stealer-fingerprints/families/cs_count_core_stealer/rules.yar at main · cystack/stealer-fingerprints · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
// YARA rules for CSCountCoreStealer.
// Each rule fires on either a unique banner string or the full
// observed field-key set. Tune false-positive thresholds at use
// site, especially for variants relying on field combinations.

rule CSCountCoreStealer_cystack_012b9023
{
    meta:
        family = "CSCountCoreStealer"
        fingerprint_id = "cystack_012b9023"

    strings:
        $key_0 = "Arch:" ascii
        $key_1 = "Count Core:" ascii
        $key_2 = "Hostname:" ascii
        $key_3 = "IP Address:" ascii
        $key_4 = "User Info:" ascii
        $key_5 = "Version:" ascii

    condition:
        all of ($key_*)
}

rule CSCountCoreStealer_cystack_58103687
{
    meta:
        family = "CSCountCoreStealer"
        fingerprint_id = "cystack_58103687"

    strings:
        $key_0 = "Arch:" ascii
        $key_1 = "Count Core:" ascii
        $key_2 = "Cpu:" ascii
        $key_3 = "File Location:" ascii
        $key_4 = "Gpu:" ascii
        $key_5 = "Hostname:" ascii
        $key_6 = "IP Address:" ascii
        $key_7 = "Mac:" ascii
        $key_8 = "Release:" ascii
        $key_9 = "Type:" ascii
        $key_10 = "User Info:" ascii
        $key_11 = "Uuid:" ascii
        $key_12 = "Version:" ascii

    condition:
        all of ($key_*)
}

rule CSCountCoreStealer_cystack_6e563a49
{
    meta:
        family = "CSCountCoreStealer"
        fingerprint_id = "cystack_6e563a49"

    strings:
        $key_0 = "Arch:" ascii
        $key_1 = "Count Core:" ascii
        $key_2 = "File Location:" ascii
        $key_3 = "Hostname:" ascii
        $key_4 = "IP Address:" ascii
        $key_5 = "User Info:" ascii
        $key_6 = "Version:" ascii

    condition:
        all of ($key_*)
}

rule CSCountCoreStealer_cystack_93fdb3ac
{
    meta:
        family = "CSCountCoreStealer"
        fingerprint_id = "cystack_93fdb3ac"

    strings:
        $key_0 = "Arch:" ascii
        $key_1 = "Count Core:" ascii
        $key_2 = "File Location:" ascii
        $key_3 = "Hostname:" ascii
        $key_4 = "IP Address:" ascii
        $key_5 = "Release:" ascii
        $key_6 = "Type:" ascii
        $key_7 = "User Info:" ascii
        $key_8 = "Version:" ascii

    condition:
        all of ($key_*)
}

rule CSCountCoreStealer_cystack_aeea7400
{
    meta:
        family = "CSCountCoreStealer"
        fingerprint_id = "cystack_aeea7400"

    strings:
        $key_0 = "Arch:" ascii
        $key_1 = "Count Core:" ascii
        $key_2 = "File Location:" ascii
        $key_3 = "Hostname:" ascii
        $key_4 = "IP Address:" ascii
        $key_5 = "Release:" ascii
        $key_6 = "Type:" ascii
        $key_7 = "User Info:" ascii

    condition:
        all of ($key_*)
}

rule CSCountCoreStealer_cystack_bc6dd75d
{
    meta:
        family = "CSCountCoreStealer"
        fingerprint_id = "cystack_bc6dd75d"

    strings:
        $key_0 = "Arch:" ascii
        $key_1 = "Count Core:" ascii
        $key_2 = "Cpu:" ascii
        $key_3 = "File Location:" ascii
        $key_4 = "Gpu:" ascii
        $key_5 = "Hostname:" ascii
        $key_6 = "IP Address:" ascii
        $key_7 = "Mac:" ascii
        $key_8 = "Release:" ascii
        $key_9 = "Type:" ascii
        $key_10 = "User Info:" ascii
        $key_11 = "Uuid:" ascii

    condition:
        all of ($key_*)
}