id: wannacry-malware

info:
  name: WannaCry Malware - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/airbnb/binaryalert/blob/master/rules/public/ransomware/windows/ransomware_windows_wannacry.yara
  tags: malware,file,wannacry
file:
  - extensions:
      - all

    matchers-condition: or
    matchers:
      - type: word
        part: raw
        words:
          - "msg/m_chinese"
          - ".wnry"
          - "attrib +h"
        condition: and

      - type: word
        part: raw
        words:
          - "WNcry@2ol7"
          - "iuqerfsodp9ifjaposdfjhgosurijfaewrwergwea.com"
          - "115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn"
          - "12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw"
          - "13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94"
        condition: or
# digest: 490a004630440220246916ddde45effbdb94feb2bb83d5e4f58d185981dab8cbe866c79d0c3cb89502200b745f85a84aac6253ea06c79e13af52ae24f4a6d9537d20ce440c67e711003a:922c64590222798bb761d5b6d8e72950