Detects typical stealer output files as created by RedLine or Racoon stealer

Associated malware family: RedLine.

It defines 8 patterns (8 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-mal-exfil-stealer-output-characteristics-sep22-1.yarDetection Rule License 1.1
rule SIGNATURE_BASE_SUSP_MAL_EXFIL_Stealer_Output_Characteristics_Sep22_1 : FILE
{
	meta:
		description = "Detects typical stealer output files as created by RedLine or Racoon stealer"
		author = "Florian Roth (Nextron Systems)"
		id = "c1cab3c3-c4f3-5a19-9ea3-9e4242238359"
		date = "2022-09-17"
		modified = "2023-12-05"
		reference = "https://twitter.com/cglyer/status/1570965878480719873"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_stealer_exfil_zip.yar#L2-L30"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "8ce14c6b720281f43c75ce52e23ec13d08e7b2be1c5fbc2d704238f1fdd1a07f"
		hash = "011c19d18fa446a2619b3a2512dacb2694e1da99a2c2ea7828769f1373ecd8fe"
		hash = "418530bc7210f74ada8e7f16b41ea2033054e99f0c4423ce1d3ebf973c89e3a3"
		hash = "aa6e2c8447f66527f9b6f4d54f57edc6cabe56095df94dc0656dca02e11356ab"
		hash = "bbfb608061931565debac405ffebe3c4bb5dac8042443fe4e80aa03395955bd2"
		hash = "c15107beecf3301fb12d140690034717e16bd5312a746e7ff43a7925e5533260"
		logic_hash = "197bb4b837cdd635f9340547b10a90c3a2a17f0113076c5ccbc0a91b7ae18eeb"
		score = 70
		quality = 85
		tags = "FILE"

	strings:
		$sa1 = "passwords.txt" ascii
		$sa2 = "autofills/" ascii
		$sa3 = "browsers/cookies/" ascii
		$sa4 = "wallets/" ascii
		$sb1 = "Passwords.txt" ascii
		$sb2 = "Autofills/" ascii
		$sb3 = "Browsers/Cookies/" ascii
		$sb4 = "Wallets/" ascii

	condition:
		uint16( 0 ) == 0x4b50 and filesize < 5000KB and ( 2 of ( $sa* ) or 2 of ( $sb* ) )
}

Strings (8 patterns)

IdentifierTypeValueModifiers
$sa1text"passwords.txt"ascii
$sa2text"autofills/"ascii
$sa3text"browsers/cookies/"ascii
$sa4text"wallets/"ascii
$sb1text"Passwords.txt"ascii
$sb2text"Autofills/"ascii
$sb3text"Browsers/Cookies/"ascii
$sb4text"Wallets/"ascii

Condition

uint16( 0 ) == 0x4b50 and filesize < 5000KB and ( 2 of ( $sa* ) or 2 of ( $sb* ) )

In plain words (Heuristic)

  • The file must start with “PK” — a ZIP archive (also Office Open XML, JAR, APK).
  • The file must be smaller than 5000KB (a cheap guard that skips large files).
  • At least 2 patterns in ( $sa* ) must match.
  • At least 2 patterns in ( $sb* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 8ce14c6b720281f43c75ce52e23ec13d08e7b2be1c5fbc2d704238f1fdd1a07f
  • 011c19d18fa446a2619b3a2512dacb2694e1da99a2c2ea7828769f1373ecd8fe
  • 418530bc7210f74ada8e7f16b41ea2033054e99f0c4423ce1d3ebf973c89e3a3
  • aa6e2c8447f66527f9b6f4d54f57edc6cabe56095df94dc0656dca02e11356ab
  • bbfb608061931565debac405ffebe3c4bb5dac8042443fe4e80aa03395955bd2
  • c15107beecf3301fb12d140690034717e16bd5312a746e7ff43a7925e5533260

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: c1cab3c3-c4f3-5a19-9ea3-9e4242238359

Tags:FILE

Related rules

More RedLine rules