id: wannacry-malware

info:
  name: WannaCry Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/airbnb/binaryalert/blob/master/rules/public/ransomware/windows/ransomware_windows_wannacry.yara
  tags: malware,file,wannacry
file:
  - extensions:
      - all

    matchers-condition: or
    matchers:
      - type: word
        part: raw
        words:
          - "msg/m_chinese"
          - ".wnry"
          - "attrib +h"
        condition: and

      - type: word
        part: raw
        words:
          - "WNcry@2ol7"
          - "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
          - "115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn"
          - "12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw"
          - "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94"
        condition: or

# digest: 490a00463044022075f35e75c9f2832f30654ca6b3c0a8ba30466e117d4c4b8f42baa4b0a9ae5a3202203804e16360e6ec92468528804f0e3e34058c9df44c1c1ecc8269b7cfcc84dbc2:922c64590222798bb761d5b6d8e72950