rule BlackCat3
{
	meta:
		author = "rivitna"
		family = "ransomware.blackcat3"
		description = "BlackCat v3 ransomware Windows/Linux payload"
		severity = 10
		score = 100

	strings:
		$x0 = { 6A 01 68 80 3F 00 00 E8 [4] [4-32] 68 80 3F 00 00 68 [4]
                 5? E8 }
		$y0 = { 8D ( 4D ?? | 4C 24 ?? | 8D ?? FF FF FF) BA [4]
                68 1A 0C 06 00 E8 }
		$y1 = { 8D ( 4D | 4C 24 | 8C 24 [2] ?? ) ?? BA [4] 6A 7B E8 }
		$y2 = { 68 1A 0C 06 00 68 [4] 50 E8 }
		$y3 = { 6A 7B 68 [4] 50 E8 }
		$m0 = { 0F B6 02 0F B6 F3 42 66 0F A4 D8 08 66 33 84 36 [4] 49
                 89 C3 75 E7 }
		$m1 = { 0F B6 C1 C1 E9 08 0F B7 84 00 [4] 31 C1 C1 E8 08 0F B6 C9
                 66 33 84 09 }
		$m2 = { 0F B6 44 3E 01 66 0F A4 C8 08 48 83 C7 02 66 43 33 04 51
                 48 39 F? }
		$m3 = { 0F B7 04 4E 31 C2 0F B6 CA C1 E8 08 66 33 04 4E }
		$m4 = { 8A ?C 0? 08 [0-8] 80 F? FF 0F 84 [2] 00 00 [8-40]
                 ( 0F B6 ?? [0-8] F7 64 ?? FC | F7 64 ?? FC [0-8] 0F B6 ?? )
                 [0-8] 01 C? }
		$m5 = { 8A 54 03 10 80 FA FF 0F 84 [20-68] 8B 7C B0 FC 49 0F AF FF
                 44 0F B6 F2 49 01 FE }
		$n0 = { 6A 00 6A 07 5? E8 [4] 83 C4 0? B8 00 00 00 02
                23 84 24 ?? ?? 00 00 89 C1 C1 E9 19 85 C0 }
		$n1 = { BE 07 00 00 00 31 D2 FF 15 [4] B8 00 00 00 02
                23 84 24 ?? ?? 00 00 89 C1 C1 E9 19 [0-12] 85 C0 }
		$e0 = { 66 0F 7F 89 80 00 00 00 66 0F 38 DB 92 90 00 00 00
                0F 28 8A A0 00 00 00 66 0F 7F 91 90 00 00 00
                0F 29 89 A0 00 00 00 5D }
		$e1 = { 66 0F 70 84 24 ?? ?? 00 00 FF 66 0F 6F 5C 24 ?? 66 0F 6F CB
                66 0F 73 F9 04 66 0F EF CB 66 0F 6F D3 66 0F 73 FA 08
                66 0F 73 FB 0C 66 0F EF DA 66 0F EF D9 66 0F EF D8 }
		$e2 = { 66 0F 6F 5C 24 ?? 66 0F 70 84 24 ?? ?? 00 00 FF [0-16]
                66 0F 6F CB 66 0F 6F D3 66 0F 6F E3 66 0F 73 F9 04
                66 0F 73 FA 08 66 0F 73 FC 0C 66 0F EF D1 66 0F EF E2
                66 0F EF E0 66 0F EF E3 }
		$c0 = { 66 0F 6F C8 66 0F 72 F0 08 [0-4] 66 0F 72 D1 18 [0-24]
                66 0F EB C1 }
		$c1 = { 66 0F 72
                ( F? 07 [0-12] 66 0F 72 D? 19 |
                  D? 19 [0-12] 66 0F 72 F? 07 )
                [0-24] 66 0F EB ?? }

	condition:
		(( ( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) ) or ( uint32( 0 ) == 0x464C457F ) ) and ( ( $x0 and ( 1 of ( $y* ) ) ) or ( 2 of ( $m* ) ) or ( ( 1 of ( $n* ) ) and ( 1 of ( $e* ) ) and ( 1 of ( $c* ) ) ) )
}