DITEKSHEN_MALWARE_Win_Agentteslav3

rule DITEKSHEN_MALWARE_Win_Agentteslav3 : FILE
{
	meta:
		description = "AgentTeslaV3 infostealer payload"
		author = "ditekSHen"
		id = "c44c69dd-5e95-595c-88c7-89e243648198"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1448-L1481"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "6c62b2f601eba3c83b60f7f6dbd3d0ec3c01af30f4312df897bb5e902c36fdac"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$s1 = "get_kbok" fullword ascii
		$s2 = "get_CHoo" fullword ascii
		$s3 = "set_passwordIsSet" fullword ascii
		$s4 = "get_enableLog" fullword ascii
		$s5 = "bot%telegramapi%" wide
		$s6 = "KillTorProcess" fullword ascii
		$s7 = "GetMozilla" ascii
		$s8 = "torbrowser" wide
		$s9 = "%chatid%" wide
		$s10 = "logins" fullword wide
		$s11 = "credential" fullword wide
		$s12 = "AccountConfiguration+" wide
		$s13 = "<a.+?href\\s*=\\s*([\"'])(?<href>.+?)\\1[^>]*>" fullword wide
		$g1 = "get_Clipboard" fullword ascii
		$g2 = "get_Keyboard" fullword ascii
		$g3 = "get_Password" fullword ascii
		$g4 = "get_CtrlKeyDown" fullword ascii
		$g5 = "get_ShiftKeyDown" fullword ascii
		$g6 = "get_AltKeyDown" fullword ascii
		$m1 = "yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time" ascii
		$m2 = "%image/jpg:Zone.Identifier\\tmpG.tmp%urlkey%-f \\Data\\Tor\\torrcp=%PostURL%127.0.0.1POST+%2B" ascii
		$m3 = ">{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\\WScript.ShellRegReadg401" ascii
		$m4 = "%startupfolder%\\%insfolder%\\%insname%/\\%insfolder%\\Software\\Microsoft\\Windows\\CurrentVersion\\Run%insregname%SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\StartupApproved\\RunTruehttp" ascii
		$m5 = "\\WindowsLoad%ftphost%/%ftpuser%%ftppassword%STORLengthWriteCloseGetBytesOpera" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 6 of ( $* ) and all of ( $g* ) ) ) ) or ( 2 of ( $m* ) )
}