rule LummaC_Stealer {
	meta:
		author = "Cyble"
		description = "Detects LummaC Stealer Files"
		date = "2023-08-10"
		os = "Windows"
		threat_name = "LummaC Stealer"
		scan_type = "Memory"
		severity = 100
		reference_sample = "a53dafb72659e7aa4f36a6626b01aad9cc44500d5d4c1ee7a96c957a4e556d02"
	strings:
		$a = "/c2sock" ascii wide
		$b = "TeslaBrowser" ascii wide
		$c = "Software.txt" ascii wide
		$d = "System.txt" ascii wide
		$e = "/c2conf" ascii wide
	condition:
		all of them
}