Create RANSOM_screenlocker_5h311_1nj3c706

malware/RANSOM_screenlocker_5h311_1nj3c706

+rule screenlocker_5h311_1nj3c706 {
+
+   meta:
+
+      description = "Rule to detect the screenlocker 5h311_1nj3c706"
+      author = "Marc Rivero | @seifreed"
+      reference = "https://twitter.com/demonslay335/status/1038060120461266944"
+
+   strings:
+
+      $s1 = "C:\\Users\\Hoang Nam\\source\\repos\\WindowsApp22\\WindowsApp22\\obj\\Debug\\WindowsApp22.pdb" fullword ascii
+      $s2 = "cmd.exe /cREG add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\ActiveDesktop /v NoChangingWallPaper /t REG_DWOR" wide
+      $s3 = "C:\\Users\\file1.txt" fullword wide
+      $s4 = "C:\\Users\\file2.txt" fullword wide
+      $s5 = "C:\\Users\\file.txt" fullword wide
+      $s6 = " /v Wallpaper /t REG_SZ /d %temp%\\IMG.jpg /f" fullword wide
+      $s7 = " /v DisableAntiSpyware /t REG_DWORD /d 1 /f" fullword wide
+      $s8 = "All your file has been locked. You must pay money to have a key." fullword wide
+      $s9 = "After we receive Bitcoin from you. We will send key to your email." fullword wide
+   
+   condition:
+
+      ( uint16(0) == 0x5a4d and filesize < 200KB ) and all of them 
+}