YaraSig_Babuk

rule babuk {
meta:
  ref = "https://twitter.com/Arkbird_SOLG/status/1349826691372343296"
  md5 = "8b9a0b44b738c7884e6a14f4cb18afff"
  sha256 = "704a0fa7de19564bc743fb68aa0652e38bf86e8ab694bc079b15f945c85f4320"
  size = "39424"
  author = "cs0sf"
strings:
  $a1 = "*BY BABUK LOCKER*"
  $a2 = "Your computers and servers are encrypted"
  $a3 = "using tor browser" nocase
  $a4 = "DANGER"
  $a5 = "CryptAcquireContextW"
  $a6 = "CryptGenRandom"
condition:
  uint16(0) == 0x5a4d and all of ($a*)
}