Macos_Infostealer_Wallets_8e469ea0

rule Macos_Infostealer_Wallets_8e469ea0 {
    meta:
        author = "Elastic Security"
        id = "8e469ea0-0c68-444b-b19a-4e1ab89f94b2"
        fingerprint = "a974450459cafbf24462fe221d6d9a5dff33c1ba6998157d3666c93869595eb0"
        creation_date = "2024-03-06"
        last_modified = "2025-01-30"
        threat_name = "Macos.Infostealer.Wallets"
        reference_sample = "0e649facc5c82f7112997c7629bd114e63acc1c8dc9ede646214243ace9b9c1d"
        severity = 100
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "macos"
    strings:
        $s1 = "ibnejdfjmmkpcnlpebklmnkoeoihofec" ascii wide
        $s2 = "fhbohimaelbohpjbbldcngcnapndodjp" ascii wide
        $s3 = "ffnbelfdoeiohenkjibnmadjiehjhajb" ascii wide
        $s4 = "jbdaocneiiinmjbjlgalhcelgbejmnid" ascii wide
        $s5 = "afbcbjpbpfadlkmhmclhkeeodmamcflc" ascii wide
        $s6 = "hnfanknocfeofbddgcijnmhnfnkdnaad" ascii wide
        $s7 = "hpglfhgfnhbgpjdenjgmdgoeiappafln" ascii wide
        $s8 = "blnieiiffboillknjnepogjhkgnoapac" ascii wide
        $s9 = "cjelfplplebdjjenllpjcblmjkfcffne" ascii wide
        $s10 = "fihkakfobkmkjojpchpfgcmhfjnmnfpi" ascii wide
        $s11 = "kncchdigobghenbbaddojjnnaogfppfj" ascii wide
        $s12 = "amkmjjmmflddogmhpjloimipbofnfjih" ascii wide
        $s13 = "nlbmnnijcnlegkjjpcfjclmcfggfefdm" ascii wide
        $s14 = "nanjmdknhkinifnkgdcggcfnhdaammmj" ascii wide
        $s15 = "nkddgncdjgjfcddamfgcmfnlhccnimig" ascii wide
        $s16 = "fnjhmkhhmkbjkkabndcnnogagogbneec" ascii wide
        $s17 = "cphhlgmgameodnhkjdmkpanlelnlohao" ascii wide
        $s18 = "nhnkbkgjikgcigadomkphalanndcapjk" ascii wide
        $s19 = "kpfopkelmapcoipemfendmdcghnegimn" ascii wide
        $s20 = "aiifbnbfobpmeekipheeijimdpnlpgpp" ascii wide
        $s21 = "dmkamcknogkgcdfhhbddcghachkejeap" ascii wide
        $s22 = "fhmfendgdocmcbmfikdcogofphimnkno" ascii wide
        $s23 = "cnmamaachppnkjgnildpdmkaakejnhae" ascii wide
        $s24 = "jojhfeoedkpkglbfimdfabpdfjaoolaf" ascii wide
        $s25 = "flpiciilemghbmfalicajoolhkkenfel" ascii wide
        $s26 = "nknhiehlklippafakaeklbeglecifhad" ascii wide
        $s27 = "hcflpincpppdclinealmandijcmnkbgn" ascii wide
        $s28 = "ookjlbkiijinhpmnjffcofjonbfbgaoc" ascii wide
        $s29 = "mnfifefkajgofkcjkemidiaecocnkjeh" ascii wide
        $s30 = "lodccjjbdhfakaekdiahmedfbieldgik" ascii wide
        $s31 = "ijmpgkjfkbfhoebgogflfebnmejmfbml" ascii wide
        $s32 = "lkcjlnjfpbikmcmbachjpdbijejflpcm" ascii wide
        $s33 = "nkbihfbeogaeaoehlefnkodbefgpgknn" ascii wide
        $s34 = "bcopgchhojmggmffilplmbdicgaihlkp" ascii wide
        $s35 = "klnaejjgbibmhlephnhpmaofohgkpgkd" ascii wide
        $s36 = "aeachknmefphepccionboohckonoeemg" ascii wide
        $s37 = "dkdedlpgdmmkkfjabffeganieamfklkm" ascii wide
        $s38 = "nlgbhdfgdhgbiamfdfmbikcdghidoadd" ascii wide
        $s39 = "onofpnbbkehpmmoabgpcpmigafmmnjhl" ascii wide
        $s40 = "cihmoadaighcejopammfbmddcmdekcje" ascii wide
        $s41 = "cgeeodpfagjceefieflmdfphplkenlfk" ascii wide
        $s42 = "pdadjkfkgcafgbceimcpbkalnfnepbnk" ascii wide
        $s43 = "acmacodkjbdgmoleebolmdjonilkdbch" ascii wide
        $s44 = "bfnaelmomeimhlpmgjnjophhpkkoljpa" ascii wide
        $s45 = "fhilaheimglignddkjgofkcbgekhenbh" ascii wide
        $s46 = "mgffkfbidihjpoaomajlbgchddlicgpn" ascii wide
        $s47 = "hmeobnfnfcmdkdcmlblgagmfpfboieaf" ascii wide
        $s48 = "lpfcbjknijpeeillifnkikgncikgfhdo" ascii wide
        $s49 = "dngmlblcodfobpdpecaadgfbcggfjfnm" ascii wide
        $s50 = "bhhhlbepdkbapadjdnnojkbgioiodbic" ascii wide
        $s51 = "jnkelfanjkeadonecabehalmbgpfodjm" ascii wide
        $s52 = "jhgnbkkipaallpehbohjmkbjofjdmeid" ascii wide
        $s53 = "jnlgamecbpmbajjfhmmmlhejkemejdma" ascii wide
        $s54 = "kkpllkodjeloidieedojogacfhpaihoh" ascii wide
        $s55 = "mcohilncbfahbmgdjkbpemcciiolgcge" ascii wide
        $s56 = "gjagmgiddbbciopjhllkdnddhcglnemk" ascii wide
        $s57 = "kmhcihpebfmpgmihbkipmjlmmioameka" ascii wide
        $s58 = "phkbamefinggmakgklpkljjmgibohnba" ascii wide
        $s59 = "lpilbniiabackdjcionkobglmddfbcjo" ascii wide
        $s60 = "cjmkndjhnagcfbpiemnkdpomccnjblmj" ascii wide
        $s61 = "aijcbedoijmgnlmjeegjaglmepbmpkpi" ascii wide
        $s62 = "efbglgofoippbgcjepnhiblaibcnclgk" ascii wide
        $s63 = "odbfpeeihdkbihmopkbjmoonfanlbfcl" ascii wide
        $s64 = "fnnegphlobjdpkhecapkijjdkgcjhkib" ascii wide
        $s65 = "aodkkagnadcbobfpggfnjeongemjbjca" ascii wide
        $s66 = "akoiaibnepcedcplijmiamnaigbepmcb" ascii wide
        $s67 = "ejbalbakoplchlghecdalmeeeajnimhm" ascii wide
        $s68 = "dfeccadlilpndjjohbjdblepmjeahlmm" ascii wide
        $s69 = "kjmoohlgokccodicjjfebfomlbljgfhk" ascii wide
        $s70 = "ajkhoeiiokighlmdnlakpjfoobnjinie" ascii wide
        $s71 = "fplfipmamcjaknpgnipjeaeeidnjooao" ascii wide
        $s72 = "niihfokdlimbddhfmngnplgfcgpmlido" ascii wide
        $s73 = "obffkkagpmohennipjokmpllocnlndac" ascii wide
        $s74 = "kfocnlddfahihoalinnfbnfmopjokmhl" ascii wide
        $s75 = "infeboajgfhgbjpjbeppbkgnabfdkdaf" ascii wide
        $s76 = "{530f7c6c-6077-4703-8f71-cb368c663e35}.xpi" ascii wide
        $s77 = "ronin-wallet@axieinfinity.com.xpi" ascii wide
        $s78 = "webextension@metamask.io.xpi" ascii wide
        $s79 = "{5799d9b6-8343-4c26-9ab6-5d2ad39884ce}.xpi" ascii wide
        $s80 = "{aa812bee-9e92-48ba-9570-5faf0cfe2578}.xpi" ascii wide
        $s81 = "{59ea5f29-6ea9-40b5-83cd-937249b001e1}.xpi" ascii wide
        $s82 = "{d8ddfc2a-97d9-4c60-8b53-5edd299b6674}.xpi" ascii wide
        $s83 = "{7c42eea1-b3e4-4be4-a56f-82a5852b12dc}.xpi" ascii wide
        $s84 = "{b3e96b5f-b5bf-8b48-846b-52f430365e80}.xpi" ascii wide
        $s85 = "{eb1fb57b-ca3d-4624-a841-728fdb28455f}.xpi" ascii wide
        $s86 = "{76596e30-ecdb-477a-91fd-c08f2018df1a}.xpi" ascii wide
        $s87 = "ejjladinnckdgjemekebdpeokbikhfci" ascii wide
        $s88 = "bgpipimickeadkjlklgciifhnalhdjhe" ascii wide
        $s89 = "epapihdplajcdnnkdeiahlgigofloibg" ascii wide
        $s90 = "aholpfdialjgjfhomihkjbmgjidlcdno" ascii wide
        $s91 = "egjidjbpglichdcondbcbdnbeeppgdph" ascii wide
        $s92 = "pnndplcbkakcplkjnolgbkdgjikjednm" ascii wide
        $s93 = "gojhcdgcpbpfigcaejpfhfegekdgiblk" ascii wide
    condition:
        6 of them
}