DITEKSHEN_MALWARE_Win_Babylockerkz

rule DITEKSHEN_MALWARE_Win_Babylockerkz : FILE
{
	meta:
		description = "Detects BabyLockerKZ"
		author = "ditekshen"
		id = "faa35818-2bed-528f-a6f0-5356a723ef5b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11939-L11957"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "423bbd3b23591608a32e4e724c156fbaa5d1d087515137a82a0aeb8c4865d1ca"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = ":\\locker\\bin\\stub_win_x64_encrypter.pdb" ascii
		$s2 = "taskkill /f /im explorer.exe" fullword wide
		$s3 = "\\SysWOW64\\cmd.exe /c %windir%\\" wide
		$s4 = "[!] Failed to RunNonElevated: %s, error 0x%X" fullword wide
		$s5 = "[!] Failed to run sync command: %s, error 0x%X" fullword wide
		$s6 = "[-] RunNonElevated: %s" fullword wide
		$s7 = "[!][Encrypt] Not" fullword
		$s8 = "[-] sALLUSERSPROFILE: %s" fullword wide
		$s9 = "[!] WNetGetConnection failed 0x%X" fullword wide
		$s10 = "[!][Scan] " wide
		$s11 = "[-] Start encrypt" wide

	condition:
		uint16( 0 ) == 0x5a4d and 4 of them
}