166156f803ab0174f7623d7c84082bbe4e7c2f12.yar

rule blackbyte_exfil_unpacked {  meta:  copyright = "Symantec"  family = "Alias:ExfilTool"  description = "Detects unpacked exfil tool used by BlackByte ransomware"   strings:  $str1 = ").Login"  $str2 = ").NewUpload"  $str3 = ").CreateDir"  $str4 = ".PreloginMsg"  $str5 = ".UploadCompleteMsg"  $str6 = ").UploadFile"   $str7 = {FF 20 47 6F 20 62 75 69 6C 64 69 6E 66 3A 08 02   00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00   07 75 6E 6B 6E 6F 77 6E 00 00 00 00 00 00 00 00}   $c1 = {44 24 68 44 31 C2 88 50 10 0F B6 54 24 56 44 0F}   $c2 = {FB 48 89 F7 4C 89 C6 E8 54 ED F6 FF 4C 8D 43 01}   condition:  all of ($str*) and ($c1 or $c2)  and filesize > 8MB and  (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) }