Windows_VulnDriver_IoBitMalwareFighter_09a63a44

rule Windows_VulnDriver_IoBitMalwareFighter_09a63a44 {
    meta:
        author = "Elastic Security"
        id = "09a63a44-13c1-4e9c-bf2c-2a6c5d3ef444"
        fingerprint = "3b8f322a15ca0a70fad6be96a16b1dfee101b3cd0f8a906a2724d0e679288efd"
        creation_date = "2026-02-26"
        last_modified = "2026-07-20"
        description = "Subject: IObit CO., LTD, Name: ForceDelete.sys, Version: 7.0.0.5, Product Name: IObit Malware Fighter"
        threat_name = "Windows.VulnDriver.IoBitMalwareFighter"
        reference = "https://github.com/xM0kht4r/VEN0m-Ransomware"
        reference_sample = "ef4e4b88df24825dbf4e7131e71a41002715d38b7a8c0c432aa936c854152ef3"
        severity = 50
        arch_context = "x86"
        scan_context = "file, memory"
        license = "Elastic License v2"
        os = "windows"
    strings:
        $subject_name = { 06 03 55 04 03 [2] 49 4F 62 69 74 20 43 4F 2E 2C 20 4C 54 44 }
        $original_file_name = { 4F 00 72 00 69 00 67 00 69 00 6E 00 61 00 6C 00 46 00 69 00 6C 00 65 00 6E 00 61 00 6D 00 65 [1-8] 46 00 6F 00 72 00 63 00 65 00 44 00 65 00 6C 00 65 00 74 00 65 00 2E 00 73 00 79 00 73 00 }
        $file_version_number = { 46 00 69 00 6C 00 65 00 56 00 65 00 72 00 73 00 69 00 6F 00 6E [1-8] 37 00 2E 00 30 00 2E 00 30 00 2E 00 35 00 }
        $product_name = { 50 00 72 00 6F 00 64 00 75 00 63 00 74 00 4E 00 61 00 6D 00 65 [1-8] 49 00 4F 00 62 00 69 00 74 00 20 00 4D 00 61 00 6C 00 77 00 61 00 72 00 65 00 20 00 46 00 69 00 67 00 68 00 74 00 65 00 72 00 }
    condition:
        int16(uint32(0x3C) + 0x5c) == 0x0001 and int16(uint32(0x3C) + 0x18) == 0x020b and $subject_name and $original_file_name and $file_version_number and $product_name
}