DITEKSHEN_MALWARE_Win_Wobbychipmbr

rule DITEKSHEN_MALWARE_Win_Wobbychipmbr : FILE
{
	meta:
		description = "Detects WobbyChipMBR / Covid-21 ransomware"
		author = "ditekSHen"
		id = "581fbce1-128d-5323-a259-14d9bfdf09b1"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5044-L5060"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "168c7f610625131c9552252d2b824a90918d2961996ee0f783497dff5cf17351"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$x1 = "You became a Victim of the Covid-21 Ransomware" ascii wide
		$x2 = "Reinstalling Windows has been blocked" ascii wide
		$x3 = "Enter Decryption Key:" ascii wide
		$x4 = "encrypted with military grade encryption" ascii wide
		$s1 = "schtasks.exe /Create /TN wininit /ru SYSTEM /SC ONSTART /TR" ascii
		$s2 = "\\EFI\\Boot\\bootx64.efi" ascii wide
		$s3 = "DumpHex" fullword ascii
		$s4 = "TFTP Error" fullword wide
		$s5 = "HD(Part%d,MBRType=%02x,SigType=%02x)" fullword wide

	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $x* ) or all of ( $s* ) or ( 1 of ( $x* ) and 2 of ( $s* ) ) )
}