DITEKSHEN_MALWARE_Win_Hive

rule DITEKSHEN_MALWARE_Win_Hive : FILE
{
	meta:
		description = "Detects Hive ransomware"
		author = "ditekSHen"
		id = "7b79dc54-01c7-5667-acf5-a32cd7a45b54"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L6610-L6647"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "14c20ff2fa62d80eed0f4f364e24d93d493d4f3b47f664983714940afa74046f"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$url1 = "http://hivecust" ascii
		$url2 = "http://hiveleakdb" ascii
		$s1 = "encrypt_files.go" ascii
		$s2 = "erase_key.go" ascii
		$s3 = "kill_processes.go" ascii
		$s4 = "remove_shadow_copies.go" ascii
		$s5 = "stop_services_windows.go" ascii
		$s6 = "remove_itself_windows.go" ascii
		$x1 = "/encryptor/" ascii
		$x2 = "HOW_TO_DECRYPT.txt" ascii
		$x3 = "FilesEncrypted" fullword ascii
		$x4 = "EncryptionStarted" fullword ascii
		$x5 = "encryptFilesGroup" fullword ascii
		$x6 = "Your data will be undecryptable" ascii
		$x7 = "- Do not fool yourself. Encryption has perfect secrecy" ascii
		$v1_1 = ".EncryptFiles." ascii
		$v1_2 = ".EncryptFilename." ascii
		$v1_3 = ")*struct { F uintptr; .autotmp_14 string }" ascii
		$v1_4 = "D*struct { F uintptr; data *[]uint8; seed *uint8; fnc *main.decFunc }" ascii
		$v1_5 = "golang.org/x/sys/windows.getSystemWindowsDirectory" ascii
		$v1_6 = "path/filepath.WalkDir" ascii
		$v2_1 = "taskkill /f /im" ascii
		$v2_2 = "schtasks /delete /tn" ascii
		$v2_3 = "encfile.txt" ascii
		$v2_4 = "README.html" ascii
		$v2_5 = "total encrypt %v/%v" ascii
		$v2_6 = "<b>ITSSHOWKEY</b>" ascii
		$v2_7 = "Recovery your files." ascii
		$v2_8 = "yaml:\"send_host\"" ascii
		$v2_9 = "yaml:\"ignore_dir\"" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $url* ) or all of ( $s* ) or 4 of ( $x* ) or 5 of ( $v1* ) or 5 of ( $v2* ) or ( 4 of ( $v2* ) and #v2_1 > 10 ) )
}