rule Conti
{
	meta:
		author = "rivitna"
		family = "ransomware.conti.windows"
		description = "Conti 2 and 3 ransomware Windows payload"
		severity = 10
		score = 100

	strings:
		$h0 = { 85 ?? 0F 84 ?? 0? 00 00 ( 0F B6 00 | 8A 0? ) 3C E9 74 1?
                3C FF 0F 85 ?? 0? 00 00 80 7? 01 25 0F 85 }
		$h1 = { 45 33 C9 C7 44 24 ?? 0C 02 00 00 [0-4] 33 D2 48 89 [8-12]
                45 8D 41 01 FF D0 85 C0 }
		$h2 = { 83 C4 08 8D 4D ?? 68 0C 02 00 00 5? 5? 6A 00 6A 01 6A 00
                FF 75 ?? FF D0 }
		$h3 = { ( 2D 5B 00 00 | DA FC 01 B8 ) ( 41 83 | 83 ) F? 04 7C ??
                [12-24] 69 0? 95 E9 D1 5B ( 48 83 | 83 ) C2 04
                ( 45 69 | 69 ) ?? 95 E9 D1 5B }
		$h4 = { 41 B0 14 B2 25 [0-4] E8 [2] FF FF 85 C0 }

	condition:
		(( uint16( 0 ) == 0x5A4D ) and ( uint32( uint32( 0x3C ) ) == 0x00004550 ) ) and ( ( 2 of ( $h* ) ) )
}