EternalPetya (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.eternal_petya (Back to overview)

EternalPetya

aka: ExPetr, Pnyetya, Petna, NotPetya, Nyetya, NonPetya, nPetya, Diskcoder.C, BadRabbit

Actor(s): TeleBots, Sandworm

There is no description at this point.

References

2022-04-28 ⋅ Fortinet ⋅ Gergely Revay
An Overview of the Increasing Wiper Malware Threat
AcidRain CaddyWiper DistTrack DoubleZero EternalPetya HermeticWiper IsaacWiper Olympic Destroyer Ordinypt WhisperGate ZeroCleare

2022-04-20 ⋅ CISA ⋅ CISA
Alert (AA22-110A): Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader Killnet

2022-04-20 ⋅ CISA ⋅ CISA, NSA, FBI, Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), Government Communications Security Bureau, NCSC UK, National Crime Agency (NCA)
AA22-110A Joint CSA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader

2022-03-01 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
DiskKill/HermeticWiper and NotPetya (Dis)similarities
EternalPetya HermeticWiper

2022-02-25 ⋅ CyberPeace Institute
UKRAINE: Timeline of Cyberattacks
VPNFilter EternalPetya HermeticWiper WhisperGate

2022-02-24 ⋅ Talos ⋅ Mitch Neff
Threat Advisory: Current executive guidance for ongoing cyberattacks in Ukraine
VPNFilter EternalPetya

2022-02-24 ⋅ Tesorion ⋅ TESORION
Report OSINT: Russia/ Ukraine Conflict Cyberaspect
Mirai VPNFilter BlackEnergy EternalPetya HermeticWiper Industroyer WhisperGate

2022-02-24 ⋅ nviso ⋅ Michel Coene
Threat Update – Ukraine & Russia conflict
EternalPetya GreyEnergy HermeticWiper Industroyer KillDisk WhisperGate

2022-02-23 ⋅ ISTARI ⋅ Manuel Hepfer
Re-cap: The Untold Story of NotPetya, The Most Devastating Cyberattack in History
EternalPetya

2021-09-09 ⋅ Recorded Future ⋅ Insikt Group
Dark Covenant: Connections Between the Russian State and Criminal Actors
BlackEnergy EternalPetya Gameover P2P Zeus

2021-04-29 ⋅ The Institute for Security and Technology ⋅ The Institute for Security and Technology
Combating Ransomware A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force
Conti EternalPetya

2020-12-21 ⋅ IronNet ⋅ Adam Hlavek, Kimberly Ortiz
Russian cyber attack campaigns and actors
WellMail elf.wellmess Agent.BTZ BlackEnergy EternalPetya Havex RAT Industroyer Ryuk Triton WellMess

2020-11-04 ⋅ Stranded on Pylos Blog ⋅ Joe Slowik
The Enigmatic Energetic Bear
EternalPetya Havex RAT

2020-10-19 ⋅ CyberScoop ⋅ Tim Starks
US charges Russian GRU officers for NotPetya, other major hacks
EternalPetya

2020-10-19 ⋅ UK Government ⋅ ForeignCommonwealth & Development Office, Dominic Raab
UK exposes series of Russian cyber attacks against Olympic and Paralympic Games
VPNFilter BlackEnergy EternalPetya Industroyer

2020-10-19 ⋅ Wired ⋅ Andy Greenberg
US Indicts Sandworm, Russia's Most Destructive Cyberwar Unit
EternalPetya Olympic Destroyer

2020-10-19 ⋅ Riskint Blog ⋅ Curtis
Revisited: Fancy Bear's New Faces...and Sandworms' too
BlackEnergy EternalPetya Industroyer Olympic Destroyer

2020-08-29 ⋅ Aguinet ⋅ Adrien Guinet
Emulating NotPetya bootloader with Miasm
EternalPetya

2020-07-29 ⋅ Kaspersky Labs ⋅ GReAT
APT trends report Q2 2020
PhantomLance Dacls Penquin Turla elf.wellmess AppleJeus Dacls AcidBox Cobalt Strike Dacls EternalPetya Godlike12 Olympic Destroyer PlugX shadowhammer ShadowPad Sinowal VHD Ransomware Volgmer WellMess X-Agent XTunnel

2020-07-29 ⋅ Atlantic Council ⋅ Trey Herr, June Lee, William Loomis, Stewart Scott
BREAKING TRUST: Shades of Crisis Across an Insecure Software Supply Chain
EternalPetya GoldenSpy Kwampirs Stuxnet

2020-06-21 ⋅ GVNSHTN ⋅ Gavin Ashton
Maersk, me & notPetya
EternalPetya

2020-06-09 ⋅ Kaspersky Labs ⋅ Costin Raiu
Looking at Big Threats Using Code Similarity. Part 1
Penquin Turla CCleaner Backdoor EternalPetya Regin WannaCryptor XTunnel

2020-05-31 ⋅ Wired ⋅ Andy Greenberg
Hacker Lexicon: What Is a Supply Chain Attack?
EternalPetya SUNBURST

2020-03-05 ⋅ Microsoft ⋅ Microsoft Threat Protection Intelligence Team
Human-operated ransomware attacks: A preventable disaster
Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor

2020 ⋅ Secureworks ⋅ SecureWorks
IRON VIKING
BlackEnergy EternalPetya GreyEnergy Industroyer KillDisk TeleBot TeleDoor

2019-08-01 ⋅ Kaspersky Labs ⋅ GReAT
APT trends report Q2 2019
ZooPark magecart POWERSTATS Chaperone COMpfun EternalPetya FinFisher RAT HawkEye Keylogger HOPLIGHT Microcin NjRAT Olympic Destroyer PLEAD RokRAT Triton Zebrocy Microcin

2018-10-11 ⋅ ESET Research ⋅ Anton Cherepanov, Robert Lipovsky
New TeleBots backdoor: First evidence linking Industroyer to NotPetya
Exaramel EternalPetya Exaramel Industroyer

2018-01-13 ⋅ The Washington Post ⋅ Ellen Nakashima
Russian military was behind ‘NotPetya’ cyberattack in Ukraine, CIA concludes
EternalPetya

2017-10-27 ⋅ F-Secure ⋅ F-Secure Global
The big difference with Bad Rabbit
EternalPetya

2017-10-26 ⋅ FireEye ⋅ Barry Vengerik, Ben Read, Brian Mordosky, Christopher Glyer, Ian Ahl, Matt Williams, Michael Matonis, Nick Carr
BACKSWING - Pulling a BADRABBIT Out of a Hat
EternalPetya

2017-10-26 ⋅ Reversing Labs ⋅ None
ReversingLabs' YARA rule detects BadRabbit encryption routine specifics
EternalPetya

2017-10-25 ⋅ RiskIQ ⋅ Yonathan Klijnsma
Down the Rabbit Hole: Tracking the BadRabbit Ransomware to a Long Ongoing Campaign of Target Selection
EternalPetya

2017-10-24 ⋅ ESET Research ⋅ Editor
Kiev metro hit with a new variant of the infamous Diskcoder ransomware
EternalPetya

2017-10-24 ⋅ ESET Research ⋅ Marc-Etienne M.Léveillé
Bad Rabbit: Not‑Petya is back with improved ransomware
EternalPetya TeleBots

2017-10-24 ⋅ Cisco Talos ⋅ Nick Biasini
Threat Spotlight: Follow the Bad Rabbit
EternalPetya

2017-10-24 ⋅ Kaspersky Labs ⋅ Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov
Bad Rabbit ransomware
EternalPetya

2017-10-24 ⋅ Wired ⋅ Andy Greenberg
New Ransomware Linked to NotPetya Sweeps Russia and Ukraine
EternalPetya

2017-10-24 ⋅ Intezer ⋅ Jay Rosenberg
NotPetya Returns as Bad Rabbit
EternalPetya

2017-09-19 ⋅ NCC Group ⋅ Ollie Whitehouse
EternalGlue part one: Rebuilding NotPetya to assess real-world resilience
EternalPetya

2017-08-11 ⋅ Threatpost ⋅ Tom Spring
Ukrainian Man Arrested, Charged in NotPetya Distribution
EternalPetya

2017-07-14 ⋅ Malwarebytes ⋅ Malwarebytes Labs
Keeping up with the Petyas: Demystifying the malware family
EternalPetya GoldenEye PetrWrap Petya

2017-07-03 ⋅ The Guardian ⋅ Alex Hern
'NotPetya' malware attacks could warrant retaliation, says Nato affiliated-researcher
EternalPetya

2017-07-03 ⋅ CrowdStrike ⋅ Shaun Hurley, Karan Sood
NotPetya Technical Analysis Part II: Further Findings and Potential for MBR Recovery
EternalPetya

2017-07-03 ⋅ G Data ⋅ G Data
Who is behind Petna?
EternalPetya

2017-06-30 ⋅ Kaspersky Labs ⋅ GReAT
From BlackEnergy to ExPetr
EternalPetya

2017-06-30 ⋅ ESET Research ⋅ Anton Cherepanov
TeleBots are back: Supply‑chain attacks against Ukraine
EternalPetya TeleBots

2017-06-30 ⋅ Malwarebytes ⋅ Malwarebytes Labs
EternalPetya – yet another stolen piece in the package?
EternalPetya

2017-06-29 ⋅ Robert Graham
NonPetya: no evidence it was a "smokescreen"
EternalPetya

2017-06-29 ⋅ Malwarebytes ⋅ Malwarebytes Labs
EternalPetya and the lost Salsa20 key
EternalPetya

2017-06-29 ⋅ Bleeping Computer ⋅ Catalin Cimpanu
Ransomware Attacks Continue in Ukraine with Mysterious WannaCry Clone
EternalPetya

2017-06-29 ⋅ Microsoft ⋅ Microsoft Defender ATP Research Team
Windows 10 platform resilience against the Petya ransomware attack
EternalPetya

2017-06-28 ⋅ Kaspersky Labs ⋅ Anton Ivanov, Orkhan Mamedov
ExPetr/Petya/NotPetya is a Wiper, Not Ransomware
EternalPetya

2017-06-28 ⋅ hacks4pancakes
Why NotPetya Kept Me Awake (& You Should Worry Too)
EternalPetya

2017-06-28 ⋅ CrowdStrike ⋅ Falcon Intelligence Team
CrowdStrike Protects Against NotPetya Attack
EternalPetya

2017-06-27 ⋅ SANS ⋅ Brad Duncan
Checking out the new Petya variant
EternalPetya

2017-06-27 ⋅ Kaspersky Labs ⋅ GReAT
Schroedinger’s Pet(ya)
EternalPetya

2017-06-27 ⋅ Medium thegrugq ⋅ thegrugq
Pnyetya: Yet Another Ransomware Outbreak
EternalPetya

Yara Rules

[TLP:WHITE] win_eternal_petya_auto (20220411 | Detects win.eternal_petya.)

rule win_eternal_petya_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-04-08"
        version = "1"
        description = "Detects win.eternal_petya."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
        malpedia_rule_date = "20220405"
        malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a"
        malpedia_version = "20220411"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 53 68f0000000 6a40 ff15???????? }
            // n = 4, score = 400
            //   53                   | push                ebx
            //   68f0000000           | push                0xf0
            //   6a40                 | push                0x40
            //   ff15????????         |                     

        $sequence_1 = { 49 75f9 56 ff15???????? }
            // n = 4, score = 400
            //   49                   | dec                 ecx
            //   75f9                 | jne                 0xfffffffb
            //   56                   | push                esi
            //   ff15????????         |                     

        $sequence_2 = { 51 57 68000000f0 6a18 33ff }
            // n = 5, score = 400
            //   51                   | push                ecx
            //   57                   | push                edi
            //   68000000f0           | push                0xf0000000
            //   6a18                 | push                0x18
            //   33ff                 | xor                 edi, edi

        $sequence_3 = { 53 8d4644 50 53 }
            // n = 4, score = 400
            //   53                   | push                ebx
            //   8d4644               | lea                 eax, dword ptr [esi + 0x44]
            //   50                   | push                eax
            //   53                   | push                ebx

        $sequence_4 = { 53 6a21 8d460c 50 }
            // n = 4, score = 400
            //   53                   | push                ebx
            //   6a21                 | push                0x21
            //   8d460c               | lea                 eax, dword ptr [esi + 0xc]
            //   50                   | push                eax

        $sequence_5 = { 8d442428 53 50 895c242c e8???????? 83c40c 68fc1f0000 }
            // n = 7, score = 300
            //   8d442428             | lea                 eax, dword ptr [esp + 0x28]
            //   53                   | push                ebx
            //   50                   | push                eax
            //   895c242c             | mov                 dword ptr [esp + 0x2c], ebx
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   68fc1f0000           | push                0x1ffc

        $sequence_6 = { 68???????? 8d8594f9ffff 50 ff15???????? 85c0 7459 }
            // n = 6, score = 300
            //   68????????           |                     
            //   8d8594f9ffff         | lea                 eax, dword ptr [ebp - 0x66c]
            //   50                   | push                eax
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   7459                 | je                  0x5b

        $sequence_7 = { 8d442428 50 6a04 8d442428 50 6a0c ff742424 }
            // n = 7, score = 300
            //   8d442428             | lea                 eax, dword ptr [esp + 0x28]
            //   50                   | push                eax
            //   6a04                 | push                4
            //   8d442428             | lea                 eax, dword ptr [esp + 0x28]
            //   50                   | push                eax
            //   6a0c                 | push                0xc
            //   ff742424             | push                dword ptr [esp + 0x24]

        $sequence_8 = { 55 8bec 83ec10 a1???????? 8365fc00 8945f8 }
            // n = 6, score = 300
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83ec10               | sub                 esp, 0x10
            //   a1????????           |                     
            //   8365fc00             | and                 dword ptr [ebp - 4], 0
            //   8945f8               | mov                 dword ptr [ebp - 8], eax

        $sequence_9 = { 0f8696000000 56 57 8b4df8 8d3481 }
            // n = 5, score = 300
            //   0f8696000000         | jbe                 0x9c
            //   56                   | push                esi
            //   57                   | push                edi
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   8d3481               | lea                 esi, dword ptr [ecx + eax*4]

        $sequence_10 = { 8d442428 50 6a38 8d442440 }
            // n = 4, score = 300
            //   8d442428             | lea                 eax, dword ptr [esp + 0x28]
            //   50                   | push                eax
            //   6a38                 | push                0x38
            //   8d442440             | lea                 eax, dword ptr [esp + 0x40]

        $sequence_11 = { 55 8bec 83ec14 53 8d45f8 50 33db }
            // n = 7, score = 300
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83ec14               | sub                 esp, 0x14
            //   53                   | push                ebx
            //   8d45f8               | lea                 eax, dword ptr [ebp - 8]
            //   50                   | push                eax
            //   33db                 | xor                 ebx, ebx

        $sequence_12 = { 55 8bec 83ec14 834df8ff 53 57 }
            // n = 6, score = 300
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83ec14               | sub                 esp, 0x14
            //   834df8ff             | or                  dword ptr [ebp - 8], 0xffffffff
            //   53                   | push                ebx
            //   57                   | push                edi

        $sequence_13 = { 56 57 50 eb09 }
            // n = 4, score = 200
            //   56                   | push                esi
            //   57                   | push                edi
            //   50                   | push                eax
            //   eb09                 | jmp                 0xb

        $sequence_14 = { 8b4118 ffd0 8b85ccf5ffff 8b08 }
            // n = 4, score = 200
            //   8b4118               | mov                 eax, dword ptr [ecx + 0x18]
            //   ffd0                 | call                eax
            //   8b85ccf5ffff         | mov                 eax, dword ptr [ebp - 0xa34]
            //   8b08                 | mov                 ecx, dword ptr [eax]

        $sequence_15 = { 50 ff15???????? 50 ff15???????? 8d4d80 }
            // n = 5, score = 200
            //   50                   | push                eax
            //   ff15????????         |                     
            //   50                   | push                eax
            //   ff15????????         |                     
            //   8d4d80               | lea                 ecx, dword ptr [ebp - 0x80]

    condition:
        7 of them and filesize < 851968
}

[TLP:WHITE] win_eternal_petya_w0 (20171222 | No description)

rule win_eternal_petya_w0 {

    meta:
        author = "ReversingLabs"
        date = "2017-11-29"
        source = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-badrabbit-encryption-routine-specifics.html"
        info = "ReversingLabs' YARA rule detects BadRabbit encryption routine specifics."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
        malpedia_version = "20171222"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    
    strings:
        $encrypt_file = { 55 8B EC 83 EC ?? 53 56 57 8B 7D ?? 8B 4F ?? 33 DB 8D 45 ?? 50 53 53 51 89 5D ?? 89  5D ?? 89 5D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 55 ?? 53 53 6A ?? 53 53  68 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D  4D ?? 51 57 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 39 5D ?? 0F 84 ??  ?? ?? ?? 39 5D ?? 0F 84 ?? ?? ?? ?? 8D 55 ?? 52 56 FF 15 ?? ?? ?? ?? 8B 4F ?? 8B 45  ?? 83 C1 ?? 2B C1 19 5D ?? 89 45 ?? 89 5D ?? 78 ?? 7F ?? 3D ?? ?? ?? ?? 76 ?? B8 ??  ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? 53 50 53 6A ?? 53 8B F8 56 89 45 ?? 89 7D ?? FF  15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8B 55 ?? 52 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ??  8B F8 85 FF 74 ?? 8B 4D ?? 8B 55 ?? 8D 45 ?? 50 57 6A ?? 51 6A ?? 52 FF 15 ?? ?? ??  ?? 85 C0 74 ?? 8B 45 ?? 50 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 68 ?? ?? ?? ?? E8 ?? ??  ?? ?? 83 C4 ?? 57 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? 3B C7 73  ?? 2B F8 EB ?? 33 FF 8B 55 ?? 8B 42 ?? 8D 4C 38 ?? 6A ?? 51 E8 ?? ?? ?? ?? 8B 7D ??  83 C4 ?? 33 DB 56 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 39 5D ?? 74 ?? 39  5D ?? 75 ?? 8B 47 ?? 8B 35 ?? ?? ?? ?? 50 FF D6 8B 7F ?? 3B FB 74 ?? 57 FF D6 5F 5E  5B 8B E5 5D C3 }

        $main_encrypt = { 55 8B EC 56 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 75 ?? 89 46 ?? 85 C0 0F 84  ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 7E ?? 57 FF  D3 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? 6A ?? 6A ?? 6A ?? 57 FF  D3 85 C0 74 ?? 8B 07 8D 5E ?? 53 50 8B 46 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B  C6 E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 4E ?? 6A ?? 51 E8 ??  ?? ?? ?? 8B 56 ?? 83 C4 ?? 52 FF 15 ?? ?? ?? ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 0B  51 FF 15 ?? ?? ?? ?? 8B 17 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ??  5F 5B B9 ?? ?? ?? ?? 8D 46 ?? 8B FF C6 00 ?? 40 49 75 ?? 56 FF 15 ?? ?? ?? ?? 33 C0  5E 5D C2 ?? ?? }

        $encryption_loop = { 8B 7C 24 ?? 6A ?? 6A ?? 8D 43 ?? 50 33 C0 39 43 ?? 0F 95 C0 40 50 FF 15 ?? ?? ?? ??  85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B9 ??  ?? ?? ?? 8D 44 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ??  75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ??  ?? ?? B9 ?? ?? ?? ?? 8D 44 24 ?? 8D 64 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ??  66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83  D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51 57 8D 94 24 ?? ?? ?? ?? 52 FF 15 ?? ??  ?? ?? 85 C0 74 ?? 8B 44 24 ?? A8 ?? 74 ?? A9 ?? ?? ?? ?? 75 ?? 8D BC 24 ?? ?? ?? ??  E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 45 ?? 53 48 50 8B CF 51 E8 ?? ?? ?? ?? 83 C4 ?? EB ??  8D 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 8D 71 ?? 90 66 8B 11 83 C1 ?? 66 85 D2  75 ?? 2B CE D1 F9 8D 4C 4C ?? 3B C1 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D  94 24 ?? ?? ?? ?? 53 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 74 24 ?? 8D 44 24 ?? 50 56 FF 15  ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??}

    condition:
        $encrypt_file and $main_encrypt and $encryption_loop 
}

Download all Yara Rules

EternalPetya Propose Change

References

Yara Rules

EternalPetya