SEKOIA_Infostealer_Win_Xehook_Str

rule SEKOIA_Infostealer_Win_Xehook_Str : FILE
{
	meta:
		description = "Finds XehookStealer standalone samples based on specific strings."
		author = "Sekoia.io"
		id = "fa76988d-f0a2-4fc2-a122-c104fd585f34"
		date = "2024-06-12"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/infostealer_win_xehook_str.yar#L1-L32"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "543ec3b523e5f00d3c285e453c8d11f3d5c7778b2986b7fe03f2d62ff18c2778"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$str01 = "xehook" ascii
		$str02 = "Classes.LogRecord" ascii
		$str03 = "__  _____| |__   ___   ___ | | __" wide
		$str04 = "\\ \\/ / _ \\ '_ \\ / _ \\ / _ \\| |/ /" wide
		$str05 = " >  <  __/ | | | (_) | (_) |   <" wide
		$str06 = "/_/\\_\\___|_| |_|\\___/ \\___/|_|\\_\\" wide
		$str07 = "https://t.me/xehook" wide
		$str08 = "About PC.txt" wide
		$str09 = "Browser: {4} v{5} ({6})" wide
		$str10 = "http://ip-api.com/json/?fields=11827" wide
		$str11 = "{0}gate.php?id={1}&build={2}&passwords={3}&cookies={4}" wide
		$str12 = "getjson.php?id=" wide
		$com01 = "CheckRemoteDebuggerPresent" ascii
		$com02 = "get_CurrentThread" ascii
		$com03 = "get_InstalledInputLanguages" ascii
		$com04 = "get_Ticks" ascii
		$com05 = "System.Security.Cryptography" ascii

	condition:
		uint16( 0 ) == 0x5A4D and 2 of ( $str* ) and 4 of ( $com* )
}