id: universal-1337-malware

info:
  name: Universal 1337 Stealer Malware - Detect
  author: daffainfo
  severity: info
  reference:
    - https://github.com/Yara-Rules/rules/blob/master/malware/MALW_Stealer.yar
  tags: malware,file
file:
  - extensions:
      - all

    matchers-condition: or
    matchers:
      - type: binary
        binary:
          - "2A5B532D502D4C2D492D545D2A"
          - "2A5B482D452D522D455D2A"
        condition: and

      - type: binary
        binary:
          - "4654507E"
          - "7E317E317E307E30"
        condition: and
# digest: 490a00463044022043e570cac70dad134d6d5c8b930c336a1aed566979783d14e0399d309e130a4902201ea4511262e318f329aca295d7a5a0a14a409ead5c4c2cccc20e31c56c2a70ae:922c64590222798bb761d5b6d8e72950