rule SunCrypt
{
	meta:
		author = "rivitna"
		family = "ransomware.suncrypt.windows"
		description = "SunCrypt ransomware Windows payload"
		severity = 10
		score = 100

	strings:
		$h0 = { B0 00 02 00 C7 00 A3 00 00 00 [8-16] 83 C? 20 }
		$h1 = { C7 00 A3 00 00 00 [8-16]
                ( 81 C7 B0 00 02 00 83 C? 20 | 83 C? 20 81 C7 B0 00 02 00) }
		$s1 = "-noshares\x00" wide
		$s2 = "\x00-nomutex\x00" wide
		$s3 = "\x00-noreport\x00" wide
		$s4 = "\x00-noservices\x00" wide
		$s5 = "\x00-justcrypt\x00" wide
		$s6 = "\x00-keep_exe\x00" wide
		$s7 = "\x00$Recycle.bin\x00" wide
		$s8 = "%s\\efi\\microsoft\\boot\\bootmgr.efi\x00" wide
		$s9 = "YOUR_FILES_ARE_ENCRYPTED.HTML\x00" wide
		$s10 = "\x0D... %d ...\x00" ascii
		$a1 = "<a href=\"http://" ascii xor(0x11-0x22)
		$a2 = ".onion/chat.html?" ascii xor(0x11-0x22)
		$a3 = "<h2>Why pay us?</h2>" ascii xor(0x11-0x22)
		$a4 = "background-color: #1a1a1a;" ascii xor(0x11-0x22)
		$a5 = "rem !important;" ascii xor(0x11-0x22)
		$a6 = "TOR browser" ascii xor(0x11-0x22)
		$a7 = "torproject.org" ascii xor(0x11-0x22)

	condition:
		(( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) ) and ( ( 1 of ( $h* ) ) or ( 5 of ( $s* ) ) or ( 4 of ( $a* ) ) )
}