SHA256 hashes
– 8143d7d370015ccebcdaafce3f399156ffdf045ac8bedcc67bdffb1507be0b58
– 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745
– f8dbabdfa03068130c277ce49c60e35c029ff29d9e3c74c362521f3fb02670d5
– 41cb22109da26a6ff5464d6915db81c1c60f9e0808d8dbd63df1550b86372165
– 0a3706fd283a5c87340215ce05e0bdbc958d20d9ca415f6c08ec176f824fb3c0
– eccd88bfc2be71e0ee7926fa4bed4e72a2db864328f2351d301f67bfe19e26bc
Prevention Yara Rule for the Perimeter Protection
rule NotPetya_Ransomware_Jun17 {
meta:
description = “Detects new NotPetya Ransomware variant from June 2017”
date = “2017-06-27”
hash1 = “027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745”
strings:
$x1 = “Ooops, your important files are encrypted.” fullword wide
$x2 = “process call create \”C:\\Windows\\System32\\rundll32.exe \\\”C:\\Windows\\%s\\\” #1 ” fullword wide
$x3 = “-d C:\\Windows\\System32\\rundll32.exe \”C:\\Windows\\%s\”,#1 ” fullword wide
$x4 = “Send your Bitcoin wallet ID and personal installation key to e-mail ” fullword wide
$x5 = “fsutil usn deletejournal /D %c:” fullword wide
$x6 = “wevtutil cl Setup & wevtutil cl System” ascii
$s1 = “%s /node:\”%ws\” /user:\”%ws\” /password:\”%ws\” ” fullword wide
$s4 = “\\\\.\\pipe\\%ws” fullword wide
$s5 = “schtasks %ws/Create /SC once /TN \”\” /TR \”%ws\” /ST %02d:%02d” fullword wide
$s6 = “u%s \\\\%s -accepteula -s ” fullword wide
$s7 = “dllhost.dat” fullword wide
condition:
uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 3 of them )
}
rule NotPetya_Rel_Malware {
meta:
description = “Detects NotPetya related malware – karo.exe”
hash1 = “e5c643f1d8ecc0fd739d0bbe4a1c6c7de2601d86ab0fff74fd89c40908654be5”
hash2 = “7f081859ae2b9b59f014669233473921f1cac755f6c6bbd5dcdd3fafbe710000”
hash3 = “3e896599851231d11c06ee3f5f9677436850d3e7d745530f0a46f712e37ce082”
strings:
$s1 = “PublicKeyToken=3e56350693f7355e” fullword wide
$s2 = “karo.exe” fullword wide
$s3 = “IWshShell3” fullword ascii
condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
}
rule NotPetya_Rel_Malware_3 {
meta:
description = “Detects NotPetya related malware – iosi.exe”
date = “2017-06-27”
hash1 = “2ddf8df2ee880dae54a7f52e4bf56f896bb3f873fb6b8fdb60cae4a3de16ff49”
strings:
$s1 = “PublicKeyToken=3e56350693f7355e” fullword wide
$s2 = “iosi.exe” fullword wide
$s3 = “WshExecStatus” fullword ascii
$s4 = “IsX64Process” fullword ascii
condition:
( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
CVE-2017-0147 https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-0147
Patch: MS17-010 https://technet.microsoft.com/en-us/library/security/MS17-010
………………………..XXXXXXXXXXXXXXXXXX…………………………………………………………………….
On 2017-06-27
