DITEKSHEN_MALWARE_Win_Buran

rule DITEKSHEN_MALWARE_Win_Buran : FILE
{
	meta:
		description = "Buran ransomware payload"
		author = "ditekSHen"
		id = "1433bac5-2ece-54bb-8e57-b5834fffc719"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L871-L903"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "eaf50d824dbade0ca63fafc5b4a376553039de9b51a0f6387cb28c8f91a7e0b9"
		score = 75
		quality = 73
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.Buran"

	strings:
		$v1_1 = "U?$error_info_injector@V" ascii
		$v1_2 = "Browse for Folder (FTP)" fullword ascii
		$v1_3 = "Find/Replace in Files" fullword ascii
		$v1_4 = "PAHKLM" fullword ascii
		$v1_5 = "PAHKCR" fullword ascii
		$v1_6 = "chkOpt_" ascii
		$h1 = "Search <a href=\"location\" class=\"menu\">in this folder</a>" ascii
		$h2 = "<br>to find where the text below" ascii
		$h3 = "</a> files with these extensions (separate with semi-colons)" ascii
		$h4 = "Need help with <a href=\"" ascii
		$path = "\\work\\cr\\nata\\libs\\boost_" wide
		$v2_1 = "(ShlObj" fullword ascii
		$v2_2 = "\\StreamUnit" fullword ascii
		$v2_3 = "TReadme" fullword ascii
		$v2_4 = "TDrivesAndShares" fullword ascii
		$v2_5 = "TCustomMemoryStreamD" fullword ascii
		$v2_6 = "OpenProcessToken" fullword ascii
		$v2_7 = "UrlMon" fullword ascii
		$v2_8 = "HttpSendRequestA" fullword ascii
		$v2_9 = "InternetConnectA" fullword ascii
		$v2_10 = "FindFiles" fullword ascii
		$v2_12 = "$*@@@*$@@@$" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( ( ( all of ( $v1* ) and 1 of ( $h* ) ) or ( $path and 2 of ( $v1* ) and 1 of ( $h* ) ) or 10 of them ) or all of ( $v2* ) )
}