sample2.yara

import "pe"

rule sample2_exe_infostealer {
    meta:        
        malware = "sample2.exe: Raccoon Infostealer"
        author = "Nathan Padriga"
        creation_date = "2025-03-28"
        version = "1.0"

    strings:
        $mz = { 4D 5A } // File Type must be a Windows Executable
        $dropped_wotsuper = "wotsuper.exe" ascii
        $dropped_wotsuper1 = "wotsuper1.exe" ascii
        $install_maker_signature = "Smart Install Maker" ascii

        $packed_signature = {55 8b ec 83 c4 f0 b8} // borland delphi entry point - prologue, add -0x10, mov ???

    condition:
        $mz at 0 and $packed_signature at pe.entry_point and all of ($dropped_wotsuper, $dropped_wotsuper1, $install_maker_signature)
}