/*
REvil / Sodinokibi ransomware
*/

rule REvil_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.revil"
        description = "Detects REvil / Sodinokibi ransom note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "-readme.txt" ascii nocase
        $s2 = "sodinokibi" ascii nocase
        $s3 = "Your files are encrypted" ascii nocase
        $s4 = "decryptor" ascii nocase

    condition:
        2 of ($s1, $s2) or ($s3 and $s4)
}

rule REvil_PE_Config
{
    meta:
        author = "ransomware.live"
        family = "ransomware.revil"
        description = "Detects REvil embedded JSON config keys"
        date = "2026-05-04"
        severity = 9
        score = 90

    strings:
        $c1 = "\"pk\":" ascii
        $c2 = "\"pid\":" ascii
        $c3 = "\"sub\":" ascii
        $c4 = "\"dbg\":" ascii
        $c5 = "\"wipe\":" ascii

    condition:
        uint16(0) == 0x5A4D and 4 of them
}

rule REvil_PE_Strings
{
    meta:
        author = "ransomware.live"
        family = "ransomware.revil"
        description = "Detects REvil ransomware strings in PE"
        date = "2026-05-04"
        severity = 9
        score = 90

    strings:
        $s1 = "expand 32-byte k" ascii
        $s2 = "SOFTWARE\\BlackLivesMatter" ascii wide
        $s3 = "readme.txt" ascii nocase
        $s4 = "sodinokibi" ascii nocase

    condition:
        uint16(0) == 0x5A4D and 2 of them
}