Windows_Discock_Stealer_WASP_Stealer

yara

rule Windows_Discock_Stealer_WASP {
    meta:
        author = "Loginsoft Security Research Team"
        id = "763faed2-250d-40dc-8d59-d21cd01dcfad"
        creation_date = "2023-01-03"
        reference = "https://urlscan.io/result/640b83f5-71ee-4e6e-bc7e-09140979de7d/"
        os = "windows"
    strings:
        $gen1 = "billythegoat356" ascii wide nocase
        $gen2 = "_stackoverflow(MemoryAccess" ascii wide nocase
        $gen3 = "Hypothesis._calculate(Builtins" ascii wide nocase
        $gen4 = "memoryaccess.execute(code" ascii wide nocase
        $gen5 = "IJJLJJJIIJLIJILIJ" ascii wide nocase
        $gen6 = "O00O00oOo00Oo00O" ascii wide nocase
        $code1 = "\x76\x61\x72\x73" 
        $code2 = "\x7a\x6c\x69\x62" 
        $code3 = "Hypothesis._product(Floor=" ascii nocase wide
        
    condition:
        2 of ($gen*) or 1 of ($code*)
}