DITEKSHEN_MALWARE_Win_G0Crypt

rule DITEKSHEN_MALWARE_Win_G0Crypt : FILE
{
	meta:
		description = "Detects G0Crypt / BRG0SNet / NovaGP ransomware"
		author = "ditekSHen"
		id = "c0dd8a1b-1aa6-50be-92c4-125eabaf3f9f"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L10123-L10156"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a678bbb02b82c34fb5e7bdce2e60b0da88f12b094e7ca3b74345814d0da5ce42"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$x1 = "G0Crypt/go/" ascii
		$x2 = "BRG0SNet" ascii
		$x3 = "/NovaGroup" ascii
		$x4 = "novagroup@onionmail.org" ascii nocase
		$x5 = "# Nova Group" ascii
		$f1 = "main.HaveRun" ascii
		$f2 = "main.FindFile" ascii
		$f3 = "main.deriveKey" ascii
		$f4 = "main.Pwd" fullword ascii
		$f5 = "/ClearBashFile" ascii
		$f6 = "/ClearUserTempFiles" ascii
		$f7 = "/KillProccess" ascii
		$f8 = "/Encryptor" ascii
		$f9 = "/NoDirEncrypt" ascii
		$f10 = "/RunCmdEexecutable" ascii
		$f11 = "/StopImportantServices" ascii
		$f12 = "/GetPwd" ascii
		$s1 = "\\$Recycle.Bin"
		$s2 = ".README.txt"
		$s3 = "\\BRSPATH.exe"
		$s4 = "taskkill /F /IM sql*"
		$s5 = "C:\\inetpub\\logs\\"
		$s6 = "shutdown /r"
		$s7 = ":\\Program Files\\VMware\\"
		$s8 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v Message /t REG_SZ /d"
		$s9 = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /v DelLogSoft /t REG_SZ /d"

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 7 of ( $f* ) or ( 1 of ( $x* ) and ( 5 of ( $f* ) or 5 of ( $s* ) ) ) or ( 6 of ( $f* ) and 4 of ( $s* ) ) or 12 of them )
}