id: wannacry-malware

info:
  name: WannaCry Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/airbnb/binaryalert/blob/master/rules/public/ransomware/windows/ransomware_windows_wannacry.yara
  tags: malware,file,wannacry

file:
  - extensions:
      - all

    matchers-condition: or
    matchers:
      - type: word
        part: raw
        words:
          - "msg/m_chinese"
          - ".wnry"
          - "attrib +h"
        condition: and

      - type: word
        part: raw
        words:
          - "WNcry@2ol7"
          - "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
          - "115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn"
          - "12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw"
          - "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94"
        condition: or