/*
   HybridPetya : regles de detection.
   Construites par analyse statique de 8 echantillons MalwareBazaar (tag
   HybridPetya) et des composants extraits (DLL, bootkits EFI, chargeur MBR).
   Testees sur les echantillons, les artefacts extraits, le chargeur NotPetya
   (perfc.dat) et un corpus negatif d'autres familles.
*/

rule HybridPetya_Installer_AES_Bootstrap
{
    meta:
        description = "Installeur HybridPetya : amorce aes_setkey_dec(256) + aes_crypt_cbc en place sur la DLL embarquee"
        reference_sha256 = "c75a0c76dd7cd7f364421b9b13bd2d7c4a0778bfc2a4e85e54283d75e91ae65c"
    strings:
        // lea eax,[ebp-0xf8] ; push eax ; push 0x100 ; push KEY ; call setkey ;
        // push 0 ; push IV ; lea ecx,[ebp-0xf8] ; push ecx ; push SIZE ; push BLOB ; push BLOB ; call cbc
        $boot = { 8D 85 08 FF FF FF 50 68 00 01 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ??
                  6A 00 68 ?? ?? ?? ?? 8D 8D 08 FF FF FF 51 68 ?? ?? ?? ?? 68 ?? ?? ?? ??
                  68 ?? ?? ?? ?? E8 }
    condition:
        uint16(0) == 0x5A4D and filesize < 2MB and $boot
}

rule HybridPetya_Payload_DLL
{
    meta:
        description = "DLL HybridPetya (chargement reflexif) : blocs XORes par 0x6b81 % (i+1), chiffrement de fichiers, installation MBR/UEFI"
        reference_sha256 = "234f3932f33b025fc0cb4e409bed2fe8fcbf8a20f8f0c5e4bb4d057bf6d71788"
    strings:
        // mov eax,0x6b81 ; lea edi,[...] ; cdq ; idiv edi ; inc ecx ; xor byte [ecx+BLOB-1],dl
        $xor = { B8 81 6B 00 00 8D BC ?? ?? ?? ?? ?? 99 F7 FF 41 30 91 ?? ?? ?? ?? 81 F9 }
        $note = "YOUR_FILES_ARE_ENCRYPTED.TXT" ascii
        $gr = "\\\\?\\GLOBALROOT\\Device\\Harddisk%d\\Partition%d" ascii
        $efi = "\\EFI\\Microsoft\\Boot\\bootmgfw.efi.old" ascii
        $rl = "_ReflectiveLoader@4" ascii
        $hard = "NtRaiseHardError" ascii
        $sec = ".xxxx" ascii
    condition:
        uint16(0) == 0x5A4D and $xor and 3 of ($note, $gr, $efi, $rl, $hard, $sec)
}

rule HybridPetya_UEFI_Bootkit
{
    meta:
        description = "Bootkit UEFI HybridPetya (EFI/Diskcoder.A) : chiffrement Salsa20 du $MFT, faux CHKDSK"
        reference_sha256 = "97bc6da2c387b4b0d6f1f08f4eeeec65359bb66cb23c15e805f68c89493bf1d4"
    strings:
        $p1 = "\\EFI\\Microsoft\\Boot\\counter" wide
        $p2 = "\\EFI\\Microsoft\\Boot\\verify" wide
        $p3 = "\\EFI\\Microsoft\\Boot\\config" wide
        $p4 = "\\EFI\\Microsoft\\Boot\\bootmgfw.efi.old" wide
        $s1 = "CHKDSK is repairing sector" wide
        $s2 = "Decrypting sector" wide
        $s3 = "personal installation key" wide
        $udk = "udk2015\\MdePkg" ascii nocase
    condition:
        uint16(0) == 0x5A4D and filesize < 200KB and
        uint16(uint32(0x3C) + 0x5C) == 10 and
        3 of ($p*) and 1 of ($s*) and $udk
}

rule HybridPetya_Legacy_Loader16
{
    meta:
        description = "Chargeur MBR 16 bits d'HybridPetya (NotPetya patche : constante Salsa20 standard, LFSR 0x9e) dans des secteurs bruts"
        reference_sha256 = "6d5fa71014200cb55be3cdfd7f8670f308cabd7d578e698216997393b4a37c61"
    strings:
        // construction de "expand 32-byte k" octet par octet sur la pile
        $k = { C6 46 EF 78 C6 46 F0 70 C6 46 F1 61 C6 46 F2 6E C6 46 F3 64 }
        // mov byte [bp-5],0x9e : constante LFSR de l'eponge (0xa3 chez NotPetya)
        $lfsr = { C6 46 FB 9E 8A 46 FB 30 06 B2 A2 }
        $mail = "wowsmith123457@proton.me" ascii
        $chk = "CHKDSK is repairing sector" ascii
    condition:
        uint16(0) != 0x5A4D and $k and ($lfsr or $mail) and $chk
}

rule HybridPetya_ESP_Config
{
    meta:
        description = "Fichier \\EFI\\Microsoft\\Boot\\config ou secteur 0x20 (MBR) d'HybridPetya : statut, cle, nonce, portefeuille a 0x29"
    strings:
        $btc = "34UNkKSGZZvf5AYbjkUa2yYYzw89ZLWxu2" ascii
    condition:
        filesize <= 0x400 and uint8(0) <= 2 and $btc at 0x29
}

rule Vulnerable_Howyar_Reloader_CVE_2024_7344
{
    meta:
        description = "reloader.efi Howyar signe Microsoft UEFI CA 2011, charge cloak.dat sans verification (CVE-2024-7344, revoque par DBX le 2024-11-01) ; deploye comme bootmgfw.efi par la variante HybridPetya qui contourne Secure Boot"
        authenticode_sha256 = "cdb7c90d3ab8833d5324f5d8516d41fa990b9ca721fe643fffaef9057d9f9e48"
    strings:
        $c1 = "\\EFI\\Microsoft\\boot\\cloak.dat" wide
        $c2 = "\\EFI\\boot\\cloak64.dat" wide
    condition:
        uint16(0) == 0x5A4D and uint16(uint32(0x3C) + 0x5C) == 10 and all of ($c*)
}