rule win_darkbit_w3 {
    meta:
        author = "albertzsigovits"
        date = "2023-02-16"
        filetype = "pe"
        threat = "Ransomware.DarkBit.Windows"
	    sha256 = "9107be160f7b639d68fe3670de58ed254d81de6aec9a41ad58d91aa814a247ff"
	    malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.darkbit"
	    malpedia_version = "20230216"
	    malpedia_license = "CC BY-NC-SA 4.0"
	    malpedia_sharing = "TLP:WHITE"
        malpedia_rule_date = "20230215"
        malpedia_hash = ""
        malpedia_license = ""
    strings:
        $gob1 = {
                    45 88 47 ??                // mov byte [r15 + 1], r8b
                    90                        // nop
                    4C 8B 84 24 ?? ?? 00 00 // mov r8, qword [rsp + 0x88]
                    49 C1 E8 ??                // shr r8, 4
                    49 83 C7 ??                // add r15, 2
                    48 8B 44 24 ??            // mov rax, qword [rsp + 0x78]
                    4C 8B 8C 24 ?? ?? 00 00    // mov r9, qword [rsp + 0xb0]
                    48 89 D0                // mov rax, rdx
                    48 8B 94 24 ?? ?? 00 00    // mov rdx, qword [rsp + 0xc0]
                    4C 89 84 24 ?? ?? 00 00    // mov qword [rsp + 0x88], r8
                    41 ?? ?? ??                // and r8d, 0xf
                    49 
        }

        $gob2 = { 
                    48 89 84 24 ?? ?? 00 00    // mov qword ptr ss:[rsp+D0],rax
                    48 89 5C 24 ??            // mov qword ptr ss:[rsp+60],rbx
                    31 C0                    // xor eax,eax
                    48 8D 5C 24 ??            // lea rbx,qword ptr ss:[rsp+44]
                    B9 ?? 00 00 00            // mov ecx,6
        }
        
        $wyhash = {
                    4D 8B 88 ?? ?? 00 00            // mov r9, qword [r8 + 0xf0]
                    49 BA 2F 64 BD 78 64 1D 76 A0    // movabs r10, 0xa0761d6478bd642f
                    4D 01 D1                        // add r9, r10
                    49 BB DB 28 B4 A0 D1 7E 03 E7    // movabs r11, 0xe7037ed1a0b428db
                    4D 31 CB                        // xor r11, r9
        }

        $vss1 = {
                    48 8B 94 24 ?? ?? 00 00        // mov rdx,qword ptr ss:[rsp+C8] [rsp+C8]:"delete"
                    48 89 94 24 ?? ?? 00 00        // mov qword ptr ss:[rsp+138],rdx [rsp+138]:"delete"
                    48 8B 54 24 ??                // mov rdx,qword ptr ss:[rsp+58]
                    48 89 94 24 ?? ?? 00 00        // mov qword ptr ss:[rsp+140],rdx
                    48 8B 94 24 ?? ?? 00 00        // mov rdx,qword ptr ss:[rsp+F0] [rsp+F0]:"shadows"
                    48 89 94 24 ?? ?? 00 00        // mov qword ptr ss:[rsp+148],rdx [rsp+148]:"shadows"
                    48 8B 94 24 ?? ?? 00 00        // mov rdx,qword ptr ss:[rsp+80]
                    48 89 94 24 ?? ?? 00 00        // mov qword ptr ss:[rsp+150],rdx
                    48 8B 94 24 ?? ?? 00 00        // mov rdx,qword ptr ss:[rsp+C0] [rsp+C0]:"/all"
                    48 89 94 24 ?? ?? 00 00        // mov qword ptr ss:[rsp+158],rdx [rsp+158]:"/all"
                    48 8B 54 24 ??                // mov rdx,qword ptr ss:[rsp+50]
                    48 89 94 24 ?? ?? 00 00        // mov qword ptr ss:[rsp+160],rdx
                    48 89 84 24 ?? ?? 00 00        // mov qword ptr ss:[rsp+168],rax [rsp+168]:"/Quiet"
                    48 89 9C 24 ?? ?? 00 00        // mov qword ptr ss:[rsp+170],rbx
                    48 8B 84 24 ?? ?? 00 00        // mov rax,qword ptr ss:[rsp+D0] [rsp+D0]:"vssadmin.exe"
                    48 8B 5C 24 ??                // mov rbx,qword ptr ss:[rsp+60]
                    48 8D 8C 24 ?? ?? 00 00        // lea rcx,qword ptr ss:[rsp+138] [rsp+138]:"delete"
        }

        $vss2 = {
                    48 BA CB BB 16 11 B4 B1 42 AD    // mov rdx,AD42B1B41116BBCB
                    48 89 94 24 ?? ?? 00 00         // mov qword ptr ss:[rsp+B1],rdx
                    48 BA AD 6D A1 5B 11 15 7B 7B    // mov rdx,7B7B15115BA16DAD
                    48 89 94 24 ?? ?? 00 00            // mov qword ptr ss:[rsp+B8],rdx
                    48 BA 9D C8 65 70 D0 DC 2B C3    // mov rdx,C32BDCD07065C89D
                    48 89 94 24 ?? ?? 00 00            // mov qword ptr ss:[rsp+A2],rdx
                    48 BA C3 4D C5 3E 7D 70 0F 1E    // mov rdx,1E0F707D3EC54DC3
                    48 89 94 24 ?? ?? 00 00            // mov qword ptr ss:[rsp+A9],rdx
        }

    condition:
        uint16(0) == 0x5A4D
        and uint32(uint32(0x3C)) == 0x00004550
        and 3 of them
}