SEKOIA_Infostealer_Win_Phoenix

rule SEKOIA_Infostealer_Win_Phoenix : FILE
{
	meta:
		description = "Finds Phoenix Stealer samples based on specific strings"
		author = "Sekoia.io"
		id = "d63a8fcf-f897-4c36-a6ce-4bd4ae0154e5"
		date = "2023-06-20"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_phoenix.yar#L1-L33"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "c8a3a9a36c978cfc28fc6e21af10894161279dfd2e2ad665c3296fda10f6303d"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "nkbihfbeogaeaoehlefnkodbefgpgknn" ascii
		$str02 = "Discord\\Tokens.txt" ascii
		$str03 = "SOFTWARE\\OpenVP" ascii
		$str04 = "config_dir" ascii
		$str05 = "| Last Login:" ascii
		$str06 = "| Games:" ascii
		$str07 = "| Host:" ascii
		$str08 = "| Port:" ascii
		$str09 = "| User:" ascii
		$str10 = "| Pass:" ascii
		$str11 = "Grabber.rar" ascii
		$str12 = "\\GHISLER\\wcx_ftp.ini" ascii
		$str13 = "Clipboard.txt" ascii
		$str14 = "PROCESSOR_ARCHITECTURE" ascii
		$str15 = "PROCESSOR_IDENTIFIER" ascii
		$str16 = "Log.txt" ascii
		$str17 = "xXxXxXxXxXx" ascii
		$str18 = "hq101ejedmwcvvasd02kw" ascii

	condition:
		uint16( 0 ) == 0x5a4d and 15 of them and filesize > 500KB
}