DITEKSHEN_MALWARE_Win_Cookiestealer

rule DITEKSHEN_MALWARE_Win_Cookiestealer : FILE
{
	meta:
		description = "Detects generic cookie stealer"
		author = "ditekSHen"
		id = "64c6c59d-4046-5949-bf71-22a5f6bfa209"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5841-L5857"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "9cc406ae078e37430b3cf10954c02014b9760bc887344842e724df735d1d9808"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "([\\S]+?)=([^;|^\\r|^\\n]+)" fullword ascii
		$s2 = "(.+?): ([^;|^\\r|^\\n]+)" fullword ascii
		$s3 = "Set-Cookie: ([^\\r|^\\n]+)" fullword ascii
		$s4 = "cmd.exe /c taskkill /f /im chrome.exe" fullword ascii
		$s5 = "FIREFOX.EXE|Google Chrome|IEXPLORE.EXE" ascii
		$pdb1 = "F:\\facebook_svn\\trunk\\database\\Release\\DiskScan.pdb" fullword ascii
		$pdb2 = "D:\\Projects\\crxinstall\\trunk\\Release\\spoofpref.pdb" fullword ascii
		$ua1 = "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36" fullword ascii
		$ua2 = "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.86 Safari/537.36" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( all of ( $s* ) and 1 of ( $pdb* ) and 1 of ( $ua* ) ) or ( all of ( $ua* ) and 1 of ( $pdb* ) and 2 of ( $s* ) ) )
}