Hello, I noticed a change in the stealer that was not yet covered by the rules. Here I propose a rule for check-in, no matter whether the server answers yes or no. Boundary features the number of bytes in hwid as well as two minus characters at the end of the post request are the detection conditions I propose. If you see fit, you can add a user agent. It is still the same as the URI. Here are two samples with different test and roza builds.
alert http any any -> any any (msg: "ET MALWARE [ANY.RUN] Win32/Stealc (Check-In)";flow: established, to_server; http.method; content: "POST"; http.header; content: "Content-Type: multipart/form-data|3b| boundary="; pcre: "/^[a-zA-Z0-9]{20}\r/R";http.header_names; content:!"Referer|0d 0a|"; http.request_body;content: "--"; depth: 2; content: "|0d0a|Content-Disposition: form-data|3b| name=|22|hwid|22 0d0a 0d0a|"; distance: 20; within: 49; content: "==|0d0a|--"; distance: 30; within: 6; content: "|0d0a|Content-Disposition: form-data|3b| name=|22|build|22 0d0a 0d0a|"; distance: 20; within: 50; content: "--"; distance: 4; content: "--"; distance: 20; within:2; isdataat: !3, relative; threshold: type limit, track by_dst, seconds 300, count 1; reference: md5,26f5d78873413d9682031d39733ae5bd; reference: url,app.any.run/tasks/a9908b18-0302-4d20-8349-6aca4db61e98; metadata: attack_target Client_Endpoint, deployment Perimeter, former_category MALWARE, signature_severity Major, malware_family Stealc, created_at 2023_08_10; classtype: command-and-control; sid: 1; rev: 1;)
http.user_agent;content: "Mozilla/4.0 (compatible|3b| MSIE 7.0|3b| Windows NT 5.1|3b| InfoPath.1)";
I also have a completely detonated sample, which, as it seemed to me, even looks like a loader. There you can write a lot of rules, good luck!
Best regards, Jane!
