id: satana-malware

info:
  name: Satana Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/Yara-Rules/rules/blob/master/malware/RANSOM_.CRYPTXXX.yar
  tags: malware,file
file:
  - extensions:
      - all

    matchers-condition: and
    matchers:
      - type: binary
        binary:
          - "210073006100740061006E00610021002E0074007800740000"
          - "456E756D4C6F63616C526573"
          - "574E65744F70656E456E756D5700"
          - "21534154414E4121"
        condition: and

      - type: binary
        binary:
          - "7467777975677771"
          - "537776776E6775"
        condition: or
# digest: 4a0a004730450221009d64e502d46881ec094126fea1df2a545ad39ce5145f34cabe7ea5a8f813f6f5022015b48c3ef731eb84e20a5da4ece4f8fe1d43ed74b80f99848c3166b0d27eb7bb:922c64590222798bb761d5b6d8e72950