EternalPetya (Malware Family)

SYMBOL	COMMON_NAME	aka. SYNONYMS

win.eternal_petya (Back to overview)

EternalPetya

aka: ExPetr, Pnyetya, Petna, NotPetya, Nyetya, NonPetya, nPetya, Diskcoder.C, BadRabbit

Actor(s): TeleBots, Sandworm

According to proofpoint, Bad Rabbit is a strain of ransomware that first appeared in 2017 and is a suspected variant of Petya. Like other strains of ransomware, Bad Rabbit virus infections lock up victims’ computers, servers, or files preventing them from regaining access until a ransom—usually in Bitcoin—is paid.

References

2023-01-29 ⋅ Acronis ⋅ Ilan Duhin
Petya/Not Petya Ransomware Analysis
EternalPetya

2022-11-18 ⋅ Atlantic Council ⋅ Justin Sherman
GRU 26165: The Russian cyber unit that hacks targets on-site
EternalPetya

2022-10-31 ⋅ The Record ⋅ Alexander Martin
Mondelez and Zurich reach settlement in NotPetya cyberattack insurance suit
EternalPetya

2022-10-24 ⋅ Youtube (Virus Bulletin) ⋅ Alexander Adamov
Russian wipers in the cyberwar against Ukraine
AcidRain CaddyWiper DesertBlade DoubleZero EternalPetya HermeticWiper HermeticWizard INDUSTROYER2 IsaacWiper KillDisk PartyTicket WhisperGate

2022-04-28 ⋅ Fortinet ⋅ Gergely Revay
An Overview of the Increasing Wiper Malware Threat
AcidRain CaddyWiper DistTrack DoubleZero EternalPetya HermeticWiper IsaacWiper Olympic Destroyer Ordinypt WhisperGate ZeroCleare

2022-04-20 ⋅ CISA ⋅ CISA, NSA, FBI, Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), Government Communications Security Bureau, NCSC UK, National Crime Agency (NCA)
AA22-110A Joint CSA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader

2022-04-20 ⋅ CISA ⋅ CISA
Alert (AA22-110A): Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader Killnet

2022-03-01 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
DiskKill/HermeticWiper and NotPetya (Dis)similarities
EternalPetya HermeticWiper

2022-02-25 ⋅ CyberPeace Institute
UKRAINE: Timeline of Cyberattacks
VPNFilter EternalPetya HermeticWiper WhisperGate

2022-02-24 ⋅ nviso ⋅ Michel Coene
Threat Update – Ukraine & Russia conflict
EternalPetya GreyEnergy HermeticWiper Industroyer KillDisk WhisperGate

2022-02-24 ⋅ Talos ⋅ Mitch Neff
Threat Advisory: Current executive guidance for ongoing cyberattacks in Ukraine
VPNFilter EternalPetya

2022-02-24 ⋅ Tesorion ⋅ TESORION
Report OSINT: Russia/ Ukraine Conflict Cyberaspect
Mirai VPNFilter BlackEnergy EternalPetya HermeticWiper Industroyer WhisperGate

2022-02-23 ⋅ ISTARI ⋅ Manuel Hepfer
Re-cap: The Untold Story of NotPetya, The Most Devastating Cyberattack in History
EternalPetya

2021-09-09 ⋅ Recorded Future ⋅ Insikt Group
Dark Covenant: Connections Between the Russian State and Criminal Actors
BlackEnergy EternalPetya Gameover P2P Zeus

2021-05-31 ⋅ Wired ⋅ Andy Greenberg
Hacker Lexicon: What Is a Supply Chain Attack?
EternalPetya SUNBURST

2021-04-29 ⋅ The Institute for Security and Technology ⋅ The Institute for Security and Technology
Combating Ransomware A Comprehensive Framework for Action: Key Recommendations from the Ransomware Task Force
Conti EternalPetya

2020-12-21 ⋅ IronNet ⋅ Adam Hlavek, Kimberly Ortiz
Russian cyber attack campaigns and actors
WellMail elf.wellmess Agent.BTZ BlackEnergy EternalPetya Havex RAT Industroyer Ryuk Triton WellMess

2020-11-04 ⋅ Stranded on Pylos Blog ⋅ Joe Slowik
The Enigmatic Energetic Bear
EternalPetya Havex RAT

2020-10-19 ⋅ CyberScoop ⋅ Tim Starks
US charges Russian GRU officers for NotPetya, other major hacks
EternalPetya

2020-10-19 ⋅ Riskint Blog ⋅ Curtis
Revisited: Fancy Bear's New Faces...and Sandworms' too
BlackEnergy EternalPetya Industroyer Olympic Destroyer

2020-10-19 ⋅ UK Government ⋅ ForeignCommonwealth & Development Office, Dominic Raab
UK exposes series of Russian cyber attacks against Olympic and Paralympic Games
VPNFilter BlackEnergy EternalPetya Industroyer

2020-10-19 ⋅ Wired ⋅ Andy Greenberg
US Indicts Sandworm, Russia's Most Destructive Cyberwar Unit
EternalPetya Olympic Destroyer

2020-08-29 ⋅ Aguinet ⋅ Adrien Guinet
Emulating NotPetya bootloader with Miasm
EternalPetya

2020-07-29 ⋅ Atlantic Council ⋅ Trey Herr, June Lee, William Loomis, Stewart Scott
BREAKING TRUST: Shades of Crisis Across an Insecure Software Supply Chain
EternalPetya GoldenSpy Kwampirs Stuxnet

2020-07-29 ⋅ Kaspersky Labs ⋅ GReAT
APT trends report Q2 2020
PhantomLance Dacls Penquin Turla elf.wellmess AppleJeus Dacls AcidBox Cobalt Strike Dacls EternalPetya Godlike12 Olympic Destroyer PlugX shadowhammer ShadowPad Sinowal VHD Ransomware Volgmer WellMess X-Agent XTunnel

2020-06-21 ⋅ GVNSHTN ⋅ Gavin Ashton
Maersk, me & notPetya
EternalPetya

2020-06-09 ⋅ Kaspersky Labs ⋅ Costin Raiu
Looking at Big Threats Using Code Similarity. Part 1
Penquin Turla CCleaner Backdoor EternalPetya Regin WannaCryptor XTunnel

2020-03-05 ⋅ Microsoft ⋅ Microsoft Threat Protection Intelligence Team
Human-operated ransomware attacks: A preventable disaster
Dharma DoppelPaymer Dridex EternalPetya Gandcrab Hermes LockerGoga MegaCortex MimiKatz REvil RobinHood Ryuk SamSam TrickBot WannaCryptor PARINACOTA

2020 ⋅ Secureworks ⋅ SecureWorks
IRON VIKING
BlackEnergy EternalPetya GreyEnergy Industroyer KillDisk TeleBot TeleDoor

2019-08-01 ⋅ Kaspersky Labs ⋅ GReAT
APT trends report Q2 2019
ZooPark magecart POWERSTATS Chaperone COMpfun EternalPetya FinFisher RAT HawkEye Keylogger HOPLIGHT Microcin NjRAT Olympic Destroyer PLEAD RokRAT Triton Zebrocy

2018-10-11 ⋅ ESET Research ⋅ Anton Cherepanov, Robert Lipovsky
New TeleBots backdoor: First evidence linking Industroyer to NotPetya
Exaramel EternalPetya Exaramel Industroyer

2018-08-22 ⋅ Wired ⋅ Andy Greenberg
The Untold Story of NotPetya, the Most Devastating Cyberattack in History
EternalPetya

2018-01-13 ⋅ The Washington Post ⋅ Ellen Nakashima
Russian military was behind ‘NotPetya’ cyberattack in Ukraine, CIA concludes
EternalPetya

2017-10-27 ⋅ F-Secure ⋅ F-Secure Global
The big difference with Bad Rabbit
EternalPetya

2017-10-26 ⋅ FireEye ⋅ Barry Vengerik, Ben Read, Brian Mordosky, Christopher Glyer, Ian Ahl, Matt Williams, Michael Matonis, Nick Carr
BACKSWING - Pulling a BADRABBIT Out of a Hat
EternalPetya

2017-10-26 ⋅ Reversing Labs ⋅ None
ReversingLabs' YARA rule detects BadRabbit encryption routine specifics
EternalPetya

2017-10-25 ⋅ RiskIQ ⋅ Yonathan Klijnsma
Down the Rabbit Hole: Tracking the BadRabbit Ransomware to a Long Ongoing Campaign of Target Selection
EternalPetya

2017-10-24 ⋅ Intezer ⋅ Jay Rosenberg
NotPetya Returns as Bad Rabbit
EternalPetya

2017-10-24 ⋅ ESET Research ⋅ Editor
Kiev metro hit with a new variant of the infamous Diskcoder ransomware
EternalPetya

2017-10-24 ⋅ Cisco Talos ⋅ Nick Biasini
Threat Spotlight: Follow the Bad Rabbit
EternalPetya

2017-10-24 ⋅ ESET Research ⋅ Marc-Etienne M.Léveillé
Bad Rabbit: Not‑Petya is back with improved ransomware
EternalPetya

2017-10-24 ⋅ Kaspersky Labs ⋅ Orkhan Mamedov, Fedor Sinitsyn, Anton Ivanov
Bad Rabbit ransomware
EternalPetya

2017-10-24 ⋅ Wired ⋅ Andy Greenberg
New Ransomware Linked to NotPetya Sweeps Russia and Ukraine
EternalPetya

2017-09-19 ⋅ NCC Group ⋅ Ollie Whitehouse
EternalGlue part one: Rebuilding NotPetya to assess real-world resilience
EternalPetya

2017-08-24 ⋅ ESET Research ⋅ Marc-Etienne M.Léveillé
Bad Rabbit: Not‑Petya is back with improved ransomware
EternalPetya Sandworm

2017-08-11 ⋅ Threatpost ⋅ Tom Spring
Ukrainian Man Arrested, Charged in NotPetya Distribution
EternalPetya

2017-07-14 ⋅ Malwarebytes ⋅ Malwarebytes Labs
Keeping up with the Petyas: Demystifying the malware family
EternalPetya GoldenEye PetrWrap Petya

2017-07-04 ⋅ Kaspersky ⋅ Anton Ivanov, Orkhan Mamedov
In ExPetr/Petya’s shadow, FakeCry ransomware wave hits Ukraine
EternalPetya FakeCry

2017-07-03 ⋅ The Guardian ⋅ Alex Hern
'NotPetya' malware attacks could warrant retaliation, says Nato affiliated-researcher
EternalPetya

2017-07-03 ⋅ G Data ⋅ G Data
Who is behind Petna?
EternalPetya

2017-07-03 ⋅ CrowdStrike ⋅ Shaun Hurley, Karan Sood
NotPetya Technical Analysis Part II: Further Findings and Potential for MBR Recovery
EternalPetya

2017-06-30 ⋅ ESET Research ⋅ Anton Cherepanov
TeleBots are back: Supply‑chain attacks against Ukraine
EternalPetya

2017-06-30 ⋅ Malwarebytes ⋅ Malwarebytes Labs
EternalPetya – yet another stolen piece in the package?
EternalPetya

2017-06-30 ⋅ Kaspersky Labs ⋅ GReAT
From BlackEnergy to ExPetr
EternalPetya

2017-06-29 ⋅ Microsoft ⋅ Microsoft Defender ATP Research Team
Windows 10 platform resilience against the Petya ransomware attack
EternalPetya

2017-06-29 ⋅ Malwarebytes ⋅ Malwarebytes Labs
EternalPetya and the lost Salsa20 key
EternalPetya

2017-06-29 ⋅ Bleeping Computer ⋅ Catalin Cimpanu
Ransomware Attacks Continue in Ukraine with Mysterious WannaCry Clone
EternalPetya

2017-06-29 ⋅ Robert Graham
NonPetya: no evidence it was a "smokescreen"
EternalPetya

2017-06-28 ⋅ hacks4pancakes
Why NotPetya Kept Me Awake (& You Should Worry Too)
EternalPetya

2017-06-28 ⋅ Kaspersky Labs ⋅ Anton Ivanov, Orkhan Mamedov
ExPetr/Petya/NotPetya is a Wiper, Not Ransomware
EternalPetya

2017-06-28 ⋅ CrowdStrike ⋅ Falcon Intelligence Team
CrowdStrike Protects Against NotPetya Attack
EternalPetya

2017-06-27 ⋅ Kaspersky Labs ⋅ GReAT
Schroedinger’s Pet(ya)
EternalPetya

2017-06-27 ⋅ SANS ⋅ Brad Duncan
Checking out the new Petya variant
EternalPetya

2017-06-27 ⋅ Medium thegrugq ⋅ thegrugq
Pnyetya: Yet Another Ransomware Outbreak
EternalPetya

2017-06-27 ⋅ ESET Research ⋅ Editor
New WannaCryptor‑like ransomware attack hits globally: All you need to know
EternalPetya Sandworm

2017-05-31 ⋅ MITRE ⋅ MITRE ATT&CK
Sandworm Team
CyclopsBlink Exaramel BlackEnergy EternalPetya Exaramel GreyEnergy KillDisk MimiKatz Olympic Destroyer Sandworm

Yara Rules

[TLP:WHITE] win_eternal_petya_auto (20230715 | Detects win.eternal_petya.)

rule win_eternal_petya_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.eternal_petya."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 40 49 75f9 56 ff15???????? }
            // n = 5, score = 400
            //   40                   | inc                 eax
            //   49                   | dec                 ecx
            //   75f9                 | jne                 0xfffffffb
            //   56                   | push                esi
            //   ff15????????         |                     

        $sequence_1 = { 51 57 68000000f0 6a18 33ff }
            // n = 5, score = 400
            //   51                   | push                ecx
            //   57                   | push                edi
            //   68000000f0           | push                0xf0000000
            //   6a18                 | push                0x18
            //   33ff                 | xor                 edi, edi

        $sequence_2 = { 53 8d4644 50 53 }
            // n = 4, score = 400
            //   53                   | push                ebx
            //   8d4644               | lea                 eax, [esi + 0x44]
            //   50                   | push                eax
            //   53                   | push                ebx

        $sequence_3 = { 53 6a21 8d460c 50 }
            // n = 4, score = 400
            //   53                   | push                ebx
            //   6a21                 | push                0x21
            //   8d460c               | lea                 eax, [esi + 0xc]
            //   50                   | push                eax

        $sequence_4 = { 53 68f0000000 6a40 ff15???????? }
            // n = 4, score = 400
            //   53                   | push                ebx
            //   68f0000000           | push                0xf0
            //   6a40                 | push                0x40
            //   ff15????????         |                     

        $sequence_5 = { 8d442428 53 50 895c242c e8???????? 83c40c 68fc1f0000 }
            // n = 7, score = 300
            //   8d442428             | lea                 eax, [esp + 0x28]
            //   53                   | push                ebx
            //   50                   | push                eax
            //   895c242c             | mov                 dword ptr [esp + 0x2c], ebx
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   68fc1f0000           | push                0x1ffc

        $sequence_6 = { 8d442428 50 6a38 8d442440 50 6a0a }
            // n = 6, score = 300
            //   8d442428             | lea                 eax, [esp + 0x28]
            //   50                   | push                eax
            //   6a38                 | push                0x38
            //   8d442440             | lea                 eax, [esp + 0x40]
            //   50                   | push                eax
            //   6a0a                 | push                0xa

        $sequence_7 = { 03c8 8bc2 c1e818 03c8 33c0 }
            // n = 5, score = 300
            //   03c8                 | add                 ecx, eax
            //   8bc2                 | mov                 eax, edx
            //   c1e818               | shr                 eax, 0x18
            //   03c8                 | add                 ecx, eax
            //   33c0                 | xor                 eax, eax

        $sequence_8 = { 8945cc 83ef02 e9???????? 8b55f4 6a11 59 66394dce }
            // n = 7, score = 300
            //   8945cc               | mov                 dword ptr [ebp - 0x34], eax
            //   83ef02               | sub                 edi, 2
            //   e9????????           |                     
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   6a11                 | push                0x11
            //   59                   | pop                 ecx
            //   66394dce             | cmp                 word ptr [ebp - 0x32], cx

        $sequence_9 = { 55 8bec 83ec7c 33c0 33d2 53 }
            // n = 6, score = 300
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83ec7c               | sub                 esp, 0x7c
            //   33c0                 | xor                 eax, eax
            //   33d2                 | xor                 edx, edx
            //   53                   | push                ebx

        $sequence_10 = { 33db 47 395e34 7520 }
            // n = 4, score = 300
            //   33db                 | xor                 ebx, ebx
            //   47                   | inc                 edi
            //   395e34               | cmp                 dword ptr [esi + 0x34], ebx
            //   7520                 | jne                 0x22

        $sequence_11 = { 68bd010000 ff7508 33f6 e8???????? 85c0 }
            // n = 5, score = 300
            //   68bd010000           | push                0x1bd
            //   ff7508               | push                dword ptr [ebp + 8]
            //   33f6                 | xor                 esi, esi
            //   e8????????           |                     
            //   85c0                 | test                eax, eax

        $sequence_12 = { 33db 50 53 33ff 895df8 }
            // n = 5, score = 300
            //   33db                 | xor                 ebx, ebx
            //   50                   | push                eax
            //   53                   | push                ebx
            //   33ff                 | xor                 edi, edi
            //   895df8               | mov                 dword ptr [ebp - 8], ebx

        $sequence_13 = { e8???????? 83c40c 8b8de8fbffff 8bc7 81f95a030000 761d ba46da6972 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   8b8de8fbffff         | mov                 ecx, dword ptr [ebp - 0x418]
            //   8bc7                 | mov                 eax, edi
            //   81f95a030000         | cmp                 ecx, 0x35a
            //   761d                 | jbe                 0x1f
            //   ba46da6972           | mov                 edx, 0x7269da46

        $sequence_14 = { 8d4c2444 8d7102 90 668b11 }
            // n = 4, score = 200
            //   8d4c2444             | lea                 ecx, [esp + 0x44]
            //   8d7102               | lea                 esi, [ecx + 2]
            //   90                   | nop                 
            //   668b11               | mov                 dx, word ptr [ecx]

        $sequence_15 = { 8b7d0c 83c408 33db 56 ff15???????? 8b55f8 }
            // n = 6, score = 200
            //   8b7d0c               | mov                 edi, dword ptr [ebp + 0xc]
            //   83c408               | add                 esp, 8
            //   33db                 | xor                 ebx, ebx
            //   56                   | push                esi
            //   ff15????????         |                     
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]

    condition:
        7 of them and filesize < 851968
}

[TLP:WHITE] win_eternal_petya_w0 (20171222 | No description)

rule win_eternal_petya_w0 {

    meta:
        author = "ReversingLabs"
        date = "2017-11-29"
        source = "https://www.reversinglabs.com/newsroom/news/reversinglabs-yara-rule-detects-badrabbit-encryption-routine-specifics.html"
        info = "ReversingLabs' YARA rule detects BadRabbit encryption routine specifics."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eternal_petya"
        malpedia_version = "20171222"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    
    strings:
        $encrypt_file = { 55 8B EC 83 EC ?? 53 56 57 8B 7D ?? 8B 4F ?? 33 DB 8D 45 ?? 50 53 53 51 89 5D ?? 89  5D ?? 89 5D ?? FF 15 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 8B 55 ?? 53 53 6A ?? 53 53  68 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 8B F0 83 FE ?? 0F 84 ?? ?? ?? ?? 8D 45 ?? 50 8D  4D ?? 51 57 8B CE E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 0F 84 ?? ?? ?? ?? 39 5D ?? 0F 84 ??  ?? ?? ?? 39 5D ?? 0F 84 ?? ?? ?? ?? 8D 55 ?? 52 56 FF 15 ?? ?? ?? ?? 8B 4F ?? 8B 45  ?? 83 C1 ?? 2B C1 19 5D ?? 89 45 ?? 89 5D ?? 78 ?? 7F ?? 3D ?? ?? ?? ?? 76 ?? B8 ??  ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? 53 50 53 6A ?? 53 8B F8 56 89 45 ?? 89 7D ?? FF  15 ?? ?? ?? ?? 8B D8 85 DB 74 ?? 8B 55 ?? 52 6A ?? 6A ?? 6A ?? 53 FF 15 ?? ?? ?? ??  8B F8 85 FF 74 ?? 8B 4D ?? 8B 55 ?? 8D 45 ?? 50 57 6A ?? 51 6A ?? 52 FF 15 ?? ?? ??  ?? 85 C0 74 ?? 8B 45 ?? 50 57 FF 15 ?? ?? ?? ?? 8B 4D ?? 51 68 ?? ?? ?? ?? E8 ?? ??  ?? ?? 83 C4 ?? 57 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 8B 7D ?? 8B 45 ?? 3B C7 73  ?? 2B F8 EB ?? 33 FF 8B 55 ?? 8B 42 ?? 8D 4C 38 ?? 6A ?? 51 E8 ?? ?? ?? ?? 8B 7D ??  83 C4 ?? 33 DB 56 FF 15 ?? ?? ?? ?? 8B 55 ?? 52 FF 15 ?? ?? ?? ?? 39 5D ?? 74 ?? 39  5D ?? 75 ?? 8B 47 ?? 8B 35 ?? ?? ?? ?? 50 FF D6 8B 7F ?? 3B FB 74 ?? 57 FF D6 5F 5E  5B 8B E5 5D C3 }

        $main_encrypt = { 55 8B EC 56 6A ?? 6A ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B 75 ?? 89 46 ?? 85 C0 0F 84  ?? ?? ?? ?? 53 8B 1D ?? ?? ?? ?? 57 68 ?? ?? ?? ?? 6A ?? 6A ?? 6A ?? 8D 7E ?? 57 FF  D3 85 C0 75 ?? FF 15 ?? ?? ?? ?? 3D ?? ?? ?? ?? 75 ?? 6A ?? 6A ?? 6A ?? 6A ?? 57 FF  D3 85 C0 74 ?? 8B 07 8D 5E ?? 53 50 8B 46 ?? E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8B  C6 E8 ?? ?? ?? ?? 85 C0 74 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 56 8D 4E ?? 6A ?? 51 E8 ??  ?? ?? ?? 8B 56 ?? 83 C4 ?? 52 FF 15 ?? ?? ?? ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ?? 8B 0B  51 FF 15 ?? ?? ?? ?? 8B 17 6A ?? 52 FF 15 ?? ?? ?? ?? 8B 46 ?? 50 FF 15 ?? ?? ?? ??  5F 5B B9 ?? ?? ?? ?? 8D 46 ?? 8B FF C6 00 ?? 40 49 75 ?? 56 FF 15 ?? ?? ?? ?? 33 C0  5E 5D C2 ?? ?? }

        $encryption_loop = { 8B 7C 24 ?? 6A ?? 6A ?? 8D 43 ?? 50 33 C0 39 43 ?? 0F 95 C0 40 50 FF 15 ?? ?? ?? ??  85 C0 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? 83 F8 ?? 0F 84 ?? ?? ?? ?? B9 ??  ?? ?? ?? 8D 44 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ?? 66 8B 50 ?? 66 3B 51 ??  75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83 D8 ?? 85 C0 0F 84 ?? ??  ?? ?? B9 ?? ?? ?? ?? 8D 44 24 ?? 8D 64 24 ?? 66 8B 10 66 3B 11 75 ?? 66 85 D2 74 ??  66 8B 50 ?? 66 3B 51 ?? 75 ?? 83 C0 ?? 83 C1 ?? 66 85 D2 75 ?? 33 C0 EB ?? 1B C0 83  D8 ?? 85 C0 0F 84 ?? ?? ?? ?? 8D 4C 24 ?? 51 57 8D 94 24 ?? ?? ?? ?? 52 FF 15 ?? ??  ?? ?? 85 C0 74 ?? 8B 44 24 ?? A8 ?? 74 ?? A9 ?? ?? ?? ?? 75 ?? 8D BC 24 ?? ?? ?? ??  E8 ?? ?? ?? ?? 85 C0 75 ?? 8B 45 ?? 53 48 50 8B CF 51 E8 ?? ?? ?? ?? 83 C4 ?? EB ??  8D 54 24 ?? 52 FF 15 ?? ?? ?? ?? 8D 4C 24 ?? 8D 71 ?? 90 66 8B 11 83 C1 ?? 66 85 D2  75 ?? 2B CE D1 F9 8D 4C 4C ?? 3B C1 74 ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 85 C0 74 ?? 8D  94 24 ?? ?? ?? ?? 53 52 E8 ?? ?? ?? ?? 83 C4 ?? 8B 74 24 ?? 8D 44 24 ?? 50 56 FF 15  ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??}

    condition:
        $encrypt_file and $main_encrypt and $encryption_loop 
}

Download all Yara Rules

EternalPetya Propose Change

References

Yara Rules

EternalPetya