DITEKSHEN_MALWARE_Win_Satana

rule DITEKSHEN_MALWARE_Win_Satana : FILE
{
	meta:
		description = "Detects Satana ransomware"
		author = "ditekSHen"
		id = "f3cb7cc4-3c63-50b2-8e19-d675abbb33f8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8587-L8604"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b2946e8c37be4a57237999aaa0c0a760a181306320162e04bc6fc12a542b81d5"
		score = 75
		quality = 73
		tags = "FILE"
		snort_sid = "920269-920270"

	strings:
		$bf1 = "Try Decrypt: uc_size = %d, c_size = %d" ascii
		$bf2 = "dwMailSelector = %d  dwBtcSelector = %d" ascii
		$bf3 = "%s: Error DecB: 0x%X" ascii
		$bf4 = "MBR written to Disk# %d" ascii
		$bf5 = "!SATANA!" ascii wide nocase
		$bf6 = "1 -th start" fullword ascii
		$bf7 = "id=%d&code=%d&sdata=%d.%d.%d %d %d %s %s %d&name=%s&md5=%s&dlen=%s" ascii
		$bf8 = "threadAdminFlood: %s %s %s" wide
		$bf9 = "%s: NET RES FOUND: %s" wide

	condition:
		( uint16( 0 ) == 0x5a4d and 4 of ( $bf* ) ) or ( 5 of ( $bf* ) )
}