DITEKSHEN_MALWARE_Win_Ziggy

rule DITEKSHEN_MALWARE_Win_Ziggy : FILE
{
	meta:
		description = "Detects Ziggy ransomware"
		author = "ditekSHen"
		id = "6d2d316a-cf19-5001-bf94-842346229d76"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3397-L3421"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "103a50511971161ca673e0c8378aeca2fa7d0f6309966bbb2b70e0d039e0f196"
		score = 75
		quality = 75
		tags = "FILE"
		snort2_sid = "920098"
		snort3_sid = "920096"
		clamav_sig = "MALWARE.Win.Ransomware.Ziggy"

	strings:
		$id1 = "/Ziggy Info;component/mainwindow.xaml" fullword wide
		$id2 = "AZiggy Info, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" fullword ascii
		$id3 = "Ziggy Ransomware" fullword wide
		$id4 = "clr-namespace:Zeggy" fullword ascii
		$s1 = "GetCooldown" fullword ascii
		$s2 = "checkCommandMappings" fullword ascii
		$s3 = "add_OnExecuteCommand" fullword ascii
		$s4 = "MindLated.jpg" fullword wide
		$s5 = "http://fixfiles.xyz/ziggy/api/info.php?id=" fullword wide
		$s6 = "Reamaining time:" fullword wide
		$msg1 = "<:In case of no answer in 12 hours write us to this e-mail" ascii
		$msg2 = "Free decryption as guarantee" fullword ascii
		$msg3 = "# Do not try to decrypt your data using third party software, it may cause permanent data loss" ascii
		$msg4 = "# Decryption of your files with the help of third parties may cause increased price (they add their fee to our) or you can becom" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $id* ) or 4 of ( $s* ) or 3 of ( $msg* ) )
}