DITEKSHEN_MALWARE_Win_Zeoticus

rule DITEKSHEN_MALWARE_Win_Zeoticus : FILE
{
	meta:
		description = "Detects Zeoticus ransomware"
		author = "ditekSHen"
		id = "6d1096dd-d075-54eb-ade9-48e2f945145d"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5529-L5549"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "588c140c141e82dae56758550549dfb96410db50521ac546477e1adc5575b4a0"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "Dear %s" fullword wide
		$s2 = "\\??\\UNC\\%s\\%s\\" wide
		$s3 = "\\\\%ws\\admin$\\%ws" wide
		$s4 = "%s /node:\"%ws\" /user:\"%ws\" /password:" wide
		$s5 = "process call create" wide
		$s6 = ">----===Zeoticus" ascii
		$s7 = "ZEOTICUSV2" ascii
		$s8 = "GetExtendedTcpTable" fullword ascii
		$s9 = "SHAMROckSWTF" ascii
		$s10 = "NTDLL.RtlAllocateHeap" fullword ascii
		$s11 = ".pandora" fullword wide
		$s12 = { 70 00 20 00 72 00 20 00 69 00 20 00 76 00 20 00 65 00 20 00 74 }
		$pdb = "_cryptor\\shell_gen\\Release\\" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( $pdb ) )
}