SEKOIA_Wiper_Win_Nominatus_Toxicbattery

import "pe"
import "hash"

rule SEKOIA_Wiper_Win_Nominatus_Toxicbattery : FILE
{
	meta:
		description = "Detect the Nominatus_ToxicBattery malware"
		author = "Sekoia.io"
		id = "0262378f-f509-4ea4-a3eb-cd0183c4361d"
		date = "2022-11-21"
		modified = "2024-12-19"
		reference = "https://github.com/SEKOIA-IO/Community"
		source_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/yara_rules/wiper_win_nominatus_toxicbattery.yar#L4-L42"
		license_url = "https://github.com/SEKOIA-IO/Community/blob/a438a5901a211c2abdf75da9c93921ef187473d1/LICENSE.md"
		logic_hash = "c226a4c3bcc451482eb782c1cb84f3e956be1e214368d1b315076078d3148955"
		score = 75
		quality = 80
		tags = "FILE"
		version = "1.0"
		classification = "TLP:CLEAR"

	strings:
		$ = "DISK"
		$ = "FileNaME"
		$ = "FILNAME"
		$ = "runCommand"
		$ = "HAHAH"
		$ = "Damage"
		$ = "fastInfector"
		$ = "d:\\again\\SharpDevelop Projects\\RInjector\\Virus.win32RozbehStrike\\obj\\Debug\\Nominatus_ToxicBattery.pdb"
		$ = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" wide
		$ = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon" wide
		$ = "\\Antivirus.bat" wide
		$ = "\\Antivirus3.vbs" wide
		$ = "vssadmin Delete Shadows /all /quiet" wide

	condition:
		uint16( 0 ) == 0x5A4D and 10 of them or for any i in ( 0 .. pe.number_of_sections -1 ) : ( hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "e7f35c173c34b7080d437a90ec90a982" or hash.md5 ( pe.sections [ i ] . raw_data_offset , pe.sections [ i ] . raw_data_size ) == "2e25c5d3baba182f008a5a15c6f06403" ) or for any i in ( 0 .. pe.number_of_resources -1 ) : ( hash.sha256 ( pe.resources [ i ] . offset , pe.resources [ i ] . length ) == "70b1c002e4c0c9782c7ce1ef4a13c58ec1da54a26fd06dd7821a71f29431da82" )
}