rule MAL_Ransomware_Win_DARKSIDE_v1_1
{
	meta:
		author = "FireEye"
		date = "2021-03-22"
		description = "Detection for early versions of DARKSIDE ransomware samples based on the encryption mode configuration values."
		hash = "1a700f845849e573ab3148daef1a3b0b"
		reference = "https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html"
		id = "322a3de5-a7e5-52b9-8648-6019954e92d7"

	strings:
		$consts = { 80 3D [4] 01 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] 00 00 04 00 [1-10] 00 00 00 00 [1-30] 80 3D [4] 02 [1-10] 03 00 00 00 [1-10] 03 00 00 00 [1-10] FF FF FF FF [1-10] FF FF FF FF [1-30] 03 00 00 00 [1-10] 03 00 00 00 }

	condition:
		( uint16( 0 ) == 0x5A4D and uint32( uint32( 0x3C ) ) == 0x00004550 ) and $consts
}