DITEKSHEN_MALWARE_Win_Goldenaxe

rule DITEKSHEN_MALWARE_Win_Goldenaxe : FILE
{
	meta:
		description = "GoldenAxe ransomware payload"
		author = "ditekSHen"
		id = "23874106-dbbb-5cb2-b61a-1661d8e2d868"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L742-L763"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "6dfd88ce65acdfed4749e3b817b317c3c514ea42f892a7f5f95853c148507918"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.GoldenAxe"

	strings:
		$s1 = "Go build ID: " ascii
		$s2 = "taskkill.exe" ascii
		$s3 = "cmd.exe" ascii
		$s4 = "Speak.Speak" ascii
		$s5 = "CLNTSRVRnull" ascii
		$s6 = "-----END" ascii
		$s7 = "-----BEGIN" ascii
		$s8 = ".EncryptFile" ascii
		$g1 = "GoldenAxe/Utils." ascii
		$g2 = "GoldenAxe/Cryptography." ascii
		$g3 = "GoldenAxe/Walker." ascii
		$g4 = "C:/Users/alpha/go/src/GoldenAxe/" ascii
		$g5 = "'Golden Axe ransomware'" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $g* ) and 1 of ( $s* ) ) )
}