{"id":3053,"date":"2024-09-25T21:11:36","date_gmt":"2024-09-25T21:11:36","guid":{"rendered":"https:\/\/xdr-mdr.lmntrix.com\/main_web\/?p=3053"},"modified":"2025-07-29T07:00:49","modified_gmt":"2025-07-29T07:00:49","slug":"petya-petwrap-ransomware-with-logical-kill-switch-threat-intel-update-2","status":"publish","type":"post","link":"https:\/\/lmntrix.com\/blog\/petya-petwrap-ransomware-with-logical-kill-switch-threat-intel-update-2\/","title":{"rendered":"Threat Intel Update"},"content":{"rendered":"
\n
\"\"<\/figure>\n<\/div>\n\n\n

SHA256 hashes

– 8143d7d370015ccebcdaafce3f399156ffdf045ac8bedcc67bdffb1507be0b58

– 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745 

– f8dbabdfa03068130c277ce49c60e35c029ff29d9e3c74c362521f3fb02670d5

– 41cb22109da26a6ff5464d6915db81c1c60f9e0808d8dbd63df1550b86372165

– 0a3706fd283a5c87340215ce05e0bdbc958d20d9ca415f6c08ec176f824fb3c0

– eccd88bfc2be71e0ee7926fa4bed4e72a2db864328f2351d301f67bfe19e26bc
<\/p>\n\n\n\n

Prevention Yara Rule for the Perimeter Protection<\/strong>

rule NotPetya_Ransomware_Jun17 {

   meta:

      description = “Detects new NotPetya Ransomware variant from June 2017”

      date = “2017-06-27”

      hash1 = “027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745”

   strings:

      $x1 = “Ooops, your important files are encrypted.” fullword wide

      $x2 = “process call create \\”C:\\\\Windows\\\\System32\\\\rundll32.exe \\\\\\”C:\\\\Windows\\\\%s\\\\\\” #1 ” fullword wide

      $x3 = “-d C:\\\\Windows\\\\System32\\\\rundll32.exe \\”C:\\\\Windows\\\\%s\\”,#1 ” fullword wide

      $x4 = “Send your Bitcoin wallet ID and personal installation key to e-mail ” fullword wide

      $x5 = “fsutil usn deletejournal \/D %c:” fullword wide

      $x6 = “wevtutil cl Setup & wevtutil cl System” ascii
<\/p>\n\n\n\n

      $s1 = “%s \/node:\\”%ws\\” \/user:\\”%ws\\” \/password:\\”%ws\\” ” fullword wide

      $s4 = “\\\\\\\\.\\\\pipe\\\\%ws” fullword wide

      $s5 = “schtasks %ws\/Create \/SC once \/TN \\”\\” \/TR \\”%ws\\” \/ST %02d:%02d” fullword wide

      $s6 = “u%s \\\\\\\\%s -accepteula -s ” fullword wide

      $s7 = “dllhost.dat” fullword wide

   condition:

      uint16(0) == 0x5a4d and filesize < 1000KB and ( 1 of ($x*) or 3 of them )

}
<\/p>\n\n\n\n

rule NotPetya_Rel_Malware {

   meta:

      description = “Detects NotPetya related malware – karo.exe”

      hash1 = “e5c643f1d8ecc0fd739d0bbe4a1c6c7de2601d86ab0fff74fd89c40908654be5”

      hash2 = “7f081859ae2b9b59f014669233473921f1cac755f6c6bbd5dcdd3fafbe710000”

      hash3 = “3e896599851231d11c06ee3f5f9677436850d3e7d745530f0a46f712e37ce082”

   strings:

      $s1 = “PublicKeyToken=3e56350693f7355e” fullword wide

      $s2 = “karo.exe” fullword wide

      $s3 = “IWshShell3” fullword ascii

   condition:

      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )

}
<\/p>\n\n\n\n

rule NotPetya_Rel_Malware_3 {

   meta:

      description = “Detects NotPetya related malware – iosi.exe”

      date = “2017-06-27”

      hash1 = “2ddf8df2ee880dae54a7f52e4bf56f896bb3f873fb6b8fdb60cae4a3de16ff49”

   strings:

      $s1 = “PublicKeyToken=3e56350693f7355e” fullword wide

      $s2 = “iosi.exe” fullword wide

      $s3 = “WshExecStatus” fullword ascii

      $s4 = “IsX64Process” fullword ascii

   condition:

      ( uint16(0) == 0x5a4d and filesize < 2000KB and all of them )
<\/p>\n\n\n\n



CVE-2017-0147 https:\/\/portal.msrc.microsoft.com\/en-us\/security-guidance\/advisory\/CVE-2017-0147
<\/p>\n\n\n\n

Patch: MS17-010 https:\/\/technet.microsoft.com\/en-us\/library\/security\/MS17-010
<\/p>\n\n\n\n

\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026..XXXXXXXXXXXXXXXXXX\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026\u2026.

 <\/p>\n\n\n\n

On 2017-06-27<\/p>\n","protected":false},"excerpt":{"rendered":"

SHA256 hashes – 8143d7d370015ccebcdaafce3f399156ffdf045ac8bedcc67bdffb1507be0b58 – 027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745  – f8dbabdfa03068130c277ce49c60e35c029ff29d9e3c74c362521f3fb02670d5 – 41cb22109da26a6ff5464d6915db81c1c60f9e0808d8dbd63df1550b86372165 – 0a3706fd283a5c87340215ce05e0bdbc958d20d9ca415f6c08ec176f824fb3c0 – eccd88bfc2be71e0ee7926fa4bed4e72a2db864328f2351d301f67bfe19e26bc Prevention Yara Rule for the Perimeter Protection rule NotPetya_Ransomware_Jun17 {    meta:       description = “Detects new NotPetya Ransomware variant from June 2017”       date = “2017-06-27”       hash1 = “027cc450ef5f8c5f653329641ec1fed91f694e0d229928963b30f6b0d7d3a745”    strings:     […]<\/p>\n","protected":false},"author":1,"featured_media":3054,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[21],"tags":[],"class_list":["post-3053","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-labs"],"_links":{"self":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/3053","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/comments?post=3053"}],"version-history":[{"count":6,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/3053\/revisions"}],"predecessor-version":[{"id":4357,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/posts\/3053\/revisions\/4357"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media\/3054"}],"wp:attachment":[{"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/media?parent=3053"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/categories?post=3053"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/lmntrix.com\/blog\/wp-json\/wp\/v2\/tags?post=3053"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}