UnknownKeylogger2

rule UnknownKeylogger2_bin_mem
{
    meta:
        description = "Unknown Keylogger 2"
        author = "James_inthe_box"
        reference = "5b055f93ced32f77902f4d44c169c93e19d35334db51ecea8d1ab8f229ef6e76"
        date = "2019/12"
        maltype = "Keylogger"

    strings:
        $string1 = "TFTPList" ascii
        $string2 = "TFTPSend" ascii
        $string3 = "ftp-data" ascii
        $string4 = "PasswordInfo" ascii
        $string5 = "FirefoxRestore" ascii
        $string6 = "%d.%d.%d build %d" ascii
        $string7 = "CFNetwork.dll" ascii
        $string8 = "Instant Message" ascii
        $string9 = "IM sessions" ascii
        $string10 = "{BACKSPACE}" ascii
        $string11 = "com.apple.Safari" ascii
        $string12 = "sqlite3" ascii

    condition:
        all of ($string*)
}

hashes
664f3a7a13af70310361536aaf5df8c4767c3b47
48268352b412c9f03396052f491a6f24ec587cff
e08d0723a8aa3935d643e35ab6451ce41f15a81b
2a2372a55b20936cb8a2f6febea391aa1b449ddd
b7dddf7be0f60c8dbe9672c687ad88886910ec2a
0e45bee64c329657acd9d2fc1ad9ee5d6b1b4c66
1bb82d7654c4064f57efb338053d4cab9c791285
8b6d0213999bf2346f8d78825911266f84f5b065
addddaa3311ed16b4bd77a6e8b2a0ab4c7c6b98d
eb070353b59c27eac76d3e31f39a74e46bd45d88
cddf396823a8aabec100c6b6db8427b0413b6260
07c6e81893ac00ff843234302454bfcddb4d163d
6eaebf37f495d541921d61cb1f18732190a5badc
deb73c6bf0fb041ebfed84c0e003eaa6f62f76bc
8bbf8fdfd4217e67be6e5fb339bc642583b8d827
520798eec5e538325017e696ec713762a6b47bb0
f87373f61d65ae0b90822dfc26cf22f527ef3f3f
9f25305d076477426845c2da67cca380c6b4daa2
a7e73bdc514a103a78e30dc9c076f456c5354f2d
f895f825e5852ff4ace58ca81bced60e7d31c0da
f5bdb74fa70a20632abfc3e4e7e4ac1e7b28d629
38899b6a9cb50a7c3e28a20bc5516d452df93d23
57b6ae8dd2b6e8c9bd1c7deacce9a2f429f88234
597f78ae874bc7468a42c765a13d1adf1dc4f7e3
70883338a7d06ba22149840d7402973ed0268a63
65bc0e0cf22fc980067b37d6d99506a0e4edecf7
fd0eaf0e0a51ef9f87fc95486209e1aaee2acabe8f4beea76679e6f5af7ee701
967740ea96d0d3df8917b28145e25791700a4076ea61e9720247a986d4ddfbb9
3fe5639dabff0558afab898949081b351b0ce47bb702c8b915022a3ab72429ea
f866511456f7a6792d4b837646cc06a603f76947718f6c4c7f287d63f07fdb4d
37deb2f1a58217a8aa466ca1401f125098508bec6157742cdd4a7ab0fe206bd0
f7f3c97d1e89f31d3436f287a8bacc3e39da9c9083f72630f55f74feccacb89b
e5fdd1be3954c258df50af003a50b1e5db7fa65447310fe7f38d1a90a7f9cbd8
925e3c5330e91a337599030f8970b82421fc10b1dddc9b999250eba1580c2b74
cb188acef5c6cfd07ed69ac1db96a23ebf1f2e9227d4484634c14bd39a7d9d44
5b055f93ced32f77902f4d44c169c93e19d35334db51ecea8d1ab8f229ef6e76
8ba5bb40a7e531f0bb6d3419fa1d433546fa78c525d3bf1963e7cb075d164867
7bb7838117f63f636530c99ec317ab14a1238709052a87eb1fce3d7c3556bfd3
99cc0d231106d765173c56ff4cbe4d7b30be94ac00d86d3cf2394042f7db6533
04696b8c2db8daa5720fd0f4e94e75c1345dbbb236ddc91727cc892f1e36c9b5
d59927192dddd7fe7238318bd2c23e7d93d8aa84d0af779c1db8ee152a2a6ffa
153c948374a8094d9be189fa3ec74ebb0bad65657e56a40d2c7c195db1742dea
78e13ea6cfb01bf2d56c3ff46546e98c942a3d448baa8f902649740b3369e6ba
1887a41cb94117bafbce5c87e40ef1bb5d79c7d4d7f6613b72be206f7e2d8ed3
9b252e16e65992d643f0a0248df1d4f6b780c265b3b5afe44033ea795bb54e9a
ff21e487a4b98b05111cfd503f39d0c648ed82254170002e76cddae2a663e067
963cdc1f0d38de73d464da7b6d26e61376ac33a822f3e7160731f5030cc86f82
efe2e85e2bb27349504332c00271b3cc9c3d21a15ab2920587ffae7c508e0a60
587f3544e19e998ed5fcffb0ca20ea8a5b4d77b6834319de3075cfe3ba8dc31c
5bf6c642754fd779e48011490b89c25d8526ef35009bfcc6137df841884c400b
50145ef0d7bdb82e4507f185c5d14e191c0df1c27370b45c5ec101cc10a871f1
a09d0f04d66a00d2cb70aee2972497899a0d10ec6bb680198865a99ece221db8
bea7f22cb8664fd51517476332bcfa2dde1af6bdc08d209d111cb892867bfe7d
ad94185f169de957c839e3695831433acae7923c60abb8e8426817f3131220eb
72337950a8453e37fee89c6114c22f8b5506a388eaef52a25700a53593311c2d
1820a664bc81786be321a84768a42af217ebf0ed202dbf0c8ab90ef717ae244b
186a76f6558fdadb3cae180612b07d7f1e9bb5bdbde054d13456ad288f24ca59
be982a05c5334b34e4f91e9f798ca7a4821f6876631a027faa1542c606c9db26
995dc6f8d412d5c1fcb35c674b5bfd5fa4566fed3e7ee167e385543d9cfa54bb
7559d9262637d1e610f24bd694d8333a95a15df687599a128055aa03025df4dc
f8e8976bfbea74abb0095c6fc9ecf2bbbd6f5bdabb5fc734f2aa8507e3cc1bb5
0477e06cf1a1a98990412c3ccf177f44fda7169f82fea2479204238dc130d5fd
c5652ea8530f5ceaaae963d564e7cdf0d9707f18d726a7b1068276b9d14c41a5
ba40c74e703baf621a6687253bb6a92a54f2f7b33892e5fcbf15b01419d9db92
54aa9ec01815201aa90ca9f6cfe6a8ce643f1c869e7cd62a016ab3f7feff1c72
4d0d048acf6436509531812b2df1d3f7b2e25e5f4d6f0591d316bcf7ad605cd2
3179c4406ef392675592db7ef5dac96d7cf5cd96f5a7e4051356f9b3c39cda2e
3228b618e6e1845c0fbf4951d029222d200c5aab77a50aee45d7ca3b694ff119
c71764fc4e2ab8444c6db095a85c041129eb690ac470f5e0697c5c7b13946e9a
0bdd21d371623f0eac3305a0ec6c5a4c654003d1c6b2e3d453a697551051224d
96ab4f85ee19b9c10de93e6ae4b83625d1260a8d3a5194d089dec129e0709bec
61bb8b98400e29b4a81cbc99d9eb61a93f298ea7a21acb0c640c2de613c43649
a55d7c4ab5f9f10fd894e429663521f29f24bcd9cbec61ea80e49397747ad6e5
3459c138287430652ea77c3276384af5692d0472c75e16d30913aa48559c0e70
88933cf967d16832b53d276c572ee235a81585fdf25c81f2f6f67ab6c571b286
a3d25ed7f1cdb1ef8f328a6623305226400a26dcd3344f49c84d9fe241816453
d43543961ffddbabd337664fb8055693cf436fd5cad0b5bc18024d501d3d5386
260108bf40307127368c4ab0d0dfd7e4674fafd4af26a3e92387fb4ea17a96c6
deff9b848140425388eb12890197dfd3494e461bb39b47ca3331c42925e7a0a4
6a07a474911a046c9063c08bc373dfad695291433fe49a94d04709f8d1a5229c
2a329a8339f96b50b7c6c9db69714681d21f6205de2f8d4123812162c22d912c
eb539bc85f3eb6ed33e85d0863d1d941f18a0497d6df705b94d3299788885574
389863b056fa0c3d4ebf130103445bc56769824f1e6cecea9c950744b80752b0