id: petya-malware-variant-3

info:
  name: Petya Malware (Variant 3) - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/airbnb/binaryalert/blob/master/rules/public/ransomware/windows/ransomware_windows_petya_variant_3.yara
  tags: malware,file,petya
file:
  - extensions:
      - all
    matchers:
      - type: word
        part: raw
        words:
          - "wevtutil cl Setup & wevtutil cl System"
          - "fsutil usn deletejournal /D %c:"
        condition: or

# digest: 490a0046304402200a5ce8456fd9e33848656de116ea8e935df34a4ec5bf5e18fc01dede3b0d5fd0022049187c34d01316789d0b3dca3ca9166a4543374e0243b654cee0dda079071867:922c64590222798bb761d5b6d8e72950