TRELLIX_ARC_Ransom_Babuk

rule TRELLIX_ARC_Ransom_Babuk : RANSOM T1027 T1083 T1057 T1082 T1129 T1490 T1543_003 FILE
{
	meta:
		description = "Rule to detect Babuk Locker"
		author = "TS @ McAfee ATR"
		id = "7c0a3b4e-90aa-5442-aa5e-1a7fcae9bec8"
		date = "2021-01-19"
		modified = "2021-02-24"
		reference = "https://github.com/advanced-threat-research/Yara-Rules/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_BabukLocker_Jan2021.yar#L1-L25"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "e10713a4a5f635767dcd54d609bed977"
		logic_hash = "123cebd1c2e66f3e91ee235cb9288df63dfaeba02e6df45f896cb50f38851a8f"
		score = 75
		quality = 70
		tags = "RANSOM, T1027, T1083, T1057, T1082, T1129, T1490, T1543.003, FILE"
		rule_version = "v2"
		malware_family = "Ransom:Win/Babuk"
		malware_type = "Ransom"
		mitre_attack = "T1027, T1083, T1057, T1082, T1129, T1490, T1543.003"

	strings:
		$s1 = {005C0048006F007700200054006F00200052006500730074006F0072006500200059006F00750072002000460069006C00650073002E007400780074}
		$s2 = "delete shadows /all /quiet" fullword wide
		$pattern1 = {006D656D74617300006D65706F63730000736F70686F730000766565616D0000006261636B7570000047785673730000004778426C7200000047784657440000004778435644000000477843494D67720044656657617463680000000063634576744D67720000000063635365744D677200000000536176526F616D005254567363616E0051424643536572766963650051424944505365727669636500000000496E747569742E517569636B426F6F6B732E46435300}
		$pattern2 = {004163725363683253766300004163726F6E69734167656E74000000004341534144324457656253766300000043414152435570646174655376630000730071}
		$pattern3 = {FFB0154000C78584FDFFFFB8154000C78588FDFFFFC0154000C7858CFDFFFFC8154000C78590FDFFFFD0154000C78594FDFFFFD8154000C78598FDFFFFE0154000C7859CFDFFFFE8154000C785A0FDFFFFF0154000C785A4FDFFFFF8154000C785A8FDFFFF00164000C785ACFDFFFF08164000C785B0FDFFFF10164000C785B4FDFFFF18164000C785B8FDFFFF20164000C785BCFDFFFF28164000C785C0FDFFFF30164000C785C4FDFFFF38164000C785C8FDFFFF40164000C785CCFDFFFF48164000C785D0FDFFFF50164000C785D4FDFFFF581640}
		$pattern4 = {400010104000181040002010400028104000301040003810400040104000481040005010400058104000601040006C10400078104000841040008C10400094104000A0104000B0104000C8104000DC104000E8104000F01040000011400008114000181140002411400038114000501140005C11400064114000741140008C114000A8114000C0114000E0114000F4114000101240002812400034124000441240005412400064124000741240008C124000A0124000B8124000D4124000EC1240000C1340002813400054134000741340008C134000A4134000C4134000E8134000FC134000141440003C144000501440006C144000881440009C144000B4144000CC144000E8144000FC144000141540003415400048154000601540007815}

	condition:
		filesize >= 15KB and filesize <= 90KB and 1 of ( $s* ) and 3 of ( $pattern* )
}