SEKOIA_Infostealer_Win_Blackcap

rule SEKOIA_Infostealer_Win_Blackcap : FILE
{
	meta:
		description = "Finds BlackCap Grabber samples (Python code obfuscated using Py-Fuscate)"
		author = "Sekoia.io"
		id = "1aa1fadb-3413-46e2-b733-1ad2134f7be2"
		date = "2023-03-06"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_blackcap.yar#L1-L19"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "b826c88d557ea0a516534946ad9531eda1a875cb9c4ddf92d9b98f8c7b86623e"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$imp01 = "import asyncio, json, ntpath, random, re, shutil, sqlite3, subprocess, threading, winreg, zipfile, httpx, psutil, win32gui, win32con, pyperclip, base64, requests, ctypes, time" ascii
		$imp02 = "from ctypes import windll, wintypes, byref, cdll, Structure, POINTER, c_char, c_buffer;from Crypto.Cipher import AES;from PIL import ImageGrab;from win32crypt import CryptUnprotectData" ascii
		$pyf01 = "import marshal,lzma,gzip,bz2,binascii,zlib;exec(marshal.loads(binascii.a2b_base64(b'YwAAAAAA" ascii

	condition:
		($imp01 in ( 0 .. 500 ) and $pyf01 in ( @imp01 + 200 .. @imp01 + 1000 ) or $imp02 in ( 0 .. 1000 ) and $pyf01 in ( @imp02 + 100 .. @imp02 + 500 ) ) and filesize > 100KB and filesize < 500KB
}