DITEKSHEN_MALWARE_Win_Fonix

rule DITEKSHEN_MALWARE_Win_Fonix : FILE
{
	meta:
		description = "Detects Fonix ransomware"
		author = "ditekSHen"
		id = "d67cce49-5f4f-59f6-b2a9-9c4dd1c6c0f6"
		date = "2020-11-06"
		modified = "2024-11-01"
		reference = "https://github.com/ditekshen/detection"
		source_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/yara/malware.yar#L3459-L3481"
		license_url = "https://github.com/ditekshen/detection/blob/e76c93dcdedff04076380ffc60ea54e45b313635/LICENSE.txt"
		logic_hash = "159b8946f7772c76271de821eb12897689bf73d96fc6a1d7c4a65cdc50b877c7"
		score = 75
		quality = 75
		tags = "FILE"
		clamav_sig = "MALWARE.Win.Ransomware.Fonix"

	strings:
		$s1 = "dontcryptanyway" fullword wide
		$s2 = "Cpriv.key" ascii wide
		$s3 = "Cpub.key" ascii wide
		$s4 = "NetShareEnum() failed!Error: % ld" fullword wide
		$s5 = "<div class='title'> Attention!</div><ul><li><u><b>DO NOT</b> pay" wide
		$s6 = "Encryption Completed !!!" fullword wide
		$s7 = "kill process" fullword ascii
		$s8 = "Copy SystemID C:\\ProgramData\\SystemID" ascii
		$id1 = "].FONIX" fullword wide
		$id2 = "xinofconfig.txt" fullword ascii wide
		$id3 = "XINOF4MUTEX" wide
		$id4 = ":\\Fonix\\cryptoPP\\" ascii
		$id5 = "schtasks /CREATE /SC ONLOGON /TN fonix" ascii
		$id6 = "Ransomware\\Fonix" ascii

	condition:
		uint16( 0 ) == 0x5a4d and ( 6 of ( $s* ) or 3 of ( $id* ) or ( 1 of ( $id* ) and 3 of ( $s* ) ) )
}