DITEKSHEN_MALWARE_Win_PYSA

rule DITEKSHEN_MALWARE_Win_PYSA : FILE
{
	meta:
		description = "Detects PYSA/Mespinoza ransomware"
		author = "ditekSHen"
		id = "3a3fad6a-46bc-51dc-9723-4412034ca442"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2080-L2100"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "e614b827bd8d065e94852fed01497c785bf90c52c3624aff9939b3f40ecf96a4"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.PYSA"

	strings:
		$s1 = "%s\\Readme.README" fullword wide
		$s2 = "Every byte on any types of your devices was encrypted" ascii
		$s3 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 74 65 78 74 00 (50|70) (59|79) (53|73) (41|61) }
		$s4 = { 6c 65 67 61 6c 6e 6f 74 69 63 65 63 61 70 74 69 6f 6e 00 00 (50|70) (59|79) (53|73) (41|61) }
		$s5 = { 2e 62 61 74 00 00 6f 70 65 6e 00 00 00 00 53
                4f 46 54 57 41 52 45 5c 4d 69 63 72 6f 73 6f
                66 74 5c 57 69 6e 64 6f 77 73 5c 43 75 72 72
                65 6e 74 56 65 72 73 69 6f 6e 5c 50 6f 6c 69
                63 69 65 73 5c 53 79 73 74 65 6d 00 00 00 }
		$f1 = ".?AVPK_EncryptorFilter@CryptoPP@@" ascii
		$f2 = ".?AV?$TF_EncryptorImpl@" ascii
		$f3 = "@VTF_EncryptorBase@CryptoPP@@" ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $f* ) and 3 of ( $s* )
}