DITEKSHEN_MALWARE_Win_M00Nd3V

rule DITEKSHEN_MALWARE_Win_M00Nd3V : FILE
{
	meta:
		description = "M00nD3v keylogger payload"
		author = "ditekSHen"
		id = "4000f55d-e072-50b6-b6ee-72cefc0ec53f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L694-L715"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "68a0888da3b114dc895fe18a3d03b2b88d140fbf82b888f7a031b9364d01aabf"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "M00nD3v Stub" ascii wide
		$s2 = "M00nD3v{0}{1} Logs{0}{2} \\ {3}{0}{0}{4}" fullword wide
		$s3 = "Anti-Keylogger Elite" wide
		$s4 = "/C TASKKILL /F /IM" wide
		$s5 = "echo.>{0}:Zone.Identifier" fullword wide
		$s6 = "> Nul & Del \"{0}\" & start \"\" \"{1}.exe\"" wide
		$s7 = "> Nul & start \"\" \"{1}.exe\"" wide
		$s8 = "Stealer" fullword wide
		$s9 = "{0}{0}++++++++++++{1} {2}++++++++++++{0}{0}" wide
		$s10 = "{4}Application: {3}{4}URL: {0}{4}Username: {1}{4}Password: {2}{4}" wide
		$s11 = "encrypted_key\":\"(?<Key>.+?)\"" wide
		$s12 = "Botkiller" fullword ascii
		$s13 = "AVKiller" fullword ascii
		$s14 = "get_pnlPawns" fullword ascii

	condition:
		( uint16( 0 ) == 0x5a4d and 6 of them ) or ( 9 of them )
}