YARA · SEKOIA.IO Community

SEKOIA_Infostealer_Win_Redline_Strings

Finds Redline samples based on characteristic strings

MalwareRedLineSEKOIA.IO CommunityDetection Rule License 1.1Compila con YARA-X

Autor: Sekoia.io
Fecha: 2022-09-07
Modificada: 2024-12-19
Puntuación / Calidad: 75 / 78

Qué detecta esta regla

Finds Redline samples based on characteristic strings

Familia de malware asociada: RedLine.

Objetivos: PE de Windows.

Define 31 patrones (31 de texto, 0 hex, 0 regex).

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar

infostealer-win-redline-strings.yarDetection Rule License 1.1

rule SEKOIA_Infostealer_Win_Redline_Strings : FILE
{
	meta:
		description = "Finds Redline samples based on characteristic strings"
		author = "Sekoia.io"
		id = "0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e"
		date = "2022-09-07"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_redline_strings.yar#L1-L47"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "44443e16b788231b3f256b4d1e91c458c33963d5737d69fc5850f6b0efa7726b"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$gen01 = "ChromeGetRoamingName" ascii
		$gen02 = "ChromeGetLocalName" ascii
		$gen03 = "get_UserDomainName" ascii
		$gen04 = "get_encrypted_key" ascii
		$gen05 = "browserPaths" ascii
		$gen06 = "GetBrowsers" ascii
		$gen07 = "get_InstalledInputLanguages" ascii
		$gen08 = "BCRYPT_INIT_AUTH_MODE_INFO_VERSION" ascii
		$spe0 = "Profile_encrypted_value" wide
		$spe1 = "[AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}" wide
		$spe2 = "AFileSystemntivFileSystemirusPrFileSystemoduFileSystemct|AntiFileSystemSpyWFileSystemareProFileSystemduct|FireFileSystemwallProdFileSystemuct" wide
		$spe3 = "OpHandlerenVPHandlerN ConHandlernect%DSK_23%Opera GXcookies" wide
		$spe4 = "//settinString.Removeg[@name=\\PasswString.Removeord\\]/valuString.RemoveeROOT\\SecurityCenter" wide
		$spe5 = "ROOT\\SecurityCenter2Web DataSteamPath" wide
		$spe6 = "windows-1251, CommandLine:" wide
		$spe7 = "OFileInfopeFileInfora GFileInfoX StabFileInfole" wide
		$spe8 = "ApGenericpDaGenericta\\RGenericoamiGenericng\\" wide
		$spe9 = "*wallet*" wide
		$typ01 = "359A00EF6C789FD4C18644F56C5D3F97453FFF20" ascii
		$typ02 = "F413CEA9BAA458730567FE47F57CC3C94DDF63C0" ascii
		$typ03 = "A937C899247696B6565665BE3BD09607F49A2042" ascii
		$typ04 = "D67333042BFFC20116BF01BC556566EC76C6F7E2" ascii
		$typ05 = "4E3D7F188A5F5102BEC5B820632BBAEC26839E63" ascii
		$typ06 = "FB10FF1AD09FE8F5CA3A85B06BC96596AF83B350" ascii
		$typ07 = "77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60" ascii
		$typ08 = "A8F9B62160DF085B926D5ED70E2B0F6C95A25280" ascii
		$typ09 = "718D1294A5C2D3F3D70E09F2F473155C4F567201" ascii
		$typ10 = "2FBDC611D3D91C142C969071EA8A7D3D10FF6301" ascii
		$typ11 = "2A19BFD7333718195216588A698752C517111B02" ascii
		$typ12 = "EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2" ascii
		$typ13 = "04EC68A0FC7D9B6A255684F330C28A4DCAB91F13" ascii

	condition:
		uint16( 0 ) == 0x5A4D and ( 7 of ( $gen* ) or 3 of ( $spe* ) or 2 of ( $typ* ) )
}

Cadenas (31 patrones)

Identificador	Tipo	Valor	Modificadores
$gen01	texto	"ChromeGetRoamingName"	ascii
$gen02	texto	"ChromeGetLocalName"	ascii
$gen03	texto	"get_UserDomainName"	ascii
$gen04	texto	"get_encrypted_key"	ascii
$gen05	texto	"browserPaths"	ascii
$gen06	texto	"GetBrowsers"	ascii
$gen07	texto	"get_InstalledInputLanguages"	ascii
$gen08	texto	"BCRYPT_INIT_AUTH_MODE_INFO_VERSION"	ascii
$spe0	texto	"Profile_encrypted_value"	wide
$spe1	texto	"[AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}"	wide
$spe2	texto	"AFileSystemntivFileSystemirusPrFileSystemoduFileSystemct\|AntiFileSystemSpyWFileSystemareProFileSystemduct\|FireFileSystemwallProdFileSystemuct"	wide
$spe3	texto	"OpHandlerenVPHandlerN ConHandlernect%DSK_23%Opera GXcookies"	wide
$spe4	texto	"//settinString.Removeg[@name=\\PasswString.Removeord\\]/valuString.RemoveeROOT\\SecurityCenter"	wide
$spe5	texto	"ROOT\\SecurityCenter2Web DataSteamPath"	wide
$spe6	texto	"windows-1251, CommandLine:"	wide
$spe7	texto	"OFileInfopeFileInfora GFileInfoX StabFileInfole"	wide
$spe8	texto	"ApGenericpDaGenericta\\RGenericoamiGenericng\\"	wide
$spe9	texto	"wallet"	wide
$typ01	texto	"359A00EF6C789FD4C18644F56C5D3F97453FFF20"	ascii
$typ02	texto	"F413CEA9BAA458730567FE47F57CC3C94DDF63C0"	ascii
$typ03	texto	"A937C899247696B6565665BE3BD09607F49A2042"	ascii
$typ04	texto	"D67333042BFFC20116BF01BC556566EC76C6F7E2"	ascii
$typ05	texto	"4E3D7F188A5F5102BEC5B820632BBAEC26839E63"	ascii
$typ06	texto	"FB10FF1AD09FE8F5CA3A85B06BC96596AF83B350"	ascii
$typ07	texto	"77A9683FAF2EC9EC3DABC09D33C3BD04E8897D60"	ascii
$typ08	texto	"A8F9B62160DF085B926D5ED70E2B0F6C95A25280"	ascii
$typ09	texto	"718D1294A5C2D3F3D70E09F2F473155C4F567201"	ascii
$typ10	texto	"2FBDC611D3D91C142C969071EA8A7D3D10FF6301"	ascii
$typ11	texto	"2A19BFD7333718195216588A698752C517111B02"	ascii
$typ12	texto	"EB7EF1973CDC295B7B08FE6D82B9ECDAD1106AF2"	ascii
$typ13	texto	"04EC68A0FC7D9B6A255684F330C28A4DCAB91F13"	ascii

Condición

uint16( 0 ) == 0x5A4D and ( 7 of ( $gen* ) or 3 of ( $spe* ) or 2 of ( $typ* ) )

En palabras sencillas (Heurística)

El archivo debe empezar por «MZ»: un ejecutable de Windows (PE).
Deben coincidir al menos 7 patrones de ( $gen* ).
Deben coincidir al menos 3 patrones de ( $spe* ).
Deben coincidir al menos 2 patrones de ( $typ* ).

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

https://github.com/SEKOIA-IO/Community

Licencia y atribución

Autor: Sekoia.io

Repositorio de origen: SEKOIA.IO Community @ a438a5901a

Licencia: Detection Rule License 1.1 (licencia del repositorio)

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: 0c9fcb0e-ce8f-44f4-90b2-abafcdd6c02e

Metadatos

version	1.0
classification	TLP:CLEAR

Etiquetas:FILE

ESET_Cw_Windows_Redline_Panel_Distinctive_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Prompts
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Status_Message_Strings
MalwareESET malware-ioc· ESET Research· 2022-10-11
ESET_Cw_Windows_Redline_Panel_Tab_Headers
MalwareESET malware-ioc· ESET Research· 2022-10-11
EMBEERESEARCH_Win_Redline_Bytecodes_Jan_2024
MalwareEmbee Research· Matthew @ Embee_Research· 2023-08-27
EMBEERESEARCH_Win_Redline_Loader_Dec_2023
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24
EMBEERESEARCH_Win_Redline_Payload_Dec_2023
MalwareEmbee Research· Matthew @ Embee_Research· 2023-12-24
EMBEERESEARCH_Win_Redline_Updated_Bytecodes_Oct_2023
MalwareEmbee Research· Matthew @ Embee_Research· 2023-10-11

Más reglas de RedLine