MALPEDIA_Win_Nitrogen_Ransomware_Auto

rule MALPEDIA_Win_Nitrogen_Ransomware_Auto : FILE
{
	meta:
		description = "autogenerated rule brought to you by yara-signator"
		author = "Felix Bilstein - yara-signator at cocacoding dot com"
		id = "6c181df2-98aa-50c7-8294-ada1bd47e30e"
		date = "2026-05-04"
		modified = "2026-05-18"
		reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nitrogen_ransomware"
		source_url = "https://github.com/malpedia/signator-rules//blob/c901f97b7df03e41917da74c2a84b04c227316c2/rules/win.nitrogen_ransomware_auto.yar#L1-L134"
		license_url = "N/A"
		logic_hash = "4e2ca4609381b30d42e64c0b5293ba475f8fc064d2896c6840f5040db174f8c4"
		score = 75
		quality = 75
		tags = "FILE"
		version = "1"
		tool = "yara-signator v0.6.0"
		signator_config = "callsandjumps;datarefs;binvalue"
		malpedia_rule_date = "20260422"
		malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
		malpedia_version = "20260504"
		malpedia_license = "CC BY-SA 4.0"
		malpedia_sharing = "TLP:WHITE"

	strings:
		$sequence_0 = { 4889e5 4883ec20 894d10 837d1000 741e 8b4510 89c0 }
		$sequence_1 = { 8b842460010000 83c001 31d0 6689842466010000 0fb7942468010000 8b842460010000 83c002 }
		$sequence_2 = { 83f624 6689b42470550000 0fb7742450 83c609 83f653 6689b42472550000 0fb774244c }
		$sequence_3 = { 83c004 31d0 668984245c130000 0fb794245e130000 8b842450130000 83c005 31d0 }
		$sequence_4 = { 83e80a 668984246c040000 0fb784246e040000 f30f7e35???????? 4c8b3d???????? 83e80a 448b35???????? }
		$sequence_5 = { 83c007 31d0 66898424d21b0000 0fb79424d41b0000 8b8424c01b0000 83c008 31d0 }
		$sequence_6 = { 83ea05 66899444203e0000 4883c001 4883f81f 75e3 488d8424203e0000 4c8b05???????? }
		$sequence_7 = { 8bbc24204f0000 4183c601 8bb424204f0000 4183c502 4183c403 4183f665 83c504 }
		$sequence_8 = { 488d8424647c0000 31c9 66899424ce7c0000 4889842420870000 c78424a05b000024000000 8bb424a05b0000 448bb424a05b0000 }
		$sequence_9 = { 89442468 8b8c24205d0000 8b9424205d0000 448b9c24205d0000 897c2460 448b8424205d0000 448b8c24205d0000 }

	condition:
		7 of them and filesize < 2590720
}