id: locky-malware

info:
  name: Locky Malware - Detect
  author: daffainfo
  severity: info
  reference:
    - https://github.com/Yara-Rules/rules/blob/master/malware/RANSOM_Locky.yar
  tags: malware,file
file:
  - extensions:
      - all

    matchers-condition: or
    matchers:
      - type: binary
        binary:
          - "45b899f7f90faf45b88945b8"
          - "2b0a0faf4df8894df8c745"
        condition: and

      - type: binary
        binary:
          - "2E006C006F0063006B00790000"
          - "005F004C006F0063006B007900"
          - "5F007200650063006F00760065"
          - "0072005F0069006E0073007400"
          - "720075006300740069006F006E"
          - "0073002E0074007800740000"
          - "536F6674776172655C4C6F636B7900"
        condition: and
# digest: 4b0a00483046022100fe6eb31acc13aaae0a23b9e7d130233445ea02b66e31671be4f1121494aaa6990221008e12ef6489ba5d926c6b9a3149acf54e5ae343369db90a3a2271545ab15052ac:922c64590222798bb761d5b6d8e72950