rule Revil_Ransomware : ransomware
{
	meta:
		author = "Josh Lemon"
		description = "Detects REvil Linux - Revix 1.1 and 1.2"
		reference = "https://angle.ankura.com/post/102hcny/revix-linux-ransomware"
		date = "2021-11-04"
		version = "1.1"
		hash1 = "f864922f947a6bb7d894245b53795b54b9378c0f7633c521240488e86f60c2c5"
		hash2 = "559e9c0a2ef6898fabaf0a5fb10ac4a0f8d721edde4758351910200fe16b5fa7"
		hash3 = "ea1872b2835128e3cb49a0bc27e4727ca33c4e6eba1e80422db19b505f965bc4"

	strings:
		$s1 = "Usage example: elf.exe --path /vmfs/ --threads 5" fullword ascii
		$s2 = "uname -a && echo \" | \" && hostname" fullword ascii
		$s3 = "esxcli --formatter=csv --format-param=fields==\"WorldID,DisplayName\" vm process list" ascii
		$s4 = "awk -F \"\\\"*,\\\"*\" '{system(\"esxcli" ascii
		$s5 = "--silent (-s) use for not stoping VMs mode" fullword ascii
		$s6 = "!!!BY DEFAULT THIS SOFTWARE USES 50 THREADS!!!" fullword ascii
		$s7 = "%d:%d: Comment not allowed here" fullword ascii
		$s8 = "Error decoding user_id %d " fullword ascii
		$s9 = "Error read urandm line %d!" fullword ascii
		$s10 = "%d:%d: Unexpected `%c` in comment opening sequence" fullword ascii
		$s11 = "%d:%d: Unexpected EOF in block comment" fullword ascii
		$s12 = "Using silent mode, if you on esxi - stop VMs manualy" fullword ascii
		$s13 = "rand: try to read %hu but get %lu bytes" fullword ascii
		$s14 = "Revix" fullword ascii
		$s15 = "without --path encrypts current dir" fullword ascii
		$e1 = "[%s] already encrypted" fullword ascii
		$e2 = "File [%s] was encrypted" fullword ascii
		$e3 = "File [%s] was NOT encrypted" fullword ascii
		$e4 = "Encrypting [%s]" fullword ascii

	condition:
		uint16( 0 ) == 0x457f and filesize < 300KB and ( 4 of ( $s* ) and 2 of ( $e* ) )
}