DITEKSHEN_MALWARE_Win_Getcrypt

rule DITEKSHEN_MALWARE_Win_Getcrypt : FILE
{
	meta:
		description = "GetCrypt ransomware payload"
		author = "ditekSHen"
		id = "fb6db807-372f-59e6-96c6-54dd4ece336d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L789-L825"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "fd7ee98757c3ac1f2b2a4dd9041c78d33273d7a7d596c3d99c6b8d79988f29f1"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig1 = "MALWARE_Win.Ransomware.GetCrypt-1"
		clamav_sig2 = "MALWARE_Win.Ransomware.GetCrypt-2"

	strings:
		$x1 = "delete shadows /all /quiet" wide
		$x2 = "C:\\Windows\\System32\\svchost.exe" fullword wide
		$x3 = "desk.bmp" fullword wide
		$x4 = ":\\Boot" fullword wide
		$x5 = "\\encrypted_key.bin" fullword wide
		$x6 = "vssadmin.exe" fullword wide
		$x7 = ":\\Recovery" fullword wide
		$s1 = "CryptEncrypt" fullword ascii
		$s2 = "NtWow64ReadVirtualMemory64" fullword ascii
		$s3 = "MPR.dll" fullword ascii
		$s4 = "%key%" fullword ascii
		$s5 = "CryptDestroyKey" fullword ascii
		$s6 = "ntdll.dll" fullword ascii
		$s7 = "WNetCancelConnection2W" fullword ascii
		$s8 = ".%c%c%c%c" fullword wide
		$s10 = { 43 72 79 70 74 49 6d 70 6f 72 74 4b 65 79 00 00
                 cb 00 43 72 79 70 74 45 6e 63 72 79 70 74 00 00
                 c1 00 43 72 79 70 74 41 63 71 75 69 72 65 43 6f
                 6e 74 65 78 74 41 00 00 c8 00 43 72 79 70 74 44
                 65 73 74 72 6f 79 4b 65 79 00 d2 00 43 72 79 70
                 74 47 65 6e 52 61 6e 64 6f 6d 00 00 c2 00 43 72
                 79 70 74 41 63 71 75 69 72 65 43 6f 6e 74 65 78
                 74 57 00 00 41 44 56 41 50 49 33 32 2e 64 6c 6c
                 00 00 b5 01 53 68 65 6c 6c 45 78 65 63 75 74 65
                 45 78 57 00 53 48 45 4c 4c 33 32 2e 64 6c 6c 00 }

	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or 8 of ( $s* ) )
}