DITEKSHEN_MALWARE_Linux_Akira

rule DITEKSHEN_MALWARE_Linux_Akira : FILE
{
	meta:
		description = "Detects Akira Ransomware Linux"
		author = "ditekSHen"
		id = "3ac144b3-c747-58e5-bc75-b3f90786f404"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10245-L10264"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3a00154e1cfc442718e753641d3706ffd4dd8465525d0bb2854f74dfb1cf5dd0"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$x1 = "https://akira" ascii
		$x2 = ":\\akira\\" ascii
		$x3 = ".akira" ascii
		$x4 = "akira_readme.txt" ascii
		$s1 = "--encryption_" ascii
		$s2 = "--share_file" ascii
		$s3 = { 00 24 52 65 63 79 63 6c 65 2e 42 69 6e 00 24 52 45 43 59 43 4c 45 2e 42 49 4e 00 }
		$s4 = " PUBLIC KEY-----" ascii
		$s5 = ".onion" ascii
		$s6 = "/Esxi_Build_Esxi6/./" ascii nocase
		$s7 = "No path to encrypt" ascii
		$s8 = "-fork" fullword ascii

	condition:
		uint16( 0 ) == 0x457f and ( 3 of ( $x* ) or ( 1 of ( $x* ) and 4 of ( $s* ) ) or 6 of ( $s* ) )
}