Windows_Trojan_MetaStealer_a07e395c

rule Windows_Trojan_MetaStealer_a07e395c {
    meta:
        author = "Elastic Security"
        id = "a07e395c-121d-46fe-ab65-d28eb9b83e9d"
        fingerprint = "0ac013d500d3c72be3ec22bf05929ad583f3148634188a2d583bdc1a841c03e1"
        creation_date = "2024-10-23"
        last_modified = "2024-10-29"
        threat_name = "Windows.Trojan.MetaStealer"
        reference_sample = "973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a"
        severity = 100
        arch_context = "x86, arm64"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $b = "SeImpersonatePrivilege" wide fullword
        $d = { 34 36 33 41 42 45 43 46 2D 34 31 30 44 2D 34 30 37 46 2D 38 41 46 35 2D 30 44 46 33 35 41 30 30 35 43 43 38 }
        $e = { 25 1F 0F 5F 0C 1A 63 1F 0F 5F 0D 09 1F 09 }
    condition:
        all of them
}