/*
    Source: research.ohiiho.com/reports/2026-05-sorry-worm-playbook/
    Author: OHIIHO Research
    License: Free to use with attribution.
*/

rule SorryWorm_EncryptedFile_48byte_Prefix : ohiiho sorry_worm encrypted_file
{
    meta:
        author      = "OHIIHO Research"
        date        = "2026-05-01"
        description = "Detects files encrypted by Sorry-worm based on the 48-byte fixed prefix consistent across all encrypted artifacts observed for this campaign. The prefix corresponds to a fragment of the operator's hardcoded RSA-2048 public key formatted as an OpenPGP Public-Key Packet header."
        sample_sha256       = "2fc0a056fd4eff5d31d06c103af3298d711f33dbcd5d122cae30b571ac511e5a"
        rsa_pubkey_sha256   = "02cffd86bcfae828ca5cdea65b794a47079f49cc52c72b32570ed5abff24fd99"
        prefix_sha256       = "5bfbdd128ceef2d6820897f1af9cc4060e9c53cd5042dc4b3cf6de0a9f58af82"
        reference           = "https://research.ohiiho.com/part-2-sorry-worm-anatomy"
        license             = "CC0-1.0"

    strings:
        $prefix = {
            99 00 00 08 00 6D 02 1B C7 93 E1 23 D5 AF 31 12
            E8 32 C3 DE 6D 40 D1 0E 1A 57 1C DE DF 93 E7 8E
            CA D8 03 E6 56 FE 9F 9F 92 E6 43 0B 1C 12 F6 F0
        }