DITEKSHEN_MALWARE_Win_Snatch

rule DITEKSHEN_MALWARE_Win_Snatch : FILE
{
	meta:
		description = "Detects Snatch / GoRansome / MauriGo ransomware"
		author = "ditekSHen"
		id = "00dce673-b909-571f-8117-c5d4ce73fb31"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5062-L5091"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "bf8c33a7203458c80a43944c3117bb897b1702f0024271904d9be682cbd695fc"
		score = 75
		quality = 73
		tags = "FILE"

	strings:
		$s1 = "main.encryptFile" ascii
		$s2 = "main.encryptFileExt" ascii
		$s3 = "main.deleteShadowCopy" ascii
		$s4 = "main.Shadow" fullword ascii
		$s5 = "main.RecoverMe" fullword ascii
		$s6 = "main.EncryptWithPublicKey" ascii
		$s7 = "main.EncoderLookupDir" fullword ascii
		$s8 = "main.ALIGNUP" fullword ascii
		$s9 = "main.encrypt" fullword ascii
		$s10 = "github.com/mauri870/ransomware" ascii
		$m1 = "Dear You, ALl Your files On YOUR network computers are encrypted" ascii
		$m2 = "You have to pay the ransom of %s USD in bitcoins to the address" ascii
		$m3 = "REMEMBER YOU FILES ARE IN SAVE HANDS AND WILL BE RESTORED OR RECOVERED ONCE PAYMENT IS DONE" ascii
		$m4 = ":HELP FEEED A CHILD:" ascii
		$m5 = ">SYSTEM NETWORK ENCRYPTED<" ascii
		$m6 = "YOUR IDENTIFICATION : %s" ascii
		$m7 = "convince you of our honesty" ascii
		$m8 = "use TOR browser to talk with support" ascii
		$m9 = "encrypted and attackers are taking" ascii
		$p1 = "/Go/src/kitty/kidrives/" ascii
		$p2 = "/LGoGo/encoder.go" ascii nocase
		$p3 = "/Go/src/kitty/kidata/" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 3 of ( $s* ) or 2 of ( $m* ) or ( 1 of ( $m* ) and 1 of ( $s* ) ) or ( all of ( $p* ) and ( 1 of ( $s* ) or 1 of ( $m* ) ) ) )
}