DITEKSHEN_MALWARE_Linux_Hellokitty

rule DITEKSHEN_MALWARE_Linux_Hellokitty : FILE
{
	meta:
		description = "Detects Linux version of HelloKitty ransomware"
		author = "ditekSHen"
		id = "bb228937-8cd8-5fb8-aaed-3bd539ae96f2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L7722-L7746"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bcb1188d616b29fa535e757a37476435a3061d27e143339413f6829876701868"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$s1 = "exec_pipe:%s" ascii
		$s2 = "Error InitAPI !!!" fullword ascii
		$s3 = "No Files Found !!!" fullword ascii
		$s4 = "Error open log File:%s" fullword ascii
		$s5 = "%ld - Files Found  " fullword ascii
		$s6 = "Total VM run on host:" fullword ascii
		$s7 = "error:%d open:%s" fullword ascii
		$s8 = "work.log" fullword ascii
		$s9 = "esxcli vm process kill" ascii
		$s10 = "readdir64" fullword ascii
		$s11 = "%s_%d.block" fullword ascii
		$s12 = "EVP_EncryptFinal_ex" fullword ascii
		$s13 = ".README_TO_RESTORE" fullword ascii
		$m1 = "COMPROMISED AND YOUR SENSITIVE PRIVATE INFORMATION WAS STOLEN" ascii nocase
		$m2 = "damage them without special software" ascii nocase
		$m3 = "leaking or being sold" ascii nocase
		$m4 = "Data will be Published and/or Sold" ascii nocase

	condition:
		uint16( 0 ) == 0x457f and ( 6 of ( $s* ) or ( 2 of ( $m* ) and 2 of ( $s* ) ) or 8 of them )
}