2019-11-07-bitpaymer-ransomware-everis-vk.yar

import "pe"

rule crime_win32_bitpaymer_ransomware_1 {
   meta:
      description = "Detects BitPaymer ransomware payload"
      author = "@VK_Intel"
      reference = "https://twitter.com/VK_Intel/status/1192690031019937792"
      date = "2019-11-08"
      hash1 = "78e180e5765aa7f4b89d6bcd9bcef1dd1e0d0261ad0f9c3ec6ab0635bf494eb3"
   strings:
      $s1 = "@C:\\aaa_TouchMeNot_.txt" fullword wide
      $hash_function = { ?? ?? 8b fa 8b ?? 8b cf e8 ?? ?? ?? ?? 85 c0 75 ?? 81 ?? }
   condition:
      ( uint16(0) == 0x5a4d and
         filesize < 200KB and
         pe.imphash() == "f4ae67c9e8bc20f92225adc1c52e833b" and
         ( all of them )
       )
}