rule win_darkbit_w1 {
    meta:
        author = "albertzsigovits"
        reference = "https://twitter.com/vxunderground/status/1624814604936249345"
        date = "2023-02-13"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkbit"
        malpedia_version = "20230216"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
        malpedia_rule_date = "20230215"
        malpedia_hash = ""
        malpedia_license = ""
    strings:
        $note1 = "But, you can contact us via TOX messenger if you want to recover your files personally." ascii wide
        $note2 = "All your files are encrypted using AES-256 military grade algorithm." ascii wide
        $note3 = "They should pay for firing high-skilled experts." ascii wide
        $tor = "iw6v2p3cruy7tqfup3yl4dgt4pfibfa3ai4zgnu5df2q3hus3lm7c7ad.onion" ascii wide
    condition:
        2 of ($note*) or $tor
}