YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1

Triggers on strings of known DearCry samples

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Nils Kuhnert
Date: 2021-03-12
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Triggers on strings of known DearCry samples

Targets: Windows PE.

It defines 9 patterns (9 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

mal-ransom-crime-dearcry-mar2021-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_MAL_RANSOM_Crime_Dearcry_Mar2021_1 : FILE
{
	meta:
		description = "Triggers on strings of known DearCry samples"
		author = "Nils Kuhnert"
		id = "d9714502-f1ea-5fe8-b0ac-1f7a9a30d8f5"
		date = "2021-03-12"
		modified = "2023-12-05"
		reference = "https://twitter.com/phillip_misner/status/1370197696280027136"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/crime_dearcry_ransom.yar#L1-L27"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff"
		hash = "e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6"
		hash = "feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede"
		logic_hash = "e55507475888087c84f9624f82516e8a40aaf59bf2fbea72129a1dd134b28110"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$x1 = ".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML  .XHTML .JS .JSP .PHP .KEYCHAIN .PEM .SQL .APK .APP .BAT .CGI .ASPX .CER .CFM .C .CPP .GO .CONFIG .PL .PY .DWG .XML .JPG .BMP .PNG .EXE .DLL .CAD .AVI .H.CSV .DAT .ISO .PST .PGD  .7Z .RAR .ZIP .ZIPX .TAR .PDB .BIN .DB .MDB .MDF .BAK .LOG .EDB .STM .DBF .ORA .GPG .EDB .MFS" ascii
		$s1 = "create rsa error" ascii fullword
		$s2 = "DEARCRY!" ascii fullword
		$s4 = "/readme.txt" ascii fullword
		$s5 = "msupdate" ascii fullword
		$s6 = "Your file has been encrypted!" ascii fullword
		$s7 = "%c:\\%s" ascii fullword
		$s8 = "C:\\Users\\john\\" ascii
		$s9 = "EncryptFile.exe.pdb" ascii

	condition:
		uint16( 0 ) == 0x5a4d and filesize > 1MB and filesize < 2MB and ( 1 of ( $x* ) or 3 of them ) or 5 of them
}

Strings (9 patterns)

Identifier	Type	Value	Modifiers
$x1	text	".TIF .TIFF .PDF .XLS .XLSX .XLTM .PS .PPS .PPT .PPTX .DOC .DOCX .LOG .MSG .RTF .TEX .TXT .CAD .WPS .EML .INI .CSS .HTM .HTML .XHTML .JS .JSP .PHP .KEYCHAIN .P …	ascii
$s1	text	"create rsa error"	ascii fullword
$s2	text	"DEARCRY!"	ascii fullword
$s4	text	"/readme.txt"	ascii fullword
$s5	text	"msupdate"	ascii fullword
$s6	text	"Your file has been encrypted!"	ascii fullword
$s7	text	"%c:\\%s"	ascii fullword
$s8	text	"C:\\Users\\john\\"	ascii
$s9	text	"EncryptFile.exe.pdb"	ascii

Condition

uint16( 0 ) == 0x5a4d and filesize > 1MB and filesize < 2MB and ( 1 of ( $x* ) or 3 of them ) or 5 of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 2MB (a cheap guard that skips large files).
The file must be larger than 1MB.
At least 1 patterns in ( $x* ) must match.
At least 3 patterns in the rule must match.
At least 5 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://twitter.com/phillip_misner/status/1370197696280027136

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

2b9838da7edb0decd32b086e47a31e8f5733b5981ad8247a2f9508e232589bff
e044d9f2d0f1260c3f4a543a1e67f33fcac265be114a1b135fd575b860d2b8c6
feb3e6d30ba573ba23f3bd1291ca173b7879706d1fe039c34d53a4fdcdf33ede

Licence & attribution

Author: Nils Kuhnert

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: d9714502-f1ea-5fe8-b0ac-1f7a9a30d8f5

Tags:FILE

SIGNATURE_BASE_EXT_MAL_JS_Socgholish_Mar21_1
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-03-29
SIGNATURE_BASE_MAL_CRIME_Unknown_ISO_Jun21_1
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04
SIGNATURE_BASE_MAL_CRIME_Unknown_LNK_Jun21_1
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04
SIGNATURE_BASE_MAL_CRIME_Suspicious_Hex_String_Jun21_1
MalwareSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2021-06-04
SIGNATURE_BASE_SUSP_Doc_Windowsinstaller_Call_Feb22_1
Suspicious / huntingSignature Base (Florian Roth / Nextron)· Nils Kuhnert· 2022-02-26