DITEKSHEN_MALWARE_Win_Clop

rule DITEKSHEN_MALWARE_Win_Clop : FILE
{
	meta:
		description = "Detects Clop ransomware variants"
		author = "ditekSHen"
		id = "d3c9e950-8b03-5d19-8448-9cf208813df2"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L4869-L4889"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "a1a21100c468c4db147f97b0724b7a3aefbb92b157071bfe6f61d02768573b44"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$x1 = "Cllp^_-" ascii
		$s2 = "temp.dat" fullword wide
		$s3 = "README_README.txt" wide
		$s4 = "BEGIN PUBLIC KEY" ascii
		$s5 = "runrun" wide
		$s6 = "wevtutil.exe" ascii
		$s7 = "%s%s.Cllp" fullword wide
		$s8 = "WinCheckDRVs" fullword wide
		$o1 = { 6a ff 56 89 9d 28 dd ff ff ff d0 a1 64 32 41 00 }
		$o2 = { 56 89 9d 28 dd ff ff ff 15 78 32 41 00 eb 07 43 }
		$o3 = { 68 ?? 34 41 00 8d 85 58 dd ff ff 50 ff d7 85 c0 }
		$o4 = { 68 d0 34 41 00 50 ff d6 8b bd 28 d5 ff ff 83 c4 }
		$o5 = { a1 64 32 41 00 43 56 89 9d 08 d5 ff ff ff d0 8b }

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $s* ) or ( 1 of ( $x* ) and ( 3 of ( $s* ) or 4 of ( $o* ) ) ) or ( all of ( $o* ) and 2 of ( $s* ) ) or ( 4 of ( $s* ) and 4 of ( $o* ) ) )
}