DITEKSHEN_MALWARE_Win_Spyro

rule DITEKSHEN_MALWARE_Win_Spyro : FILE
{
	meta:
		description = "Detects Spyro / VoidCrypt / Limbozar ransomware"
		author = "ditekSHen"
		id = "8b3273c4-827e-50ce-983e-a5843f6b5a78"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6649-L6675"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "2e3be361f6d4283fd312a4486eaa39d6594813937cc3f62dbb603babeff17929"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "Decrypt-info.txt" ascii wide
		$s2 = "AbolHidden" ascii wide
		$s3 = "C:\\ProgramData\\prvkey" ascii wide
		$s4 = ".?AV?$TF_CryptoSystemBase@VPK_Encryptor@CryptoPP" ascii
		$s5 = "C:\\Users\\LEGION\\" ascii
		$s6 = "C:\\ProgramData\\pkey.txt" fullword ascii
		$s7 = ".Spyro" fullword ascii
		$m1 = "Go to C:\\ProgramData\\ or in Your other Drives" wide
		$m2 = "saving prvkey.txt.key file will cause" wide
		$m3 = "in Case of no Answer:" wide
		$m4 = "send us prvkey*.txt.key" wide
		$m5 = "Somerhing went wrong while writing payload on disk" ascii
		$m6 = "this country is forbidden.\"}" ascii
		$c1 = "Voidcrypt/1.0" ascii
		$c2 = "h1dd3n.cc" ascii
		$c3 = "/voidcrypt/index.php" ascii
		$c4 = "&user=" ascii
		$c5 = "&disk-size=" ascii
		$c6 = "unique-id=" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 5 of ( $s* ) or 4 of ( $c* ) or 3 of ( $m* ) or 8 of them )
}