Permalink
Switch branches/tags
Nothing to show
Find file Copy path
Fetching contributors…
Cannot retrieve contributors at this time
14 lines (14 sloc) 446 Bytes
rule Gandcrab
{
meta:
author = "kevoreilly"
description = "Gandcrab Payload"
cape_type = "Gandcrab Payload"
strings:
$string1 = "GDCB-DECRYPT.txt" wide
$string2 = "GandCrabGandCrabnomoreransom.coinomoreransom.bit"
$string3 = "action=result&e_files=%d&e_size=%I64u&e_time=%d&" wide
$string4 = "KRAB-DECRYPT.txt" wide
condition:
uint16(0) == 0x5A4D and any of ($string*)
}