Baldr yara

rule Baldr_bin
{
    meta:
        author = "James_inthe_box"
        reference = "e8adeee1736ee068f79284077ec905137051eaed11f0be53cc1977f30edb3102"
        date = "3/2019"
        maltype = "Infotealer"

    strings:
        $string1 = "_autocomplete.txt" wide
        $string2 = "hostname|encryptedPassword|encryptedUsername" wide
        $string3 = "cookieDomains.log" wide
        $string4 = "sitemanager.xml" wide
        $string5 = "Cards Count" wide
        $string6 = ".purple\\accounts.xml" wide
        $string7 = "ProtonVPN.exe_Url_" wide
        $string8 = "NordVPN.exe_Url_" wide
        $string9 = "Exodus\\exodus.wallet" wide

    condition:
        uint16(0) == 0x5A4D and all of ($string*) and filesize < 800KB
}

rule Baldr_mem
{
    meta:
        author = "James_inthe_box"
        reference = "e8adeee1736ee068f79284077ec905137051eaed11f0be53cc1977f30edb3102"
        date = "3/2019"
        maltype = "Infotealer"

    strings:
        $string1 = "_autocomplete.txt" wide
        $string2 = "hostname|encryptedPassword|encryptedUsername" wide
        $string3 = "cookieDomains.log" wide
        $string4 = "sitemanager.xml" wide
        $string5 = "Cards Count" wide
        $string6 = ".purple\\accounts.xml" wide
        $string7 = "ProtonVPN.exe_Url_" wide
        $string8 = "NordVPN.exe_Url_" wide
        $string9 = "Exodus\\exodus.wallet" wide

    condition:
        all of ($string*) and filesize > 800KB
}