DITEKSHEN_MALWARE_Win_Nibiru

rule DITEKSHEN_MALWARE_Win_Nibiru : FILE
{
	meta:
		description = "Detects Nibiru ransomware"
		author = "ditekSHen"
		id = "78c3bf75-1ab3-5f88-ba4b-d5a0a906d57c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2486-L2504"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "f3718e9091b09e0f47ecd6715a3a2c160ede6ab9fb144e7ed115dd5a25c8e379"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.Nibiru"

	strings:
		$s1 = ".encrypt" fullword wide
		$s2 = "crypted" fullword wide
		$s3 = ".Nibiru" fullword wide
		$s4 = "Encryption Complete" fullword wide
		$s5 = "All your files,documents,important datas,mp4,mp3 and anything valuable" ascii
		$s6 = "EncryptOrDecryptFile" fullword ascii
		$s7 = "get_hacker" ascii
		$s8 = "/C choice /C Y /N /D Y /T 3 & Del \"" fullword wide
		$s9 = "Once You pay,you get the KEY to decrypt files" ascii
		$pdb = "\\Projects\\Nibiru\\Nibiru\\obj\\x86\\Release\\Nibiru.pdb" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 7 of them or ( $pdb and 2 of ( $s* ) ) )
}