DITEKSHEN_MALWARE_Win_Osno

rule DITEKSHEN_MALWARE_Win_Osno : FILE
{
	meta:
		description = "Osno ransomware and infostealer payload"
		author = "ditekSHen"
		id = "25ed5ad4-804a-5608-b6fe-a811ca6744d8"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L1617-L1652"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3df59c306017001467a5f237db2ab37d97c34116558e18420a6a1f01f08f520f"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$s1 = ".HolyGate+<>c+<<FinalBoss>" ascii
		$s2 = /Osno(Keylogger|Stealer|Ransom)/ wide
		$s3 = "password,executeWebhook('Account credentials" wide
		$s4 = "-Name Osno -PropertyType" wide
		$s5 = "process.env.hook" ascii
		$s6 = "Stealer.JSON.JsonValue" ascii
		$s7 = "<DetectBrowserss>b_" ascii
		$s8 = "<TryGetDiscordPath>b_" ascii
		$s9 = "antiVM" fullword ascii
		$s10 = "downloadurl" fullword ascii
		$s11 = "set_sPassword" fullword ascii
		$txt0 = "{0} {1} .txt" fullword wide
		$txt1 = "\\ScanningNetworks.txt" fullword wide
		$txt2 = "\\SteamApps.txt" fullword wide
		$txt3 = "-ErrorsLogs.txt" fullword wide
		$txt4 = "-keylogs.txt" fullword wide
		$txt5 = "Hardware & Soft.txt" fullword wide
		$cnc0 = "/csharp/" ascii wide
		$cnc1 = "token=" ascii wide
		$cnc2 = "&timestamp=" ascii wide
		$cnc3 = "&session_id=" ascii wide
		$cnc4 = "&aid=" ascii wide
		$cnc5 = "&secret=" ascii wide
		$cnc6 = "&api_key" ascii wide
		$cnc7 = "&session_key=" ascii wide
		$cnc8 = "&type=" ascii wide

	condition:
		( uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 4 of ( $txt* ) or ( 4 of ( $s* ) and 2 of ( $txt* ) ) ) ) or ( 7 of ( $cnc* ) )
}