DITEKSHEN_MALWARE_Win_STOP

rule DITEKSHEN_MALWARE_Win_STOP : FILE
{
	meta:
		description = "Detects STOP ransomware"
		author = "ditekSHen"
		id = "e928d917-a9d9-5830-938a-59b62608e84c"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3286-L3309"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "61f7e7c1139c56088b2f58b78ae132ffcfef0f931c15b67ea775b0d5e51d189d"
		score = 75
		quality = 73
		tags = "FILE"
		snort2_sid = "920113"
		snort3_sid = "920111"
		clamav_sig = "MALWARE.Win.Ransomware.STOP"

	strings:
		$x1 = "C:\\SystemID\\PersonalID.txt" fullword wide
		$x2 = "/deny *S-1-1-0:(OI)(CI)(DE,DC)" wide
		$x3 = "e:\\doc\\my work (c++)\\_git\\encryption\\" ascii wide nocase
		$s1 = "\" --AutoStart" fullword ascii wide
		$s2 = "--ForNetRes" fullword wide
		$s3 = "--Admin" fullword wide
		$s4 = "%username%" fullword wide
		$s5 = "?pid=" fullword wide
		$s6 = /&first=(true|false)/ fullword wide
		$s7 = "delself.bat" ascii
		$mutex1 = "{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}" fullword ascii
		$mutex2 = "{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}" fullword ascii
		$mutex3 = "{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}" fullword ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( 2 of ( $x* ) and 1 of ( $mutex* ) ) or ( all of ( $x* ) ) or ( 6 of ( $s* ) and ( 1 of ( $x* ) or 1 of ( $mutex* ) ) ) or ( 9 of them ) )
}