BLACKBERRY_Mal_Infostealer_Win32_Blackguard

import "pe"

rule BLACKBERRY_Mal_Infostealer_Win32_Blackguard : FILE
{
	meta:
		description = "Detects W32 BlackGuard Infostealer"
		author = "BlackBerry Threat Research team "
		id = "e079de0f-c607-5089-b385-ba67ed2cb73e"
		date = "2022-04-14"
		modified = "2022-07-06"
		reference = "https://blogs.blackberry.com/en/2022/04/threat-thursday-blackguard-infostealer"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Blackberry/Mal_Infostealer_Win32_BlackGuard.yar#L3-L39"
		license_url = "N/A"
		hash = "6ab3b21fa7cb638ed68509be1ed6302284e8a9cd1a10f9b6837c057154aa6162"
		logic_hash = "6e819ee656b6d696be1e818eeb8a545e7934c1f5a1171a1192422d8c74c0caa2"
		score = 75
		quality = 85
		tags = "FILE"
		license = "This Yara rule is provided under the Apache License 2.0 (https://www.apache.org/licenses/LICENSE-2.0) and open to any user or organization, as long as you use it under this license and ensure originator credit in any derivative to The BlackBerry Research & Intelligence Team"

	strings:
		$a1 = { 06 91 06 61 20 AA 00 00 00 61 D2 9C 06 17 58 0A }
		$a2 = "System.Data.SQLite"
		$a3 = "FromBase64String"
		$a4 = "BlockInput"
		$a5 = "UploadFile"
		$a6 = "Passwords"
		$a7 = "Discord"
		$a8 = "GetVolumeInformationA"
		$a9 = "NordVPN"
		$a10 = "OpenVPN"
		$a11 = "ProtonVPN"
		$a12 = "OperaCookies"
		$a13 = "EdgeCookies"
		$a14 = "ChromeCookies"
		$b1 = "upche" wide

	condition:
		uint16( 0 ) == 0x5a4d and pe.imphash ( ) == "f34d5f2d4577ed6d9ceec516c1f5a744" and pe.number_of_sections == 3 and pe.section_index ( ".text" ) == 0 and pe.section_index ( ".rsrc" ) == 1 and pe.section_index ( ".reloc" ) == 2 and ( ( all of ( $a* ) ) or ( ( 12 of ( $a* ) and all of ( $b* ) ) ) )
}