EternalPetya (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.eternal_petya (Back to overview)

EternalPetya

aka: ExPetr, Pnyetya, Petna, NotPetya, Nyetya, NonPetya, nPetya, Diskcoder.C, BadRabbit

Actor(s): TeleBots, Sandworm

VTCollection

According to proofpoint, Bad Rabbit is a strain of ransomware that first appeared in 2017 and is a suspected variant of Petya. Like other strains of ransomware, Bad Rabbit virus infections lock up victims’ computers, servers, or files preventing them from regaining access until a ransom—usually in Bitcoin—is paid.

References

2024-04-16 ⋅ Mandiant ⋅ Alden Wahlstrom, Anton Prokopenkov, Dan Black, Dan Perez, Gabby Roncone, John Wolfram, Lexie Aytes, Nick Simonian, Ryan Hall, Tyler McLellan
APT44: Unearthing Sandworm
VPNFilter BlackEnergy CaddyWiper EternalPetya HermeticWiper Industroyer INDUSTROYER2 Olympic Destroyer PartyTicket RoarBAT Sandworm

2023-01-29 ⋅ Acronis ⋅ Ilan Duhin
Petya/Not Petya Ransomware Analysis
EternalPetya

2022-11-18 ⋅ Atlantic Council ⋅ Justin Sherman
GRU 26165: The Russian cyber unit that hacks targets on-site
EternalPetya

2022-10-31 ⋅ The Record ⋅ Alexander Martin
Mondelez and Zurich reach settlement in NotPetya cyberattack insurance suit
EternalPetya

2022-10-24 ⋅ Youtube (Virus Bulletin) ⋅ Alexander Adamov
Russian wipers in the cyberwar against Ukraine
AcidRain CaddyWiper DesertBlade DoubleZero EternalPetya HermeticWiper HermeticWizard INDUSTROYER2 IsaacWiper KillDisk PartyTicket WhisperGate

2022-04-28 ⋅ Fortinet ⋅ Gergely Revay
An Overview of the Increasing Wiper Malware Threat
AcidRain CaddyWiper DistTrack DoubleZero EternalPetya HermeticWiper IsaacWiper Olympic Destroyer Ordinypt WhisperGate ZeroCleare

2022-04-20 ⋅ CISA ⋅ CISA
Alert (AA22-110A): Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader Killnet

2022-04-20 ⋅ CISA ⋅ Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), CISA, FBI, Government Communications Security Bureau, National Crime Agency (NCA), NCSC UK, NSA
AA22-110A Joint CSA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader

2022-03-01 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
DiskKill/HermeticWiper and NotPetya (Dis)similarities
EternalPetya HermeticWiper

2022-02-25 ⋅ CyberPeace Institute
UKRAINE: Timeline of Cyberattacks
VPNFilter EternalPetya HermeticWiper WhisperGate

2022-02-24 ⋅ Talos ⋅ Mitch Neff
Threat Advisory: Current executive guidance for ongoing cyberattacks in Ukraine
VPNFilter EternalPetya

2022-02-24 ⋅ Tesorion ⋅ TESORION
Report OSINT: Russia/ Ukraine Conflict Cyberaspect
Mirai VPNFilter BlackEnergy EternalPetya HermeticWiper Industroyer WhisperGate

2022-02-24 ⋅ nviso ⋅ Michel Coene
Threat Update – Ukraine & Russia conflict
EternalPetya GreyEnergy HermeticWiper Industroyer KillDisk WhisperGate

2022-02-23 ⋅ ISTARI ⋅ Manuel Hepfer
Re-cap: The Untold Story of NotPetya, The Most Devastating Cyberattack in History
EternalPetya

2021-09-09 ⋅ Recorded Future ⋅ Insikt Group
Dark Covenant: Connections Between the Russian State and Criminal Actors
BlackEnergy EternalPetya Gameover P2P Zeus

2021-05-31 ⋅ Wired ⋅ Andy Greenberg
Hacker Lexicon: What Is a Supply Chain Attack?
EternalPetya SUNBURST

2021-04-29 ⋅ The Institute for Security and Technology ⋅ The Institute for Security and Technology
Combating Ransomware A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force
Conti EternalPetya

2020-12-21 ⋅ IronNet ⋅ Adam Hlavek, Kimberly Ortiz
Russian cyber attack campaigns and actors
WellMail elf.wellmess Agent.BTZ BlackEnergy EternalPetya Havex RAT Industroyer Ryuk Triton WellMess

2020-11-04 ⋅ Stranded on Pylos Blog ⋅ Joe Slowik
The Enigmatic Energetic Bear
EternalPetya Havex RAT

2020-10-19 ⋅ UK Government ⋅ Dominic Raab, ForeignCommonwealth & Development Office
UK exposes series of Russian cyber attacks against Olympic and Paralympic Games
VPNFilter BlackEnergy EternalPetya Industroyer

2020-10-19 ⋅ Riskint Blog ⋅ Curtis
Revisited: Fancy Bear's New Faces...and Sandworms' too
BlackEnergy EternalPetya Industroyer Olympic Destroyer

2020-10-19 ⋅ CyberScoop ⋅ Tim Starks
US charges Russian GRU officers for NotPetya, other major hacks
EternalPetya

2020-10-19 ⋅ Wired ⋅ Andy Greenberg
US Indicts Sandworm, Russia's Most Destructive Cyberwar Unit
EternalPetya Olympic Destroyer

2020-08-29 ⋅ Aguinet ⋅ Adrien Guinet
Emulating NotPetya bootloader with Miasm
EternalPetya

2020-07-29 ⋅ Kaspersky Labs ⋅ GReAT
APT trends report Q2 2020
PhantomLance Dacls Penquin Turla elf.wellmess AppleJeus Dacls AcidBox Cobalt Strike Dacls EternalPetya Godlike12 Olympic Destroyer PlugX shadowhammer ShadowPad Sinowal VHD Ransomware Volgmer WellMess X-Agent XTunnel

2020-07-29 ⋅ Atlantic Council ⋅ June Lee, Stewart Scott, Trey Herr, William Loomis
BREAKING TRUST: Shades of Crisis Across an Insecure Software Supply Chain
EternalPetya GoldenSpy Kwampirs Stuxnet

2020-06-21 ⋅ GVNSHTN ⋅ Gavin Ashton
Maersk, me & notPetya
EternalPetya

2020-06-09 ⋅ Kaspersky Labs ⋅ Costin Raiu
Looking at Big Threats Using Code Similarity. Part 1
Penquin Turla CCleaner Backdoor EternalPetya Regin WannaCryptor XTunnel

2020-03-05 ⋅ Microsoft ⋅ Microsoft Threat Protection Intelligence Team
Human-operated ransomware attacks: A preventable disaster
Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor PARINACOTA

2020-01-01 ⋅ Secureworks ⋅ SecureWorks
IRON VIKING
BlackEnergy EternalPetya GreyEnergy Industroyer KillDisk TeleBot TeleDoor

2019-08-01 ⋅ Kaspersky Labs ⋅ GReAT
APT trends report Q2 2019
ZooPark magecart POWERSTATS Chaperone COMpfun EternalPetya FinFisher RAT HawkEye Keylogger HOPLIGHT Microcin NjRAT Olympic Destroyer PLEAD RokRAT Triton Zebrocy

2018-10-11 ⋅ ESET Research ⋅ Anton Cherepanov, Robert Lipovsky
New TeleBots backdoor: First evidence linking Industroyer to NotPetya
Exaramel EternalPetya Exaramel Industroyer

2018-08-22 ⋅ Wired ⋅ Andy Greenberg
The Untold Story of NotPetya, the Most Devastating Cyberattack in History
EternalPetya

2018-01-13 ⋅ The Washington Post ⋅ Ellen Nakashima
Russian military was behind ‘NotPetya’ cyberattack in Ukraine, CIA concludes
EternalPetya

2017-10-27 ⋅ F-Secure ⋅ F-Secure Global
The big difference with Bad Rabbit
EternalPetya

2017-10-26 ⋅ Reversing Labs ⋅ None
ReversingLabs' YARA rule detects BadRabbit encryption routine specifics
EternalPetya

2017-10-26 ⋅ FireEye ⋅ Barry Vengerik, Ben Read, Brian Mordosky, Christopher Glyer, Ian Ahl, Matt Williams, Michael Matonis, Nick Carr
BACKSWING - Pulling a BADRABBIT Out of a Hat
EternalPetya

2017-10-25 ⋅ RiskIQ ⋅ Yonathan Klijnsma
Down the Rabbit Hole: Tracking the BadRabbit Ransomware to a Long Ongoing Campaign of Target Selection
EternalPetya

2017-10-24 ⋅ Kaspersky Labs ⋅ Anton Ivanov, Fedor Sinitsyn, Orkhan Mamedov
Bad Rabbit ransomware
EternalPetya

2017-10-24 ⋅ Cisco Talos ⋅ Nick Biasini
Threat Spotlight: Follow the Bad Rabbit
EternalPetya

2017-10-24 ⋅ ESET Research ⋅ Editor
Kiev metro hit with a new variant of the infamous Diskcoder ransomware
EternalPetya

2017-10-24 ⋅ Wired ⋅ Andy Greenberg
New Ransomware Linked to NotPetya Sweeps Russia and Ukraine
EternalPetya

2017-10-24 ⋅ Intezer ⋅ Jay Rosenberg
NotPetya Returns as Bad Rabbit
EternalPetya

2017-10-24 ⋅ ESET Research ⋅ Marc-Etienne M.Léveillé
Bad Rabbit: Not‑Petya is back with improved ransomware
EternalPetya

2017-09-19 ⋅ NCC Group ⋅ Ollie Whitehouse
EternalGlue part one: Rebuilding NotPetya to assess real-world resilience
EternalPetya

2017-08-24 ⋅ ESET Research ⋅ Marc-Etienne M.Léveillé
Bad Rabbit: Not‑Petya is back with improved ransomware
EternalPetya Sandworm

2017-08-11 ⋅ Threatpost ⋅ Tom Spring
Ukrainian Man Arrested, Charged in NotPetya Distribution
EternalPetya

2017-07-14 ⋅ Malwarebytes ⋅ Malwarebytes Labs
Keeping up with the Petyas: Demystifying the malware family
EternalPetya GoldenEye PetrWrap Petya

2017-07-04 ⋅ Kaspersky ⋅ Anton Ivanov, Orkhan Mamedov
In ExPetr/Petya’s shadow, FakeCry ransomware wave hits Ukraine
EternalPetya FakeCry

2017-07-03 ⋅ CrowdStrike ⋅ Karan Sood, Shaun Hurley
NotPetya Technical Analysis Part II: Further Findings and Potential for MBR Recovery
EternalPetya

2017-07-03 ⋅ G Data ⋅ G Data
Who is behind Petna?
EternalPetya

2017-07-03 ⋅ The Guardian ⋅ Alex Hern
'NotPetya' malware attacks could warrant retaliation, says Nato affiliated-researcher
EternalPetya

2017-06-30 ⋅ Kaspersky Labs ⋅ GReAT
From BlackEnergy to ExPetr
EternalPetya

2017-06-30 ⋅ Malwarebytes ⋅ Malwarebytes Labs
EternalPetya – yet another stolen piece in the package?
EternalPetya

2017-06-30 ⋅ ESET Research ⋅ Anton Cherepanov
TeleBots are back: Supply‑chain attacks against Ukraine
EternalPetya

2017-06-29 ⋅ Bleeping Computer ⋅ Catalin Cimpanu
Ransomware Attacks Continue in Ukraine with Mysterious WannaCry Clone
EternalPetya

2017-06-29 ⋅ Malwarebytes ⋅ Malwarebytes Labs
EternalPetya and the lost Salsa20 key
EternalPetya

2017-06-29 ⋅ Microsoft ⋅ Microsoft Defender ATP Research Team
Windows 10 platform resilience against the Petya ransomware attack
EternalPetya

2017-06-29 ⋅ Robert Graham
NonPetya: no evidence it was a "smokescreen"
EternalPetya

2017-06-28 ⋅ CrowdStrike ⋅ Falcon Intelligence Team
CrowdStrike Protects Against NotPetya Attack
EternalPetya

2017-06-28 ⋅ hacks4pancakes
Why NotPetya Kept Me Awake (& You Should Worry Too)
EternalPetya

2017-06-28 ⋅ Kaspersky Labs ⋅ Anton Ivanov, Orkhan Mamedov
ExPetr/Petya/NotPetya is a Wiper, Not Ransomware
EternalPetya

2017-06-27 ⋅ Kaspersky Labs ⋅ GReAT
Schroedinger’s Pet(ya)
EternalPetya

2017-06-27 ⋅ ESET Research ⋅ Editor
New WannaCryptor‑like ransomware attack hits globally: All you need to know
EternalPetya Sandworm

2017-06-27 ⋅ Medium thegrugq ⋅ thegrugq
Pnyetya: Yet Another Ransomware Outbreak
EternalPetya

2017-06-27 ⋅ SANS ⋅ Brad Duncan
Checking out the new Petya variant
EternalPetya

2017-05-31 ⋅ MITRE ⋅ MITRE ATT&CK
Sandworm Team
CyclopsBlink Exaramel BlackEnergy EternalPetya Exaramel GreyEnergy KillDisk MimiKatz Olympic Destroyer Sandworm

Yara Rules

[TLP:WHITE] win_eternal_petya_auto (20241030 | Detects win.eternal_petya.)

rule win_eternal_petya_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.eternal_petya."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 53 6a21 8d460c 50 }
            // n = 4, score = 400
            //   53                   | push                ebx
            //   6a21                 | push                0x21
            //   8d460c               | lea                 eax, [esi + 0xc]
            //   50                   | push                eax

        $sequence_1 = { 55 8bec 51 57 68000000f0 6a18 33ff }
            // n = 7, score = 400
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   51                   | push                ecx
            //   57                   | push                edi
            //   68000000f0           | push                0xf0000000
            //   6a18                 | push                0x18
            //   33ff                 | xor                 edi, edi

        $sequence_2 = { 53 68f0000000 6a40 ff15???????? 8bd8 }
            // n = 5, score = 400
            //   53                   | push                ebx
            //   68f0000000           | push                0xf0
            //   6a40                 | push                0x40
            //   ff15????????         |                     
            //   8bd8                 | mov                 ebx, eax

        $sequence_3 = { 53 8d4644 50 53 }
            // n = 4, score = 400
            //   53                   | push                ebx
            //   8d4644               | lea                 eax, [esi + 0x44]
            //   50                   | push                eax
            //   53                   | push                ebx

        $sequence_4 = { 49 75f7 8b7508 895de4 }
            // n = 4, score = 300
            //   49                   | dec                 ecx
            //   75f7                 | jne                 0xfffffff9
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   895de4               | mov                 dword ptr [ebp - 0x1c], ebx

        $sequence_5 = { 49 75f9 6800400000 56 }
            // n = 4, score = 300
            //   49                   | dec                 ecx
            //   75f9                 | jne                 0xfffffffb
            //   6800400000           | push                0x4000
            //   56                   | push                esi

        $sequence_6 = { 0f86eef9ffff 6afe 58 5f }
            // n = 4, score = 300
            //   0f86eef9ffff         | jbe                 0xfffff9f4
            //   6afe                 | push                -2
            //   58                   | pop                 eax
            //   5f                   | pop                 edi

        $sequence_7 = { 49 75f2 8b4364 034360 8b4b68 894dd4 3bc8 }
            // n = 7, score = 300
            //   49                   | dec                 ecx
            //   75f2                 | jne                 0xfffffff4
            //   8b4364               | mov                 eax, dword ptr [ebx + 0x64]
            //   034360               | add                 eax, dword ptr [ebx + 0x60]
            //   8b4b68               | mov                 ecx, dword ptr [ebx + 0x68]
            //   894dd4               | mov                 dword ptr [ebp - 0x2c], ecx
            //   3bc8                 | cmp                 ecx, eax

        $sequence_8 = { 55 8bec e8???????? 8b4d08 85c9 }
            // n = 5, score = 300
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   e8????????           |                     
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   85c9                 | test                ecx, ecx

        $sequence_9 = { 03c8 8bc2 c1e818 03c8 33c0 }
            // n = 5, score = 300
            //   03c8                 | add                 ecx, eax
            //   8bc2                 | mov                 eax, edx
            //   c1e818               | shr                 eax, 0x18
            //   03c8                 | add                 ecx, eax
            //   33c0                 | xor                 eax, eax

        $sequence_10 = { 03c8 ff442418 ff442410 89940ca0020000 }
            // n = 4, score = 300
            //   03c8                 | add                 ecx, eax
            //   ff442418             | inc                 dword ptr [esp + 0x18]
            //   ff442410             | inc                 dword ptr [esp + 0x10]
            //   89940ca0020000       | mov                 dword ptr [esp + ecx + 0x2a0], edx

        $sequence_11 = { 33db 53 ffd7 50 ff15???????? 5f 8bc3 }
            // n = 7, score = 300
            //   33db                 | xor                 ebx, ebx
            //   53                   | push                ebx
            //   ffd7                 | call                edi
            //   50                   | push                eax
            //   ff15????????         |                     
            //   5f                   | pop                 edi
            //   8bc3                 | mov                 eax, ebx

        $sequence_12 = { ffd7 a3???????? ffd6 50 6a00 68???????? 6a02 }
            // n = 7, score = 200
            //   ffd7                 | call                edi
            //   a3????????           |                     
            //   ffd6                 | call                esi
            //   50                   | push                eax
            //   6a00                 | push                0
            //   68????????           |                     
            //   6a02                 | push                2

        $sequence_13 = { 8bc6 5e 5b c21000 b8???????? a3???????? }
            // n = 6, score = 200
            //   8bc6                 | mov                 eax, esi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   c21000               | ret                 0x10
            //   b8????????           |                     
            //   a3????????           |                     

        $sequence_14 = { 8bc6 90 0fb708 66890c03 }
            // n = 4, score = 200
            //   8bc6                 | mov                 eax, esi
            //   90                   | nop                 
            //   0fb708               | movzx               ecx, word ptr [eax]
            //   66890c03             | mov                 word ptr [ebx + eax], cx

        $sequence_15 = { 8bc6 c1f805 57 83e61f 8d3c8500cc4400 }
            // n = 5, score = 200
            //   8bc6                 | mov                 eax, esi
            //   c1f805               | sar                 eax, 5
            //   57                   | push                edi
            //   83e61f               | and                 esi, 0x1f
            //   8d3c8500cc4400       | lea                 edi, [eax*4 + 0x44cc00]

    condition:
        7 of them and filesize < 851968
}

[TLP:WHITE] win_eternal_petya_w0 (20171222 | No description)

rule win_eternal_petya_w0 {

    meta:
        author = "ReversingLabs"
        date = "2017-11-29"
        source = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-badrabbit-encryption-routine-specifics.html"
        info = "ReversingLabs' YARA rule detects BadRabbit encryption routine specifics."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
        malpedia_version = "20171222"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    
    strings:
        $encrypt_file = { 55 8B EC 83 EC ?? 53 56 57 8B 7D ?? 8B 4F ?? 33 DB 8D 45 ?? 50 53 53 51 89 5D ?? 89  5D ?? 89 5D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 55 ?? 53 53 6A ?? 53 53  68 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D  4D ?? 51 57 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 39 5D ?? 0F 84 ??  ?? ?? ?? 39 5D ?? 0F 84 ?? ?? ?? ?? 8D 55 ?? 52 56 FF 15 ?? ?? ?? ?? 8B 4F ?? 8B 45  ?? 83 C1 ?? 2B C1 19 5D ?? 89 45 ?? 89 5D ?? 78 ?? 7F ?? 3D ?? ?? ?? ?? 76 ?? B8 ??  ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? 53 50 53 6A ?? 53 8B F8 56 89 45 ?? 89 7D ?? FF  15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8B 55 ?? 52 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ??  8B F8 85 FF 74 ?? 8B 4D ?? 8B 55 ?? 8D 45 ?? 50 57 6A ?? 51 6A ?? 52 FF 15 ?? ?? ??  ?? 85 C0 74 ?? 8B 45 ?? 50 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 68 ?? ?? ?? ?? E8 ?? ??  ?? ?? 83 C4 ?? 57 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? 3B C7 73  ?? 2B F8 EB ?? 33 FF 8B 55 ?? 8B 42 ?? 8D 4C 38 ?? 6A ?? 51 E8 ?? ?? ?? ?? 8B 7D ??  83 C4 ?? 33 DB 56 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 39 5D ?? 74 ?? 39  5D ?? 75 ?? 8B 47 ?? 8B 35 ?? ?? ?? ?? 50 FF D6 8B 7F ?? 3B FB 74 ?? 57 FF D6 5F 5E  5B 8B E5 5D C3 }

        $main_encrypt = { 55 8B EC 56 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 75 ?? 89 46 ?? 85 C0 0F 84  ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 7E ?? 57 FF  D3 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? 6A ?? 6A ?? 6A ?? 57 FF  D3 85 C0 74 ?? 8B 07 8D 5E ?? 53 50 8B 46 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B  C6 E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 4E ?? 6A ?? 51 E8 ??  ?? ?? ?? 8B 56 ?? 83 C4 ?? 52 FF 15 ?? ?? ?? ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 0B  51 FF 15 ?? ?? ?? ?? 8B 17 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ??  5F 5B B9 ?? ?? ?? ?? 8D 46 ?? 8B FF C6 00 ?? 40 49 75 ?? 56 FF 15 ?? ?? ?? ?? 33 C0  5E 5D C2 ?? ?? }

        $encryption_loop = { 8B 7C 24 ?? 6A ?? 6A ?? 8D 43 ?? 50 33 C0 39 43 ?? 0F 95 C0 40 50 FF 15 ?? ?? ?? ??  85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B9 ??  ?? ?? ?? 8D 44 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ??  75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ??  ?? ?? B9 ?? ?? ?? ?? 8D 44 24 ?? 8D 64 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ??  66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83  D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51 57 8D 94 24 ?? ?? ?? ?? 52 FF 15 ?? ??  ?? ?? 85 C0 74 ?? 8B 44 24 ?? A8 ?? 74 ?? A9 ?? ?? ?? ?? 75 ?? 8D BC 24 ?? ?? ?? ??  E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 45 ?? 53 48 50 8B CF 51 E8 ?? ?? ?? ?? 83 C4 ?? EB ??  8D 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 8D 71 ?? 90 66 8B 11 83 C1 ?? 66 85 D2  75 ?? 2B CE D1 F9 8D 4C 4C ?? 3B C1 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D  94 24 ?? ?? ?? ?? 53 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 74 24 ?? 8D 44 24 ?? 50 56 FF 15  ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??}

    condition:
        $encrypt_file and $main_encrypt and $encryption_loop 
}

Download all Yara Rules

EternalPetya Propose Change

References

Yara Rules

EternalPetya