Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

YARA Rule: DarkSide_BM.yar

Group: Blackmatter
Valid Rule 
rule DarkSide_BM
{
	meta:
		author = "rivitna"
		family = "ransomware.darkside_blackmatter"
		description = "DarkSide/BlackMatter ransomware Windows payload"
		severity = 10
		score = 100

	strings:
		$h1 = { 64 A1 30 00 00 00     // mov  eax, large fs:30h
                8B B0 A4 00 00 00     // mov  esi, [eax+0A4h]
                8B B8 A8 00 00 00     // mov  edi, [eax+0A8h]
                83 FE 05              // cmp  esi, 5
                75 05                 // jnz  short L1
                83 FF 01 }

	condition:
		(( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) ) and ( ( 1 of ( $h* ) ) )
}