StealerNeko

#yara sig:
rule StealerNeko_bin
{
    meta:
        description = "StealerNeko"
        author = "James_inthe_box"
        reference = "a29d70f5c97d7d4242069ceff237d4946ba551b7786a2e441494f0c555aefca4"
        date = "2019/04"
        maltype = "Stealer"

    strings:
        $string1 = "country=%s&cc=%s&desk=%s&autof=%s&cookies=%s&filezilla=%s&passwords=%s&telegram=%s&wallet=%s&winver=%s&pidgin=%s&psi=%s&psiplus=%s&steam=%s&winscp=%s&battle=%s&amazon=%s&file=%s"

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule StealerNeko_mem
{
    meta:
        description = "StealerNeko"
        author = "James_inthe_box"
        reference = "a29d70f5c97d7d4242069ceff237d4946ba551b7786a2e441494f0c555aefca4"
        date = "2019/04"
        maltype = "Stealer"

    strings:
        $string1 = "country=%s&cc=%s&desk=%s&autof=%s&cookies=%s&filezilla=%s&passwords=%s&telegram=%s&wallet=%s&winver=%s&pidgin=%s&psi=%s&psiplus=%s&steam=%s&winscp=%s&battle=%s&amazon=%s&file=%s"

    condition:
        all of ($string*) and filesize > 800KB
}


#snort / #suricata sig:
alert tcp any any -> any $HTTP_PORTS (msg:"StealerNeko Exfiltration"; flow:established,to_server; content:"POST"; http_method; content:"country="; fast_pattern; content:"&cc="; content:"&desk="; content:"&autof="; content:"&cookies=";reference:md5,216a00647603b66967cda5d91638f18a; classtype:trojan-activity; sid:20166291; rev:1; metadata:created_at 2019_04_22;)