id: locky-malware

info:
  name: Locky Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/RANSOM_Locky.yar
  tags: malware,file
file:
  - extensions:
      - all

    matchers-condition: or
    matchers:
      - type: binary
        binary:
          - "45b899f7f90faf45b88945b8"
          - "2b0a0faf4df8894df8c745"
        condition: and

      - type: binary
        binary:
          - "2E006C006F0063006B00790000"
          - "005F004C006F0063006B007900"
          - "5F007200650063006F00760065"
          - "0072005F0069006E0073007400"
          - "720075006300740069006F006E"
          - "0073002E0074007800740000"
          - "536F6674776172655C4C6F636B7900"
        condition: and
# digest: 490a0046304402207f23b6a775483a0166ba6b4f346028f19d692ca4799099422bd421eb002923fc02205c992574a8c647c5cf5d828ccda16f8d0217fe39beb67189b8d23d76d71c6ad1:922c64590222798bb761d5b6d8e72950