/*
   NightSpire ransomware, deux lignees de code independantes identifiees
   (voir writeup.md). Les DEUX sont vulnerables a la reutilisation de
   keystream AES-256-CTR entre chunks d'un meme fichier (writeup.md §3, §5) :
   ces regles servent a IDENTIFIER la lignee (utile pour choisir l'outil de
   recuperation adapte), pas a distinguer vulnerable/corrige.

     - NightSpire_EncrypterV2_lineage : lignee "Encrypter v2.1" (dev "Senko"),
       fonctions EncryptFilev1/EncryptFilev2.

     - NightSpire_ImmoRan_lineage : lignee "ImmoRan" (dev "Administrator"),
       fonctions startEncrypting/EncryptFile/getEncryptionType.

   Necessitent la pclntab Go (quasi toujours presente meme sur un binaire
   "strippe" au sens debug DWARF/PDB) pour matcher les noms de fonctions
   complets `main.Xxx`, presents en clair dans le binaire.

   Validees sur les 7 echantillons de ce dossier (2 lignee Encrypter v2.1,
   5 lignee ImmoRan), pas testees sur un corpus NightSpire plus large.

   Auteur : Gordon PEIRS (@ozer0x777)
   TLP:CLEAR
*/

rule NightSpire_EncrypterV2_lineage
{
    meta:
        description = "NightSpire ransomware, lignee 'Encrypter v2.1' : VULNERABLE a la reutilisation de keystream AES-CTR entre chunks (main.EncryptFilev2)"
        author      = "Gordon PEIRS (@ozer0x777)"
        date        = "2026-08-03"
        malware     = "NightSpire"
        family      = "Ransomware (Go)"
        recoverable = "partiel, voir remediation.md"
        tlp         = "CLEAR"

    strings:
        $fn1 = "main.EncryptFilev1" ascii
        $fn2 = "main.EncryptFilev2" ascii
        $fn3 = "main.generateSalt" ascii
        $fn4 = "main.DecorateSalt" ascii
        $contact = "nightspireteam.receiver@onionmail.org" ascii

        $mz = "MZ"

    condition:
        $mz at 0 and filesize < 10MB and (2 of ($fn*) or $contact)
}

rule NightSpire_ImmoRan_lineage
{
    meta:
        description = "NightSpire ransomware, lignee 'ImmoRan' : VULNERABLE a la reutilisation de keystream AES-CTR entre chunks (main.startEncrypting/EncryptFile)"
        author      = "Gordon PEIRS (@ozer0x777)"
        date        = "2026-08-03"
        malware     = "NightSpire"
        family      = "Ransomware (Go)"
        recoverable = "partiel, voir remediation.md"
        tlp         = "CLEAR"

    strings:
        $fn1 = "main.startEncrypting" ascii
        $fn2 = "main.EncryptFile" ascii
        $fn3 = "main.getEncryptionType" ascii
        $fn4 = "main.generateSalt" ascii
        $path = "ImmoRan" ascii
        $contact = "nightspireteam.receiver@onionmail.org" ascii

        $mz = "MZ"

    condition:
        $mz at 0 and filesize < 10MB and (2 of ($fn*) or $path or $contact)
}