DITEKSHEN_MALWARE_Win_Avalon

rule DITEKSHEN_MALWARE_Win_Avalon : FILE
{
	meta:
		description = "Avalon infostealer payload"
		author = "ditekSHen"
		id = "3de01419-9f45-5d82-8391-2e1e41df2b34"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1330-L1359"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "1aa9dc09ec4c8962dee0455dd367e32139e4c03f1b306f17ac6e82d71aacf713"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "Parsecards" fullword ascii
		$s2 = "Please_Gofuckyouself" fullword ascii
		$s3 = "GetDomainDetect" fullword ascii
		$s4 = "GetTotalCommander" fullword ascii
		$s5 = "KnownFolder" fullword ascii
		$s6 = "set_hidden" fullword ascii
		$s7 = "set_system" fullword ascii
		$l1 = "\\DomainDetect.txt" wide
		$l2 = "\\Grabber_Log.txt" wide
		$l3 = "\\Programs.txt" wide
		$l4 = "\\Passwords_Edge.txt" wide
		$l5 = "\\KL.txt" wide
		$w1 = "dont touch" fullword wide
		$w2 = "Grabber" fullword wide
		$w3 = "Keylogger" fullword wide
		$w4 = "password-check" fullword wide
		$w5 = "H4sIAAAAAAAEA" wide
		$p1 = "^(?!:\\/\\/)([a-zA-Z0-9-_]+\\.)*[a-zA-Z0-9][a-zA-Z0-9-_]+\\.[a-zA-Z]{2,11}?$" wide
		$p2 = "^([a-zA-Z0-9_\\-\\.]+)@([a-zA-Z0-9_\\-\\.]+)\\.([a-zA-Z]{2,5})$" wide

	condition:
		uint16( 0 ) == 0x5a4d and 8 of them
}