Modulus (N): 0xcbb94cb189a638b51e7cfe161cd92edb7145ecbd93989e78c94f8c15c61829286fd834d80c931daed4ac4aba14835fd3a6721602bcaa7193245fc6cf8e1d3261460ff3f1cbae3d44690beb989adee69ac486a932ee44dbdf0a44e772ab9822a16753cd08bdbb169f866f722114ee69c0cf1588fdaf8f7efd1c3ed243786078593f9b0cd867bab2b170c1843660d16e2181ae679137e2650551a41631398e027206e22a55858c741079ceafd50d5bd69546d4d52f5a33b0a576e1750d3f83afa1ce4403d768cbd670b443f61794b44705a8b1132c0c0ce77dbd04053ba20aec9baf23944270f10d16ad0727ed490c91c7f469278827c20a3e560f7c84015f7e1b
Exponent (E): 0x10001

rule CrowdStrike_PartyTicket_01 : ransomware golang 
{
    meta:
        copyright = "(c) 2022 CrowdStrike Inc."
        description = "Detects Golang-based crypter"
        version = "202202250130"
        last_modified = "2022-02-25"
    strings:
        $ = ".encryptedJB" ascii
        $start = { ff 20 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 }
        $end = { 0a 20 ff }
    condition:
        uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550 and
        for 1 of ($end) : ( @start < @ and @start + 1024 > @) and
        all of them
}

rule CrowdStrike_PartyTicket_02 : PartyTicket golang 
{
    meta:
        copyright = "(c) 2022 CrowdStrike Inc."
        description = "Detects Golang-based PartyTicket ransomware"
        version = "202202250130"
        last_modified = "2022-02-25"
      strings:
        $s1 = "voteFor403"
        $s2 = "highWay60"
        $s3 = "randomiseDuration"
        $s4 = "subscribeNewPartyMember"
        $s5 = "primaryElectionProces"
        $s6 = "baggageGatherings"
        $s7 = "getBoo"
        $s8 = "selfElect"
        $s9 = "wHiteHousE"
        $s10 = "encryptedJB"
        $goid = { ff 20 47 6f 20 62 75 69 6c 64 20 49 44 3a 20 22 71 62 30 48 37 41 64 57 41 59 44 7a 66 4d 41 31 4a 38 30 42 2f 6e 4a 39 46 46 38 66 75 70 4a 6c 34 71 6e 45 34 57 76 41 35 2f 50 57 6b 77 45 4a 66 4b 55 72 52 62 59 4e 35 39 5f 4a 62 61 2f 32 6f 30 56 49 79 76 71 49 4e 46 62 4c 73 44 73 46 79 4c 32 22 0a 20 ff }
        $pdb = "C://projects//403forBiden//wHiteHousE"
    condition:
        (uint32(0) == 0x464c457f or (uint16(0) == 0x5a4d and uint16(uint32(0x3c)) == 0x4550)) and 4 of ($s*) or $pdb or $goid

package main
 
import (
	"crypto/aes"
	"crypto/cipher"
	"encoding/hex"
	"fmt"
	"os"
	"flag"
)
 
func main() {
 
	encrypted_filepath := flag.String("p", "encrypted.bin", "Path to encrypted file")
	flag.Parse()
 
	fmt.Printf("Decrypting file : %s\n", *encrypted_filepath)
	key_bytes := []byte("6FBBD7P95OE8UT5QRTTEBIWAR88S74DO")
	key := hex.EncodeToString(key_bytes)
	fmt.Printf("Decryption key : %s\n", key_bytes)
 
	dat, err := os.ReadFile(*encrypted_filepath)
	if err != nil {
		fmt.Println("Unable to open file, please supply path of encrypted file with flag -p, default file path is ./encrypted.bin")
		os.Exit(3)
	}
 
	decrypted_filepath := "decrypted.bin"
	filecontents := dat
	encrypted_contents := filecontents[:len(filecontents) - 288]
	enc_size := len(encrypted_contents)
	bsize := 1048604
	cycles := enc_size / bsize
 
	if cycles == 0{ 
 
		encrypted := hex.EncodeToString(encrypted_contents)
		decrypted := decrypt(encrypted, key)
		write_output(decrypted_filepath, decrypted)
		} else {
			for i:=0; i= 9 {
					start := 9 * bsize
					end := enc_size
					data := string(encrypted_contents[start:end])
					write_output(decrypted_filepath, data)
					break
				}
				block_start := i * bsize
				block_end := (i+1) * bsize
				if block_end > enc_size{
					block_end := enc_size
					encrypted:=hex.EncodeToString(encrypted_contents[block_start:block_end])
					decrypted := decrypt(encrypted, key)
					write_output(decrypted_filepath, decrypted)
 
				}
 
				encrypted:=hex.EncodeToString(encrypted_contents[block_start:block_end])
				decrypted := decrypt(encrypted, key)
				write_output(decrypted_filepath, decrypted)
			}
		}
 
		fmt.Printf("Decrypted file written to : %s\n", decrypted_filepath)
 
	}
 
func write_output(filepath string, data string) {
		f, err := os.OpenFile(filepath, os.O_APPEND|os.O_CREATE|os.O_WRONLY, 0644)
		if err != nil {
			panic(err)
		}
		byte_data := []byte(data)
		f.Write(byte_data)
		f.Close()
}
 
func decrypt(encryptedString string, keyString string) (decryptedString string) {
 
	key, _ := hex.DecodeString(keyString)
	enc, _ := hex.DecodeString(encryptedString)
 
	block, err := aes.NewCipher(key)
	if err != nil {
		panic(err.Error())
	}
	aesGCM, err := cipher.NewGCM(block)
	if err != nil {
		panic(err.Error())
	}
	nonceSize := aesGCM.NonceSize()
	nonce, ciphertext := enc[:nonceSize], enc[nonceSize:]
	plaintext, err := aesGCM.Open(nil, nonce, ciphertext, nil)
	if err != nil {
		panic(err.Error())
	}
 
	return fmt.Sprintf("%s", plaintext)
}

• ウクライナに対するサイバー攻撃の詳細については、こちらをご覧ください。Lessons Learned From Successive Use of Offensive Cyber Operations Against Ukraine and What May Be Next（ウクライナに対する一連のサイバー攻撃の教訓と今後の予測）
• CrowdStrike FalconがDriveSlayerおよびワイパー型攻撃に対して継続的に行っている防御については、こちらをご参照ください。CrowdStrike Falcon Protects from New Wiper Malware Used in Ukraine Cyberattacks（CrowdStrike Falcon、ウクライナへのサイバー攻撃で使用された新たなワイパー型マルウェアから保護）
• WhisperGateに関するCrowdStrike Intelligenceのブログ記事をご覧ください。Technical Analysis of the WhisperGate Malicious Bootloader（WhisperGate不正ブートローダーの技術分析）
• パワフルでクラウドネイティブなCrowdStrike Falconプラットフォームをウェブサイトの製品のページでご紹介しています。
• 完全な機能を搭載したCrowdStrike Falcon Preventの無料トライアルで最も高度な脅威に対抗する次世代アンチウイルスをご体験ください。