id: wannacry-malware

info:
  name: WannaCry Malware - Detect
  author: daffainfo
  severity: info
  reference:
    - https://github.com/airbnb/binaryalert/blob/master/rules/public/ransomware/windows/ransomware_windows_wannacry.yara
  tags: malware,file,wannacry
file:
  - extensions:
      - all

    matchers-condition: or
    matchers:
      - type: word
        part: raw
        words:
          - "msg/m_chinese"
          - ".wnry"
          - "attrib +h"
        condition: and

      - type: word
        part: raw
        words:
          - "WNcry@2ol7"
          - "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
          - "115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn"
          - "12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw"
          - "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94"
        condition: or
# digest: 490a00463044022079e52322bd7c219be3978b5fc0be94cb0336eeeddb0872d846b167324d0047e8022075c1dacfe4074c2c9fc52d1fbe0c1ecf0ae20f1fb1aeb7a6f9c8726f93fc9bfc:922c64590222798bb761d5b6d8e72950