FE_CPE_MS17_010_RANSOMWARE

YARA-2017-12829 Critical general Active

Probable PETYA ransomware using ETERNALBLUE, WMIC, PsExec

FE_CPE_MS17_010_RANSOMWARE.yar Valid Syntax

rule FE_CPE_MS17_010_RANSOMWARE {
meta:version="1.1"
      //filetype="PE"
      author="Ian.Ahl@fireeye.com @TekDefense, Nicholas.Carr@mandiant.com @ItsReallyNick"
      date="2017-06-27"
      description="Probable PETYA ransomware using ETERNALBLUE, WMIC, PsExec"
      reference = "https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html"
strings:
      // DRIVE USAGE
      $dmap01 = "\\\\.\\PhysicalDrive" nocase ascii wide
      $dmap02 = "\\\\.\\PhysicalDrive0" nocase ascii wide
      $dmap03 = "\\\\.\\C:" nocase ascii wide
      $dmap04 = "TERMSRV" nocase ascii wide
      $dmap05 = "\\admin$" nocase ascii wide
      $dmap06 = "GetLogicalDrives" nocase ascii wide
      $dmap07 = "GetDriveTypeW" nocase ascii wide

      // RANSOMNOTE
      $msg01 = "WARNING: DO NOT TURN OFF YOUR PC!" nocase ascii wide
      $msg02 = "IF YOU ABORT THIS PROCESS" nocase ascii wide
      $msg03 = "DESTROY ALL OF YOUR DATA!" nocase ascii wide
      $msg04 = "PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED" nocase ascii wide
      $msg05 = "your important files are encrypted" ascii wide
      $msg06 = "Your personal installation key" nocase ascii wide
      $msg07 = "worth of Bitcoin to following address" nocase ascii wide
      $msg08 = "CHKDSK is repairing sector" nocase ascii wide
      $msg09 = "Repairing file system on " nocase ascii wide
      $msg10 = "Bitcoin wallet ID" nocase ascii wide
      $msg11 = "wowsmith123456@posteo.net" nocase ascii wide
      $msg12 = "1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX" nocase ascii wide
      $msg_pcre = /(en|de)crypt(ion|ed\.)/     

      // FUNCTIONALITY, APIS
      $functions01 = "need dictionary" nocase ascii wide
      $functions02 = "comspec" nocase ascii wide
      $functions03 = "OpenProcessToken" nocase ascii wide
      $functions04 = "CloseHandle" nocase ascii wide
      $functions05 = "EnterCriticalSection" nocase ascii wide
      $functions06 = "ExitProcess" nocase ascii wide
      $functions07 = "GetCurrentProcess" nocase ascii wide
      $functions08 = "GetProcAddress" nocase ascii wide
      $functions09 = "LeaveCriticalSection" nocase ascii wide
      $functions10 = "MultiByteToWideChar" nocase ascii wide
      $functions11 = "WideCharToMultiByte" nocase ascii wide
      $functions12 = "WriteFile" nocase ascii wide
      $functions13 = "CoTaskMemFree" nocase ascii wide
      $functions14 = "NamedPipe" nocase ascii wide
      $functions15 = "Sleep" nocase ascii wide // imported, not in strings     

      // COMMANDS
      //  -- Clearing event logs & USNJrnl
      $cmd01 = "wevtutil cl Setup" ascii wide nocase
      $cmd02 = "wevtutil cl System" ascii wide nocase
      $cmd03 = "wevtutil cl Security" ascii wide nocase
      $cmd04 = "wevtutil cl Application" ascii wide nocase
      $cmd05 = "fsutil usn deletejournal" ascii wide nocase
      // -- Scheduled task
      $cmd06 = "schtasks " nocase ascii wide
      $cmd07 = "/Create /SC " nocase ascii wide
      $cmd08 = " /TN " nocase ascii wide
      $cmd09 = "at %02d:%02d %ws" nocase ascii wide
      $cmd10 = "shutdown.exe /r /f" nocase ascii wide
      // -- Sysinternals/PsExec and WMIC
      $cmd11 = "-accepteula -s" nocase ascii wide
      $cmd12 = "wmic"
      $cmd13 = "/node:" nocase ascii wide
      $cmd14 = "process call create" nocase ascii wide

condition:
      // (uint16(0) == 0x5A4D)
      3 of ($dmap*)
      and 2 of ($msg*)
      and 9 of ($functions*)
      and 7 of ($cmd*)
}         

rule petya_eternalblue : petya_eternalblue {
    meta:
        author      = "blueliv"
        description =  "Based on spreading petya version: 2017-06-28"
        reference = "https://blueliv.com/petya-ransomware-cyber-attack-is-spreading-across-the-globe-part-2/"
    strings:
        /* Some commands executed by the Petya variant */
       $cmd01 = "schtasks %ws/Create /SC once /TN \"\" /TR \"%ws\" /ST %02d:%0" wide
       $cmd02 = "shutdown.exe /r /f" wide
       $cmd03 = "%s \\\\%s -accepteula -s" wide
       $cmd04 = "process call create \"C:\\Windows\\System32\\rundll32.exe \\\"C:\\Windows\\%s\\\" #1" wide
       /* Strings of encrypted files */
       $str01 = "they have been encrypted. Perhaps you are busy looking" wide
        /* MBR/VBR payload */
        $mbr01 = {00 00 00 55 aa e9 ?? ??}
    condition:
        all of them
}

Rule Metadata

version

1.1

filetype

author

Ian.Ahl@fireeye.com @TekDefense, Nicholas.Carr@mandiant.com @ItsReallyNick

date

2017-06-27

description

Probable PETYA ransomware using ETERNALBLUE, WMIC, PsExec

reference

https://www.fireeye.com/blog/threat-research/2017/06/petya-ransomware-spreading-via-eternalblue-exploit.html

String Definitions

{"name":"$dmap01","value":"\"\\\\\\\\.\\\\PhysicalDrive\" nocase ascii wide"}

{"name":"$dmap02","value":"\"\\\\\\\\.\\\\PhysicalDrive0\" nocase ascii wide"}

{"name":"$dmap03","value":"\"\\\\\\\\.\\\\C:\" nocase ascii wide"}

{"name":"$dmap04","value":"\"TERMSRV\" nocase ascii wide"}

{"name":"$dmap05","value":"\"\\\\admin"}

{"name":"$dmap06","value":"\"GetLogicalDrives\" nocase ascii wide"}

{"name":"$dmap07","value":"\"GetDriveTypeW\" nocase ascii wide\n\n \/\/ RANSOMNOTE"}

{"name":"$msg01","value":"\"WARNING: DO NOT TURN OFF YOUR PC!\" nocase ascii wide"}

{"name":"$msg02","value":"\"IF YOU ABORT THIS PROCESS\" nocase ascii wide"}

{"name":"$msg03","value":"\"DESTROY ALL OF YOUR DATA!\" nocase ascii wide"}

{"name":"$msg04","value":"\"PLEASE ENSURE THAT YOUR POWER CABLE IS PLUGGED\" nocase ascii wide"}

{"name":"$msg05","value":"\"your important files are encrypted\" ascii wide"}

{"name":"$msg06","value":"\"Your personal installation key\" nocase ascii wide"}

{"name":"$msg07","value":"\"worth of Bitcoin to following address\" nocase ascii wide"}

{"name":"$msg08","value":"\"CHKDSK is repairing sector\" nocase ascii wide"}

{"name":"$msg09","value":"\"Repairing file system on \" nocase ascii wide"}

{"name":"$msg10","value":"\"Bitcoin wallet ID\" nocase ascii wide"}

{"name":"$msg11","value":"\"wowsmith123456@posteo.net\" nocase ascii wide"}

{"name":"$msg12","value":"\"1Mz7153HMuxXTuR2R1t78mGSdzaAtNbBWX\" nocase ascii wide"}

{"name":"$msg_pcre","value":"\/(en|de)crypt(ion|ed\\.)\/ \n\n \/\/ FUNCTIONALITY, APIS"}

{"name":"$functions01","value":"\"need dictionary\" nocase ascii wide"}

{"name":"$functions02","value":"\"comspec\" nocase ascii wide"}

{"name":"$functions03","value":"\"OpenProcessToken\" nocase ascii wide"}

{"name":"$functions04","value":"\"CloseHandle\" nocase ascii wide"}

{"name":"$functions05","value":"\"EnterCriticalSection\" nocase ascii wide"}

{"name":"$functions06","value":"\"ExitProcess\" nocase ascii wide"}

{"name":"$functions07","value":"\"GetCurrentProcess\" nocase ascii wide"}

{"name":"$functions08","value":"\"GetProcAddress\" nocase ascii wide"}

{"name":"$functions09","value":"\"LeaveCriticalSection\" nocase ascii wide"}

{"name":"$functions10","value":"\"MultiByteToWideChar\" nocase ascii wide"}

{"name":"$functions11","value":"\"WideCharToMultiByte\" nocase ascii wide"}

{"name":"$functions12","value":"\"WriteFile\" nocase ascii wide"}

{"name":"$functions13","value":"\"CoTaskMemFree\" nocase ascii wide"}

{"name":"$functions14","value":"\"NamedPipe\" nocase ascii wide"}

{"name":"$functions15","value":"\"Sleep\" nocase ascii wide \/\/ imported, not in strings \n\n \/\/ COMMANDS\n \/\/ -- Clearing event logs & USNJrnl"}

{"name":"$cmd01","value":"\"wevtutil cl Setup\" ascii wide nocase"}

{"name":"$cmd02","value":"\"wevtutil cl System\" ascii wide nocase"}

{"name":"$cmd03","value":"\"wevtutil cl Security\" ascii wide nocase"}

{"name":"$cmd04","value":"\"wevtutil cl Application\" ascii wide nocase"}

{"name":"$cmd05","value":"\"fsutil usn deletejournal\" ascii wide nocase\n \/\/ -- Scheduled task"}

{"name":"$cmd06","value":"\"schtasks \" nocase ascii wide"}

{"name":"$cmd07","value":"\"\/Create \/SC \" nocase ascii wide"}

{"name":"$cmd08","value":"\" \/TN \" nocase ascii wide"}

{"name":"$cmd09","value":"\"at %02d:%02d %ws\" nocase ascii wide"}

{"name":"$cmd10","value":"\"shutdown.exe \/r \/f\" nocase ascii wide\n \/\/ -- Sysinternals\/PsExec and WMIC"}

{"name":"$cmd11","value":"\"-accepteula -s\" nocase ascii wide"}

{"name":"$cmd12","value":"\"wmic\""}

{"name":"$cmd13","value":"\"\/node:\" nocase ascii wide"}

{"name":"$cmd14","value":"\"process call create\" nocase ascii wide"}

Threat Analysis

This YARA rule is designed to detect general threats.

Severity Level: Critical

The rule uses pattern matching to identify specific byte sequences, strings, or behavioral patterns associated with malicious activity.

Detection Capabilities

File-based detection for executables and documents
Memory scanning for running processes
Network traffic analysis support

Command Line Usage

# Scan a single file
yara FE_CPE_MS17_010_RANSOMWARE.yar /path/to/suspicious/file

# Scan a directory recursively
yara -r FE_CPE_MS17_010_RANSOMWARE.yar /path/to/directory/

# Scan with metadata output
yara -m FE_CPE_MS17_010_RANSOMWARE.yar target_file

# Scan process memory (Linux)
yara FE_CPE_MS17_010_RANSOMWARE.yar /proc/[pid]/exe

Integration Examples

Python (yara-python)

import yara
rules = yara.compile(filepath='FE_CPE_MS17_010_RANSOMWARE.yar')
matches = rules.match('/path/to/file')

ClamAV Integration

clamscan --yara-rules=FE_CPE_MS17_010_RANSOMWARE.yar /path/to/scan

Rule Information

YARA ID

YARA-2017-12829

Author

Ian.Ahl@fireeye.com @TekDefense, Nicholas.Carr@mandiant.com @ItsReallyNick

Repository

Yara-Rules_rules

Created

August 19, 2025

Last Updated

August 19, 2025

Last Imported

Never

Threat Intelligence

Risk Level Critical

Category general

Detection Confidence Analysis Pending

False Positive Rate Not Available

Last Seen in Wild No Data

Related Rules

Xtreme

YARA-2025-0555

Medium

MiniDionis_readerView

YARA-2015-0004

Medium

Maldoc_APT10_MenuPass

YARA-2018-3751

Medium

Mal_Dropper_httpEXE_from_CAB

Export Options

Similar Rules in general

YARA-2023-0001 CRI

FE_CPE_MS17_010_RANSOMWARE

Rule Metadata

String Definitions

Threat Analysis

Detection Capabilities

Command Line Usage

Integration Examples

Python (yara-python)

ClamAV Integration

Rule Information

Threat Intelligence

Related Rules

Export Options

Similar Rules in general

Detect_Mimic_Ransomware

SystemBC_malware

detect_catB

detect_Typhon_Stealer

Nosu_stealer

detect_Lumma_stealer

detect_StrelaStealer

detect_silence_Downloader