Maze Defunct

rule Maze_Ransomware {
    meta:
        description = "Detects Maze ransomware"
        author = "Security Research"
    strings:
        $s1 = "DECRYPT-FILES" ascii
        $s2 = "maze" ascii nocase
        $s3 = "ChaCha" ascii
    condition:
        uint16(0) == 0x5A4D and 2 of them
}

Attention!
---------------------------

| What happened?
---------------------------

We hacked your network and now all your files, documents, photos, databases, and
other important data are safely encrypted with reliable algorithms.
You cannot access the files right now. But do not worry. You can get it back!
It is easy to recover in a few steps.

We have also downloaded a lot of private data from your network.
If you do not contact us in a close future we will release your data to public.
It will damage your reputation and your company.

| What should I do?
---------------------------

The only way to decrypt your files is to buy the special key from us.
To get the key, please go to our website:
https://maze[REDACTED].onion

If you can't access our website, use Tor Browser.
Or contact us via email: {EMAIL}

| How to access?
---------------------------

* Download Tor browser - https://www.torproject.org
* Open link: http://maze[REDACTED].onion
* Follow the instructions on the website

---
{VICTIM_ID}