SEKOIA_Infostealer_Win_Stealerium

rule SEKOIA_Infostealer_Win_Stealerium : FILE
{
	meta:
		description = "Detects Stealerium based on specific strings"
		author = "Sekoia.io"
		id = "165c7d3d-de7e-4d71-b94a-8ab4a0e5ddd5"
		date = "2022-12-01"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_stealerium.yar#L1-L36"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "f420848164ad4b6966f2a776a58d90b7d70c8b151a42d6f56b654f1700b5e564"
		score = 75
		quality = 78
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$stl = "Stealerium" ascii wide
		$str01 = "Processe: " wide
		$str02 = "Compname: " wide
		$str03 = "Language: " wide
		$str04 = "SandBoxie: " wide
		$str05 = "== System Info ==" wide
		$str06 = "== Hardware ==" wide
		$str07 = "== Domains ==" wide
		$str08 = "WEBCAMS COUNT: " wide
		$str09 = "[Virtualization]" wide
		$str10 = "[Open google maps](" wide
		$str11 = "Remember password: " wide
		$str12 = "Target.Browsers.Firefox" ascii
		$str13 = "Modules.Keylogger" ascii
		$str14 = "ClipperAddresses" ascii
		$str15 = "ChromiumPswPaths" ascii
		$str16 = "DetectedBankingServices" ascii
		$str17 = "DetectCryptocurrencyServices" ascii
		$str18 = "CheckRemoteDebuggerPresent" ascii
		$str19 = "GetConnectedCamerasCount" ascii
		$str20 = "costura.discord-webhook-client.dll.compressed" ascii wide

	condition:
		uint16( 0 ) == 0x5A4D and filesize > 1MB and ( ( #stl > 5 and 2 of ( $str* ) ) or 15 of ( $str* ) )
}