TRELLIX_ARC_Bitpaymer_Ransomware

YARA detection rule by Marc Rivero | McAfee ATR Team · GPL-2.0

Rule to detect BitPaymer Ransomware

rule TRELLIX_ARC_Bitpaymer_Ransomware: RANSOMWARE FILE {
  meta:
    description    = "Rule to detect BitPaymer Ransomware"
    author         = "Marc Rivero | McAfee ATR Team"
    id             = "20b91cf2-2a84-55d9-8230-90d7b20a461f"
    date           = "2019-11-08"
    modified       = "2020-08-14"
    reference      = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/spanish-mssp-targeted-by-bitpaymer-ransomware/"
    source_url     = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/RANSOM_Bitpaymer.yar#L1-L72"
    license_url    = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
    logic_hash     = "527cdbdf51e6f3f5d58e805cf4a1bc09c9d24880c2323046acef6ee03c92d62f"
    score          = 75
    quality        = 66
    tags           = "RANSOMWARE, FILE"
    rule_version   = "v1"
    malware_type   = "ransomware"
    malware_family = "Ransom:W32/BitPaymer"
    actor_type     = "Cybercrime"
    actor_group    = "Unknown"

  strings:
    $s1     = "IEncrypt.dll" fullword wide
    $op0    = { e8 5f f3 ff ff ff b6 e0 }
    $op1    = { e8 ad e3 ff ff 59 59 8b 75 08 8d 34 f5 38 eb 42 }
    $op2    = { e9 45 ff ff ff 33 ff 8b 75 0c 6a 04 e8 c1 d1 ff }
    $pdb    = "S:\\Work\\_bin\\Release-Win32\\wp_encrypt.pdb" fullword ascii
    $oj0    = { 39 74 24 34 75 53 8d 4c 24 18 e8 b8 d1 ff ff ba }
    $oj1    = { 5f 8b c6 5e c2 08 00 56 8b f1 8d 4e 34 e8 91 af }
    $oj2    = { 8b cb 8d bd 50 ff ff ff 8b c1 89 5f 04 99 83 c1 }
    $t1     = ".C:\\aaa_TouchMeNot_.txt" fullword wide
    $ok0    = { e8 b5 34 00 00 ff 74 24 18 8d 4c 24 54 e8 80 39 }
    $ok1    = { 8b 5d 04 33 ff 8b 44 24 34 89 44 24 5c 85 db 7e }
    $ok2    = { 55 55 ff 74 24 20 8d 4c 24 34 e8 31 bf 00 00 55 }
    $random = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+" fullword ascii
    $oi0    = { a1 04 30 ac 00 8b ce 0f af c2 03 c0 99 8b e8 89 }
    $oi1    = { e8 64 a2 ff ff 85 c0 74 0c 8d 4d d8 51 ff 35 64 }
    $oi2    = { c7 03 d4 21 ac 00 e8 86 53 00 00 89 73 10 89 7b }
    $ou0    = { e8 64 a2 ff ff 85 c0 74 0c 8d 4d d8 51 ff 35 60 }
    $ou1    = { a1 04 30 04 00 8b ce 0f af c2 03 c0 99 8b e8 89 }
    $ou2    = { 8d 4c 24 10 e8 a0 da ff ff 68 d0 21 04 00 8d 4c }
    $oa1    = { 56 52 ba 00 10 0c 00 8b f1 e8 28 63 00 00 8b c6 }
    $oa2    = { 81 3d 50 30 0c 00 53 c6 d2 43 56 8b f1 75 23 ba }
    $oy0    = { c7 06 cc 21 a6 00 c7 46 08 }
    $oy1    = { c7 06 cc 21 a6 00 c7 46 08 }
    $oy2    = { c7 06 cc 21 a6 00 c7 46 08 }
    $oh1    = { e8 74 37 00 00 a3 00 30 fe 00 8d 4c 24 1c 8d 84 }
    $oh2    = { 56 52 ba 00 10 fe 00 8b f1 e8 28 63 00 00 8b c6 }

  condition:
    (uint16(0) == 0x5a4d and filesize < 1000KB) and ($s1 and all of ($op*)) or ($pdb and all of ($oj*)) or ($t1 and all of ($ok*)) or ($random and all of ($oi*)) or ($random and all of ($ou*)) or ($random and all of ($oa*) and $ou0) or ($random and all of ($oy*)) or ($random and all of ($oh*)) or ($random and $ou0) or ($random and $oi1)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

6ce523e6-0b0d-4bb6-834e-5e3416fe56be

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion