2019-11-11-crime_doppelpaymer_ransomware_1.vk.yar

import "pe"

rule crime_win32_doppelpaymer_ransomware_1 {
   meta:
      description = "Detects DoppelPaymer payload Nov 11 Signed"
      author = "@VK_Intel"
      reference = "https://twitter.com/VK_Intel/status/1193937831766429696"
      date = "2019-11-11"
      hash1 = "46254a390027a1708f6951f8af3da13d033dee9a71a4ee75f257087218676dd5"
   strings:
       $s1 = "Setup run" fullword wide
       $hash_function = { ?? ?? 8b fa 8b ?? 8b cf e8 ?? ?? ?? ?? 85 c0 75 ?? 81 ?? }
   condition:
      ( uint16(0) == 0x5a4d and
         filesize < 2500KB and
         ( all of them )
      )
}