id: petya-malware-variant-3

info:
  name: Petya Malware (Variant 3) - Detect
  author: daffainfo
  severity: info
  reference:
    - https://github.com/airbnb/binaryalert/blob/master/rules/public/ransomware/windows/ransomware_windows_petya_variant_3.yara
  tags: malware,file,petya
file:
  - extensions:
      - all
    matchers:
      - type: word
        part: raw
        words:
          - "wevtutil cl Setup & wevtutil cl System"
          - "fsutil usn deletejournal /D %c:"
        condition: or
# digest: 4a0a00473045022100ea0317d510dbb2a03eea6540013955128d2b05a497d7d4f150bb3dd734daa8f3022019340c31893555d35c35ec61d1ef13da8d074c0b561ee8c9a1121aa628935a7b:922c64590222798bb761d5b6d8e72950