DITEKSHEN_MALWARE_Win_Vssdestroy

rule DITEKSHEN_MALWARE_Win_Vssdestroy : FILE
{
	meta:
		description = "VSSDestroy/Matrix ransomware payload"
		author = "ditekSHen"
		id = "734ece56-b993-5b44-ae15-f673fabfe8ad"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L717-L740"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "24bfd32580f784440252d629a7ab86b84a570ded34409940616be2a89bf73088"
		score = 75
		quality = 75
		tags = "FILE"
		snort_sid = "920008-920009"
		clamav_sig = "MALWARE.Win.Ransomware.VSSDestroy"

	strings:
		$o1 = "[SHARESSCAN]" wide
		$o2 = "[LDRIVESSCAN]" wide
		$o3 = "[LOGSAVED]" wide
		$o4 = "[LPROGRESS]" wide
		$o5 = "[FINISHSAVED]" wide
		$o6 = "[ALL_LOCAL_KID]" wide
		$o7 = "[DIRSCAN" wide
		$o8 = "[GENKEY]" wide
		$s1 = "\\cmd.exe" nocase wide
		$s2 = "/C powershell \"" nocase wide
		$s3 = "%COMPUTERNAME%" wide
		$s4 = "%USERNAME%" wide
		$s5 = "Error loading Socket interface (ws2_32.dll)!" wide
		$s6 = "Old file list dump found. Want to load it? (y/n):" fullword wide

	condition:
		( uint16( 0 ) == 0x5a4d and 4 of ( $o* ) and 3 of ( $s* ) ) or ( 5 of ( $o* ) and 4 of ( $s* ) )
}