DITEKSHEN_MALWARE_Win_Blackcat

rule DITEKSHEN_MALWARE_Win_Blackcat : FILE
{
	meta:
		description = "Detects BlackCat ransomware"
		author = "ditekSHen"
		id = "b6831d84-40d7-52ae-8c4d-30b087b0007b"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9267-L9289"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "cd76e5b87f33d91c17fd032417583c3f68d0e310aaf6f08e26ec5d53844ed9d2"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$x1 = "{\"config_id\":\"\",\"public_key\":\"MIIBIjANBgkqhkiG9w0BAQEFAAO" ascii
		$x2 = "C:\\Users\\Public\\All Usersdeploy_note_and_image_for_all_users=" fullword ascii
		$s1 = "encrypt_app::windows" ascii
		$s2 = /locker::core::os::windows::(desktop_note|self_propagation|privilege_escalation|psexec|shadow_copy)/ ascii
		$s3 = "uac_bypass::shell_exec=" ascii
		$s4 = "-u-p-s-d-f-cpropagate::attempt=" ascii
		$s5 = "masquerade_peb" ascii
		$s6 = "RECOVER-${EXTENSION}-FILES.txt" ascii
		$s7 = ".onion/?access-key=${ACCESS_KEY}" ascii
		$s8 = "-vm-killno-vm-snapshot-killno-vm-kill-" ascii
		$s9 = "esxi_vm_killenable_esxi_vm_snapshot_killstrict_" ascii
		$s10 = /enum_(shares|servers)_sync::ok/ fullword ascii
		$s11 = "hidden_partitions::mount_all::mounting=" ascii

	condition:
		( uint16( 0 ) == 0x5a4d or uint16( 0 ) == 0x457f ) and ( all of ( $x* ) or 5 of ( $s* ) or ( 1 of ( $x* ) and 3 of ( $s* ) ) )
}