Windows Trojan Arkanixstealer Publicstrings
This YARA rule detects the Arkanix Stealer by identifying specific strings found within its code or related artifacts. It looks for a combination of unique user agent strings, domain names associated with its command and control infrastructure, API endpoints used for session creation or data exfiltration, a secret key, and a staging identifier. The rule requires at least one domain, one endpoint, and one of the distinctive user agent, key, or staging hints to trigger, aiming to reduce false positives by combining multiple indicators.
YARA
