# 基于PassiveTotal/SecurityTrails的域名历史解析分析
# 查找已知LockBit C2域名的历史DNS记录

python3 << 'EOF'
import requests
import json

known_c2 = ["lockbitapt[.]com", "lockbitapt2dlyktob2sqde7v3rhexdtxpqwtla5h3h3pb4tzc2evtv3id[.]onion"]

def query_passivetotal(domain, api_key, api_secret):
    url = f"https://api.passivetotal.org/v2/dns/history"
    auth = (api_key, api_secret)
    params = {"query": domain}
    response = requests.get(url, auth=auth, params=params)
    return response.json()

def find_related_infrastructure(ioc_list, output_file):
    related_ips = set()
    related_domains = set()
    for ioc in ioc_list:
        try:
            result = query_passivetotal(ioc, API_KEY, API_SECRET)
            for record in result.get("data", []):
                related_ips.add(record.get("resolve"))
                related_domains.add(record.get("value"))
        except Exception as e:
            print(f"Error querying {ioc}: {e}")

    output = {
        "source_iocs": ioc_list,
        "related_ips": list(related_ips),
        "related_domains": list(related_domains),
        "total_related": len(related_ips) + len(related_domains)
    }
    with open(output_file, "w") as f:
        json.dump(output, f, indent=2)
    return output

result = find_related_infrastructure(known_c2, "lockbit_infra.json")
print(f"Found {result['total_related']} related infrastructure items")
EOF

# 基于SSL证书指纹的关联分析
# 查询Certificate Transparency日志中的共享证书

python3 << 'EOF'
import requests
import hashlib

def query_crt_sh(domain):
    url = f"https://crt.sh/?q=%.{domain}&output=json"
    response = requests.get(url, timeout=30)
    if response.status_code == 200:
        return response.json()
    return []

def find_certificate_overlap(domains):
    cert_map = {}
    all_certs = {}
    for domain in domains:
        certs = query_crt_sh(domain)
        for cert in certs:
            name_value = cert.get("name_value", "")
            issuer = cert.get("issuer_name", "")
            ca = cert.get("ca_name", "")
            serial = cert.get("serial_number", "")
            fingerprint = hashlib.sha256(
                f"{issuer}{serial}".encode()
            ).hexdigest()[:16]
            if fingerprint not in cert_map:
                cert_map[fingerprint] = set()
            cert_map[fingerprint].add(name_value)
            all_certs[fingerprint] = {
                "issuer": issuer,
                "ca": ca,
                "domains": list(cert_map[fingerprint])
            }

    overlaps = {
        fp: info for fp, info in all_certs.items()
        if len(info["domains"]) > 1
    }
    return overlaps

suspicious_domains = [
    "evil-ransomware[.]com",
    "alt-ransomware[.]com",
    "suspected-c2[.]net"
]
overlaps = find_certificate_overlap(suspicious_domains)
for fp, info in overlaps.items():
    print(f"Certificate {fp}: {info['domains']}")
EOF

数据窃取典型流程：
1. 初始访问获取立足点
2. 部署信息窃取工具（Rclone、MegaCMD、StealBit）
3. 枚举敏感数据（数据库、文件共享、备份）
4. 数据压缩和分段
5. 通过加密通道外泄至云存储/FTP/Tor站点
6. 验证数据完整性
7. 执行加密（可选）
8. 联系受害者发送勒索通知

title: Ransomware Shadow Copy Deletion and Recovery Prevention
id: a7f3d2e1-4b8c-4a9e-9f5c-3e2d1b0a8f6c
status: experimental
description: Detects common ransomware behavior of deleting shadow copies and disabling recovery mode
references:
  - https://attack.mitre.org/techniques/T1490/
  - https://attack.mitre.org/techniques/T1486/
author: x7peeps蓝队
date: 2026/07/08
modified: 2026/07/08
tags:
  - attack.impact
  - attack.t1490
  - attack.t1486
  - ransomware
logsource:
  category: process_creation
  product: windows
detection:
  selection_vssadmin_delete:
    Image|endswith:
      - '\vssadmin.exe'
    CommandLine|contains:
      - 'delete shadows'
      - 'delete shadowcopy'
  selection_wmic_shadow:
    Image|endswith:
      - '\wmic.exe'
    CommandLine|contains:
      - 'shadowcopy delete'
  selection_bcdedit:
    Image|endswith:
      - '\bcdedit.exe'
    CommandLine|contains:
      - 'recoveryenabled no'
      - 'bootstatuspolicy ignoreallfailures'
  selection_wbadmin:
    Image|endswith:
      - '\wbadmin.exe'
    CommandLine|contains:
      - 'delete catalog'
      - 'delete systemstatebackup'
  selection_powershell_shadow:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
    CommandLine|contains:
      - 'Win32_ShadowCopy'
      - 'Delete()'
  condition: 1 of selection_*
falsepositives:
  - Legitimate system administration scripts
  - Backup software operations
level: high

#!/bin/bash

RANSOM_EXTENSIONS=(
    ".encrypted" ".locked" ".crypt" ".crypto" ".black"
    ".akira" ".play" ".cl0p" ".8base" ".royal"
    ".rhysida" ".monti" ".akira" ".blackcat"
    ".alpha" ".alpha64" ".alphv"
)

REPORT_FILE="/tmp/ransomware_check_$(date +%Y%m%d_%H%M%S).txt"

echo "=== Ransomware Forensics Check Report ===" > "$REPORT_FILE"
echo "Generated: $(date)" >> "$REPORT_FILE"
echo "Host: $(hostname)" >> "$REPORT_FILE"
echo "==========================================" >> "$REPORT_FILE"

echo "[1] Checking for ransom note files..." >> "$REPORT_FILE"
find / -maxdepth 5 -type f \( \
    -iname "README*.txt" -o \
    -iname "RECOVER*.txt" -o \
    -iname "DECRYPT*.txt" -o \
    -iname "HOW_TO*.txt" -o \
    -iname "RESTORE*.txt" -o \
    -iname "*ransom*" -o \
    -iname "*decrypt*" \
\) -newer /etc/hostname 2>/dev/null | while read -r f; do
    echo "  [RANSOM NOTE] $f ($(stat -c '%y' "$f" 2>/dev/null))" >> "$REPORT_FILE"
done

echo "" >> "$REPORT_FILE"
echo "[2] Checking for ransomware file extensions..." >> "$REPORT_FILE"
for ext in "${RANSOM_EXTENSIONS[@]}"; do
    COUNT=$(find / -maxdepth 5 -type f -name "*${ext}" 2>/dev/null | wc -l)
    if [ "$COUNT" -gt 0 ]; then
        echo "  [WARNING] Found $COUNT files with extension '$ext'" >> "$REPORT_FILE"
        find / -maxdepth 5 -type f -name "*${ext}" 2>/dev/null | head -5 | while read -r f; do
            echo "    -> $f" >> "$REPORT_FILE"
        done
    fi
done

echo "" >> "$REPORT_FILE"
echo "[3] Checking for deleted shadow copies / backup destruction..." >> "$REPORT_FILE"
if command -v lvm &>/dev/null; then
    SNAPSHOTS=$(lvs 2>/dev/null | grep -c "snap")
    echo "  LVM Snapshots remaining: $SNAPSHOTS" >> "$REPORT_FILE"
fi
if [ -d "/backup" ]; then
    RECENT=$(find /backup -type f -mtime -1 2>/dev/null | wc -l)
    DELETED=$(find /backup -type f -name "*.deleted" 2>/dev/null | wc -l)
    echo "  /backup recent files: $RECENT, deleted markers: $DELETED" >> "$REPORT_FILE"
fi

echo "" >> "$REPORT_FILE"
echo "[4] Checking for suspicious processes..." >> "$REPORT_FILE"
ps aux | grep -iE "(ransom|encrypt|crypt|lock)" | grep -v grep | while read -r line; do
    echo "  [SUSPICIOUS PROCESS] $line" >> "$REPORT_FILE"
done

echo "" >> "$REPORT_FILE"
echo "[5] Checking for suspicious cron jobs..." >> "$REPORT_FILE"
for user in $(cut -f1 -d: /etc/passwd); do
    CRON_CONTENT=$(crontab -l -u "$user" 2>/dev/null | grep -v "^#" | grep -v "^$")
    if [ -n "$CRON_CONTENT" ]; then
        echo "  [$user crontab] $CRON_CONTENT" >> "$REPORT_FILE"
    fi
done
ls -la /etc/cron.d/ /var/spool/cron/ 2>/dev/null >> "$REPORT_FILE"

echo "" >> "$REPORT_FILE"
echo "[6] Checking network connections..." >> "$REPORT_FILE"
ss -tlnp 2>/dev/null | grep -v "^State" >> "$REPORT_FILE"
echo "" >> "$REPORT_FILE"
echo "  Outbound connections to Tor entry nodes:" >> "$REPORT_FILE"
ss -tnp 2>/dev/null | grep -E ":(9001|9030|9050|9051|9150)" >> "$REPORT_FILE"

echo "" >> "$REPORT_FILE"
echo "[7] Checking recently modified system files..." >> "$REPORT_FILE"
find /etc /usr/bin /usr/sbin -type f -mtime -1 2>/dev/null | while read -r f; do
    echo "  [MODIFIED] $f ($(stat -c '%y' "$f"))" >> "$REPORT_FILE"
done

echo "" >> "$REPORT_FILE"
echo "[8] Checking for encrypted database files..." >> "$REPORT_FILE"
find / -maxdepth 4 -type f \( -name "*.sql.*" -o -name "*.db.*" -o -name "*.sqlite.*" \) \
    -newer /etc/hostname 2>/dev/null | head -20 | while read -r f; do
    echo "  [DB FILE] $f" >> "$REPORT_FILE"
done

echo "" >> "$REPORT_FILE"
echo "=== Check Complete ===" >> "$REPORT_FILE"
echo "Report saved to: $REPORT_FILE"
cat "$REPORT_FILE"

import os
import sys
import json
import hashlib
import re
import struct
from pathlib import Path
from datetime import datetime

RANSOM_SIGNATURES = {
    "LockBit": {
        "extensions": [".lockbit", ".black", ".abcd", ".abc"],
        "note_names": [" restore-files.txt", "LockBit_Readme.txt", "[ransomware_id]"],
        "mutex_patterns": [r"Global\\.*LockBit"],
        "registry_keys": ["HKEY_CURRENT_USER\\Software\\LockBit"],
    },
    "BlackCat_ALPHV": {
        "extensions": [".alphv", ".blackcat", ".cat9"],
        "note_names": ["RECOVER-[a-z0-9]+-FILES.txt", "RECOVER-FILES.txt"],
        "mutex_patterns": [r"ALPHV", r"BlackCat"],
        "registry_keys": [],
    },
    "Cl0p": {
        "extensions": [".Clop", ".CIop", ".cl0p", ".lPq4"],
        "note_names": ["ClopReadMe.txt", "Clopreadme.txt", "ReadMe.txt"],
        "mutex_patterns": [r"Clop", r"TESTERPCFORBSS"],
        "registry_keys": [],
    },
    "Akira": {
        "extensions": [".akira", ".akira64"],
        "note_names": ["akira_readme.txt", "how_to_decrypt.txt"],
        "mutex_patterns": [r"akira_mutex"],
        "registry_keys": [],
    },
    "Royal_BlackSuit": {
        "extensions": [".royal", ".royal2", ".black suit"],
        "note_names": ["README.TXT", "README.txt"],
        "mutex_patterns": [r"Royal", r"BlackSuit"],
        "registry_keys": [],
    },
    "Play": {
        "extensions": [".play", ".play_0wn", ".play_0wn_2"],
        "note_names": ["ReadMe.txt", "HOW_TO_RECOVER_DATA.txt"],
        "mutex_patterns": [r"Play"],
        "registry_keys": [],
    },
    "Rhysida": {
        "extensions": [".rhysida"],
        "note_names": ["CriticalBreachDetected.pdf", "README.TXT"],
        "mutex_patterns": [r"Rhysida"],
        "registry_keys": [],
    },
}

def calculate_file_hash(filepath):
    sha256_hash = hashlib.sha256()
    md5_hash = hashlib.md5()
    try:
        with open(filepath, "rb") as f:
            for byte_block in iter(lambda: f.read(65536), b""):
                sha256_hash.update(byte_block)
                md5_hash.update(byte_block)
        return {
            "sha256": sha256_hash.hexdigest(),
            "md5": md5_hash.hexdigest(),
            "size": os.path.getsize(filepath),
        }
    except Exception as e:
        return {"error": str(e)}

def extract_pe_strings(filepath, min_length=6):
    strings = []
    try:
        with open(filepath, "rb") as f:
            data = f.read()
        current_string = b""
        for byte in data:
            if 32 <= byte < 127:
                current_string += bytes([byte])
            else:
                if len(current_string) >= min_length:
                    try:
                        strings.append(current_string.decode("ascii"))
                    except UnicodeDecodeError:
                        pass
                current_string = b""
    except Exception:
        pass
    return strings

def extract_network_iocs(strings):
    iocs = {"domains": [], "ips": [], "urls": [], "onion": []}
    ip_pattern = re.compile(r"\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b")
    domain_pattern = re.compile(
        r"\b([a-zA-Z0-9][-a-zA-Z0-9]*\.[a-zA-Z]{2,})\b"
    )
    url_pattern = re.compile(r"https?://[^\s\"']+")
    onion_pattern = re.compile(r"[a-z2-7]{16,56}\.onion")

    private_ip_prefixes = ("10.", "127.", "169.254.", "192.168.", "172.")

    for s in strings:
        for match in ip_pattern.finditer(s):
            ip = match.group(1)
            if not any(ip.startswith(p) for p in private_ip_prefixes):
                iocs["ips"].append(ip)
        for match in domain_pattern.finditer(s):
            domain = match.group(1)
            if not domain.endswith((".exe", ".dll", ".sys", ".txt")):
                iocs["domains"].append(domain)
        for match in url_pattern.finditer(s):
            iocs["urls"].append(match.group(0))
        for match in onion_pattern.finditer(s):
            iocs["onion"].append(match.group(0))

    for key in iocs:
        iocs[key] = list(set(iocs[key]))
    return iocs

def classify_ransomware(filepath):
    results = {
        "file": filepath,
        "hashes": calculate_file_hash(filepath),
        "timestamp": datetime.now().isoformat(),
        "family_matches": [],
        "network_iocs": {},
        "extracted_strings_count": 0,
    }

    strings = extract_pe_strings(filepath)
    results["extracted_strings_count"] = len(strings)
    all_text = "\n".join(strings).lower()

    for family, signatures in RANSOM_SIGNATURES.items():
        match_score = 0
        match_details = []

        for ext in signatures["extensions"]:
            if ext.lower() in all_text:
                match_score += 2
                match_details.append(f"extension:{ext}")

        for note in signatures["note_names"]:
            if re.search(note.lower(), all_text):
                match_score += 3
                match_details.append(f"note:{note}")

        for pattern in signatures["mutex_patterns"]:
            if re.search(pattern.lower(), all_text):
                match_score += 2
                match_details.append(f"mutex:{pattern}")

        for key in signatures["registry_keys"]:
            if key.lower() in all_text:
                match_score += 2
                match_details.append(f"registry:{key}")

        if match_score > 0:
            results["family_matches"].append({
                "family": family,
                "score": match_score,
                "details": match_details,
            })

    results["family_matches"].sort(key=lambda x: x["score"], reverse=True)
    results["network_iocs"] = extract_network_iocs(strings)

    return results

def main():
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <file_or_directory> [output_json]")
        sys.exit(1)

    target = sys.argv[1]
    output_file = sys.argv[2] if len(sys.argv) > 2 else "ransomware_analysis.json"

    all_results = []

    if os.path.isfile(target):
        print(f"Analyzing: {target}")
        result = classify_ransomware(target)
        all_results.append(result)
    elif os.path.isdir(target):
        for root, dirs, files in os.walk(target):
            for fname in files:
                fpath = os.path.join(root, fname)
                print(f"Analyzing: {fpath}")
                result = classify_ransomware(fpath)
                all_results.append(result)
    else:
        print(f"Error: {target} not found")
        sys.exit(1)

    with open(output_file, "w", encoding="utf-8") as f:
        json.dump(all_results, f, indent=2, ensure_ascii=False)

    for result in all_results:
        print(f"\n--- {result['file']} ---")
        print(f"  SHA256: {result['hashes'].get('sha256', 'N/A')}")
        if result["family_matches"]:
            top = result["family_matches"][0]
            print(f"  Top Match: {top['family']} (score: {top['score']})")
            print(f"  Details: {', '.join(top['details'])}")
        else:
            print("  Family: Unknown")
        iocs = result["network_iocs"]
        if iocs.get("ips"):
            print(f"  IPs: {', '.join(iocs['ips'][:5])}")
        if iocs.get("onion"):
            print(f"  .onion: {', '.join(iocs['onion'][:3])}")

    print(f"\nFull results saved to: {output_file}")

if __name__ == "__main__":
    main()

rule Ransomware_Multi_Family_Detection {
    meta:
        description = "Detects common patterns across multiple ransomware families"
        author = "x7peeps蓝队"
        date = "2026-07-08"
        reference = "https://attack.mitre.org/techniques/T1486/"
        severity = "critical"

    strings:
        $ransom_note1 = "YOUR FILES ARE ENCRYPTED" ascii nocase
        $ransom_note2 = "All your files have been encrypted" ascii nocase
        $ransom_note3 = "To decrypt your files" ascii nocase
        $ransom_note4 = "Bitcoin wallet" ascii nocase
        $ransom_note5 = "Tor Browser" ascii nocase
        $ransom_note6 = "dark web" ascii nocase

        $vss_delete1 = "vssadmin delete shadows" ascii nocase
        $vss_delete2 = "wmic shadowcopy delete" ascii nocase
        $vss_delete3 = "bcdedit /set {default} recoveryenabled no" ascii nocase
        $vss_delete4 = "wbadmin delete catalog" ascii nocase

        $encryption1 = "AES" ascii
        $encryption2 = "RSA" ascii
        $encryption3 = "ChaCha" ascii
        $encryption4 = "aes-256" ascii nocase

        $ext_lockbit = ".lockbit" ascii nocase
        $ext_black = ".black" ascii nocase
        $ext_akira = ".akira" ascii nocase
        $ext_play = ".play" ascii nocase
        $ext_royal = ".royal" ascii nocase
        $ext_cl0p = ".cl0p" ascii nocase

        $tor1 = ".onion" ascii nocase
        $tor2 = "127.0.0.1:9050" ascii
        $tor3 = "127.0.0.1:9150" ascii

    condition:
        uint16(0) == 0x5A4D and
        (
            (2 of ($ransom_note*)) or
            (2 of ($vss_delete*)) or
            (2 of ($ext_*)) or
            (1 of ($ransom_note*) and 1 of ($vss_delete*)) or
            (1 of ($ransom_note*) and 1 of ($tor*) and 1 of ($encryption*))
        )
}