id: petya-malware-variant-3

info:
  name: Petya Malware (Variant 3) - Detect
  author: daffainfo
  severity: info
  reference: https://github.com/airbnb/binaryalert/blob/master/rules/public/ransomware/windows/ransomware_windows_petya_variant_3.yara
  tags: malware,file,petya
file:
  - extensions:
      - all
    matchers:
      - type: word
        part: raw
        words:
          - "wevtutil cl Setup & wevtutil cl System"
          - "fsutil usn deletejournal /D %c:"
        condition: or
# digest: 4a0a0047304502204504d8fbd5e3e33876f764bc4d50d16300ef58845baa44a15ad51b0472cdce35022100f5d908bfa7683ac6afd32d308eddc8011bc149d9eeae896b339e17809d6c3a18:922c64590222798bb761d5b6d8e72950