DITEKSHEN_MALWARE_Win_Deathransom

rule DITEKSHEN_MALWARE_Win_Deathransom : FILE
{
	meta:
		description = "Detects known DeathRansom ransomware"
		author = "ditekSHen"
		id = "a6eeb607-8b5c-5982-8b5a-aa2b3c6a65e6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L5908-L5925"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "3c87364a7ecc403262056eeccaa16bf230fbbe684e21d35099d0d572abba9eda"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "%s %f %c" fullword ascii
		$pdb1 = ":\\wud.pdb" ascii
		$spdb2 = "\\crypt_server\\runtime\\crypt" ascii
		$spdb3 = "\\bin\\nuvin.pdb" ascii
		$h1 = "#Dunubeyokunov" wide
		$h2 = "^Neyot dehipijakeyelih" wide
		$h3 = "talin%Sanovurenofibiw" wide
		$h4 = "WriteFile" fullword ascii
		$h5 = "ClearEventLogA" fullword ascii
		$h6 = "Mozilla/5.0 (Windows NT 6.0; rv:34.0) Gecko/20100101 Firefox/34.0" ascii wide

	condition:
		uint16( 0 ) == 0x5a4d and ( all of ( $pdb* ) or ( all of ( $s* ) and 1 of ( $pdb* ) ) or 5 of ( $h* ) )
}