TRELLIX_ARC_RANSOM_Nefilim_Go

rule TRELLIX_ARC_RANSOM_Nefilim_Go : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect the new Nefilim written in GO"
		author = "Marc Rivero | McAfee ATR Team"
		id = "a8809060-c646-5d54-88e7-c8054305ee6c"
		date = "2020-07-13"
		modified = "2020-08-14"
		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_NEFILIM.yar#L74-L98"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "a51fec27e478a1908fc58c96eb14f3719608ed925f1b44eb67bbcc67bd4c4099"
		logic_hash = "f0b10286fb1623a32bcf1f30cadce2901f7711cb36db6bbe812f6c2e03862270"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Nefilim"
		actor_type = "Cybercrime"
		actor_group = "Unknown"

	strings:
		$pattern = { FF20476F206275696C642049443A20226A744368374D37436A4A5732634C5F636633374A2F49625946794336635A64735F4D796A56633461642F486B6D36694A4D39327847785F4F2D65746744692F664E37434C43622D59716E374D795947565A686F220A20FFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108766B83EC0CC744241400000000C7442418000000008B4424108400890424E88D0200008B44240485C0740789C183F8FF7514C744241400000000C74424180000000083C40CC3894C24088B44241083C004890424E8570200008B4424048B4C2408894C24148944241883C40CC3E8AE5A0400E979FFFFFFCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EC00000083EC108B44241885C00F84C30000008B4424148400890424E8FD0100008B44240485C0742E89C183F8FF74E38B44241839C10F85800000008B44241C894424048B44241483C004890424E88B12000083C410C3E8620303008B442414890424C744240400000000C7442408FFFFFFFFE8A61200000FB644240C84C07507E868030300EB8B8B44241C894424048B4424148D4804890C24E83F1200008B442418894424048B442414890424E82B120000E83603030083C410C38D05408E4E008904248D05B8CC510089442404E8DA3F02000F0B8D05408E4E008904248D05B0CC510089442404E8C03F02000F0BE899590400E9F4FEFFFFCCCCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B4424088B4C240CF00FB14D000F94442410C3CCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCCE90B000000CCCCCCCCCCCCCCCCCCCCCC8B6C24048B44240889C1F00FC1450001C1894C240CC3CCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B05000000008B7424088B7C240C8B45008B550489C389D101F311F9F00FC74D0075F1895C2410894C2414C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B442404A90700000074068B05000000000F6F000F7F4424080F77C3CCCCCCCCE9CBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9BBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C24048B442408874500C3CCCCCCCCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B4424040FBCC074058944240CC38B4424080FBCC0740883C0208944240CC3C744240C40000000C3CCCCCCCCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC8B4424048B0089442408C3CCCCCCCCCC83EC208B4424248B088B54242889CB01D1894C241C8B6804890424895C2404896C2408894C240C8B5C242C11DD896C2418896C2410E8160100000FB644241484C074C08B44241C894424308B4424188944243483C420C3CCCCCCCCCCCCCCCCCC83EC208B4424248B08894C24188B50048954241C890424894C2404895424088B5C2428895C240C8B6C242C896C2410E8BC0000000FB644241484C074C68B442418894424308B44241C8944243483C420C3CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCCE9DBFFFFFFCCCCCCCCCCCCCCCCCCCCCCE9EBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DBFEFFFFCCCCCCCCCCCCCCCCCCCCCCE9DB000000CCCCCCCCCCCCCCCCCCCCCCE97B000000CCCCCCCCCCCCCCCCCCCCCCE9CB000000CCCCCCCCCCCCCCCCCCCCCCE9BBFEFFFFCCCCCCCCCCCCCCCCCCCCCC8B6C2404F7C50700000074068B2D000000008B4424088B54240C8B5C24108B4C2414F00FC74D000F94442418C3CCCCCC8B5C24048B4424088B4C240CF00FB10B0F94442410C3CCCCCCCCCCCCCCCCCCCC8B5C24048B44240889C1F00FC10301C88944240CC3CCCCCCCCCCCCCCCCCCCCCC8B5C24048B44240887038944240CC3CCE9EBFFFFFFCCCCCCCCCCCCCCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B5C24048B4424088703C3CCCCCCCCCC8B442404A90700000074068B05000000008D5C24080F6F000F7F030F77C3CCCC8B442404A90700000074068B05000000000F6F4424080F7F000F77B800000000F00FC10424C3CCCCCCCCCCCCCCCCCCCC8B4424048A5C2408F00818C3CCCCCCCC8B4424048A5C2408F02018C3CCCCCCCC648B0D140000008B89000000003B610876098B4424088944240CC3E860550400EBDECCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240801000000E8AF4400008B44240C8944241C83C410C3E80E550400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240802000000E85F4400008B44240C8944241C83C410C3E8BE540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108762B83EC108B4424148904248B44241889442404C744240810000000E80F4400008B44240C8944241C83C410C3E86E540400EBBCCCCCCCCCCCCCCCCCCCCCCCCC83EC108D42048B008B4C2414890C248B4C2418894C240489442408E8D04300008B44240C8944241C83C410C3CCCCCCCC648B0D140000008B89000000003B6108762C83EC108B4424148B088B400489442408890C248B44241889442404E88E4300008B44240C8944241C83C410C3E8ED530400EBBBCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B600000083EC108B442414F30F10000F57C90F2EC175060F8B860000000F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240804000000E8C74200008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E80F530400E92AFFFFFFCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86B800000083EC108B442414F20F10000F57C9660F2EC175060F8B87000000660F2EC075027B5B648B05140000008B80000000008B40188B88940000008B909800000089909400000089CBC1E11131D989D331CAC1E90731D189DAC1EB1031CB8998980000008D041A8B4C241831C835A98E7FAA69C0CD76BAC28944241C83C410C38904248B44241889442404C744240808000000E8E54100008B44240C8944241C83C410C38B44241835A98E7FAA69C0CD76BAC28944241C83C410C3E82D520400E928FFFFFFCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E815FEFFFF8B44241083C0048B4C2408890424894C2404E8FEFDFFFF8B4424088944241883C40CC3E8CD510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B6108763C83EC0C8B44241084008904248B4C2414894C2404E895FEFFFF8B44241083C0088B4C2408890424894C2404E87EFEFFFF8B4424088944241883C40CC3E86D510400EBABCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86F200000083EC248B4424288B0885C974678B49048B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E8B2FA03008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8F46603008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E81E8E00008B44240C8B4C2408890C2489442404E87A3602000F0BE853500400E9EEFEFFFFCCCCCCCCCCCCCCCCCCCCCCCCCCCC648B0D140000008B89000000003B61080F86EF00000083EC248B4424288B0885C974648B59108B1385D274670FB6490FF6C120742983C0048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B40048904248B44242C35A98E7FAA894424048B02FFD08B44240869C0CD76BAC28944243083C424C38B44242C8944243083C424C3890C24E895F903008B4424088B4C2404C70424000000008D15A279500089542404C744240818000000894C240C89442410E8D76503008B4424188B4C2414894C241C894424208D05C0D24E008904248D44241C89442404E8018D00008B44240C8B4C2408890C2489442404E85D3502000F0BE8364F0400E9F1FEFFFFCC648B0D140000008B89000000003B61087606C644240C01C3 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 8000KB and all of them
}