DITEKSHEN_MALWARE_Win_Cicada3301

rule DITEKSHEN_MALWARE_Win_Cicada3301 : FILE
{
	meta:
		description = "Detects Cicada3301"
		author = "ditekshen"
		id = "0aebee9f-177d-5a1b-87e0-8797fb6f6823"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L11860-L11885"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "b8b7596bc8ae01b89742e17bd3dbfcc1e2fad486cc6ea19c8de813fc677509f4"
		score = 75
		quality = 75
		tags = "FILE"
		clamav1 = "MALWARE.Win.Ransomware.Cicada3301"

	strings:
		$s1 = "cmd/Cchcp 65001 >nulnet view \\\\"
		$s2 = "create_file_recovery"
		$s3 = "ecnrypted_files_full"
		$s4 = "get_excluded_directories"
		$s5 = "collect_files_except"
		$s6 = ".exe4d5a" ascii
		$s7 = "-accepteula -s -d \"\" --" ascii
		$s8 = "[*.exe*.EXE*.DLL*.ini*.inf*.pol*.cmd*.ps1*.vbs*.bat*.pagefile.sys*.hiberfil.sys*.drv" ascii
		$s9 = "memtasveeamsvc$backupsqlvssmsexchangesql$mysqlmysql$sophosMSExchange" ascii
		$s10 = "-DATA.txt" ascii
		$s11 = /--no_(local|net|impl)/ fullword ascii
		$c1 = "fsutil" ascii
		$c2 = "iisreset" ascii
		$c3 = "vssadmin" ascii
		$c4 = "wmic" ascii
		$c5 = "bcdedit" ascii
		$c6 = "wevtutil" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or ( 4 of ( $c* ) and 4 of ( $s* ) ) or ( all of ( $c* ) and 2 of ( $s* ) ) or 9 of them )
}