DITEKSHEN_MALWARE_Win_Polar

rule DITEKSHEN_MALWARE_Win_Polar : FILE
{
	meta:
		description = "Detects Polar ransomware"
		author = "ditekSHen"
		id = "ab4e4478-5417-5918-b5df-5b6ffe7438a9"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L2102-L2123"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "4f05a8ace9a03d02f54f0ebdd5349d1d1b23db8e34aa71edd44eebf02b88745c"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.Polar"

	strings:
		$s1 = "Encrypt Failed ! ErrorMessage :" wide
		$s2 = ".locked" fullword wide
		$s3 = ".cryptd" fullword wide
		$s4 = "$SysReset" fullword wide
		$s5 = "Polar.Properties.Resources" ascii wide
		$s6 = "AES_EnDecryptor.Basement" fullword ascii
		$s7 = "RunCMDCommand" fullword ascii
		$s8 = "killerps_list" fullword ascii
		$s9 = "clearlog" fullword ascii
		$s10 = "encryptFile" fullword ascii
		$s11 = "changeBackPictrue" fullword ascii
		$pdb1 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x86\\Release\\Encode.pdb" ascii
		$pdb2 = "\\Ransomware_ALL_encode\\dir_file\\obj\\x64\\Release\\Encode.pdb" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 8 of ( $s* ) or ( 1 of ( $pdb* ) and 2 of ( $s* ) ) )
}