DITEKSHEN_MALWARE_Win_Lokilocker

rule DITEKSHEN_MALWARE_Win_Lokilocker : FILE
{
	meta:
		description = "Detects LokiLocker ransomware"
		author = "ditekSHen"
		id = "4f4927c5-79e6-5c5a-b84d-c4728affe9e1"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L9169-L9194"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bf78f5e8f40c1a19f6b078a85854e95d5ef1f321393a831edda17b0d65515da7"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$x1 = "SOFTWARE\\Loki" fullword wide
		$x2 = "Cpriv.Loki" fullword wide
		$x3 = "Loki/" wide
		$x4 = /loki(\s)?locker/ fullword wide nocase
		$s1 = "Restore-My-Files.txt" wide
		$s2 = "loading encryption keys" wide
		$s3 = "Kill switch -> enabled" wide
		$s4 = "ScanSMBShares" fullword ascii
		$s5 = "RewriteMBR" fullword ascii
		$s6 = /Encrypt(Drives|File|WinVolume|OsDrive)/ fullword ascii
		$n1 = "unique-id=" ascii wide
		$n2 = "&disk-size=" ascii wide
		$n3 = "&user=Darwin&cpu-name=" ascii wide
		$n4 = "&ram-size=" ascii wide
		$n5 = "&os-name=" ascii wide
		$n6 = "&chat-id=" ascii wide
		$n7 = "&msg-id=" ascii wide
		$n8 = "&elapsed-time=" ascii wide

	condition:
		uint16( 0 ) == 0x5a4d and ( 2 of ( $x* ) or 4 of ( $s* ) or 6 of ( $n* ) or ( 3 of ( $s* ) and 3 of ( $n* ) ) or ( 1 of ( $x* ) and ( 2 of ( $s* ) or 2 of ( $n* ) ) ) )
}