DITEKSHEN_MALWARE_Win_DECAF

rule DITEKSHEN_MALWARE_Win_DECAF : FILE
{
	meta:
		description = "Detects DECAF ransomware"
		author = "ditekSHen"
		id = "c6e4ce00-0be9-572d-987c-c47d699002f0"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L8248-L8268"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "5d79a4f310fb00022eb9d636f161227e84a7e15517c4d2c39acafa7d81af5c2a"
		score = 75
		quality = 75
		tags = "FILE"

	strings:
		$s1 = "main.EncWorker" fullword ascii
		$s2 = "Paths2Encrypt" fullword ascii
		$s3 = "/cmd/encryptor/main.go" ascii
		$s4 = "*win.FileUtils; .autotmp_41 *lib.Encryptor; .autotmp_" ascii
		$s5 = "\"Microsoft Window" fullword wide
		$s6 = "Legal_Policy_Statement" fullword wide
		$s7 = ").Encrypt." ascii
		$s8 = "*struct { F uintptr; pw *os.File; c *" ascii
		$s9 = ".ListFilesToEnc." ascii
		$m1 = "WINNER WINNER CHICKEN DINNER" ascii
		$m2 = "All your servers and computers are encrypted" ascii
		$m3 = "We guarantee to decrypt one image file for free." ascii
		$m4 = "We WILL NOT be able to RESTORE them." ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 4 of ( $s* ) or 3 of ( $m* ) or ( 1 of ( $m* ) and 2 of ( $s* ) ) )
}