SIGNATURE_BASE_MAL_WIN_Ralordv1_Apr25

rule SIGNATURE_BASE_MAL_WIN_Ralordv1_Apr25 : FILE
{
	meta:
		description = "This ISH Tecnologia Yara rule, detects the main components of the first version of RALord Ransomware"
		author = "0x0d4y-Icaro Cesar"
		id = "67254633-3597-4770-9806-8b2e26c8f66a"
		date = "2025-04-01"
		modified = "2026-05-15"
		reference = "https://ish.com.br/wp-content/uploads/2025/04/RALord-Novo-grupo-de-Ransomware-as-a-Service-1.pdf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_ralordv1_win_ap25.yar#L1-L29"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "be15f62d14d1cbe2aecce8396f4c6289"
		logic_hash = "75d20cca5eb48109bbb3b0ab0ce2efb4f2d89bc1984df8c4fddf1f859d069750"
		score = 80
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"
		malpedia_family = "win.ralord"

	strings:
		$code_pattern_quarterround = { 4? 31 ?? 48 8b ?? ?? ?? 4? 31 ?? 48 8b ?? ?? ?? 31 e8 4? 31 ?? 41 c1 ?? 0c c1 ?? 0c c1 ?? 0c 48 89 c2 c1 ?? 0c }
		$code_pattern_custom_alg = { 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 10 ?? c5 ?? ?? ?? ?? 0f 57 ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 0f 11 ?? c5 ?? ?? ?? ?? 48 83 c0 08 48 3d 8? }
		$ralord_str_I = "chacha" ascii
		$ralord_str_II = "scorp" ascii
		$ralord_str_III = "RALord" ascii
		$ralord_str_IV = "onion" ascii
		$ralord_str_V = "/rust" ascii
		$ralord_str_VI = "BCryptGenRandom" ascii

	condition:
		uint16( 0 ) == 0x5a4d and all of ( $code_pattern_* ) and 4 of ( $ralord_str_* )
}