Actor(s): SWEED
A .NET based keylogger and RAT readily available to actors. Logs keystrokes and the host's clipboard and beacons this information back to the C2.
rule win_agent_tesla_w0 { meta: author = "InQuest Labs" source = "https://www.inquest.net" created = "05/18/2018" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_tesla" malpedia_version = "20190731" malpedia_license = "CC BY-NC-SA 4.0" malpedia_sharing = "TLP:WHITE" strings: $s0 = "SecretId1" ascii $s1 = "#GUID" ascii $s2 = "#Strings" ascii $s3 = "#Blob" ascii $s4 = "get_URL" ascii $s5 = "set_URL" ascii $s6 = "DecryptIePassword" ascii $s8 = "GetURLHashString" ascii $s9 = "DoesURLMatchWithHash" ascii $f0 = "GetSavedPasswords" ascii $f1 = "IESecretHeader" ascii $f2 = "RecoveredBrowserAccount" ascii $f4 = "PasswordDerivedBytes" ascii $f5 = "get_ASCII" ascii $f6 = "get_ComputerName" ascii $f7 = "get_WebServices" ascii $f8 = "get_UserName" ascii $f9 = "get_OSFullName" ascii $f10 = "ComputerInfo" ascii $f11 = "set_Sendwebcam" ascii $f12 = "get_Clipboard" ascii $f13 = "get_TotalFreeSpace" ascii $f14 = "get_IsAttached" ascii $x0 = "IELibrary.dll" ascii wide $x1 = "webpanel" ascii wide nocase $x2 = "smtp" ascii wide nocase $v5 = "vmware" ascii wide nocase $v6 = "VirtualBox" ascii wide nocase $v7 = "vbox" ascii wide nocase $v9 = "avghookx.dll" ascii wide nocase $pdb = "IELibrary.pdb" ascii condition: ( ( 5 of ($s*) or 7 of ($f*) ) and all of ($x*) and all of ($v*) and $pdb ) }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Your suggestion will be reviewed before being published. Thank you for contributing!