mirror of
https://github.com/reversinglabs/reversinglabs-yara-rules
synced 2026-06-11 03:01:18 +00:00
Added new YARA rules.
This commit is contained in:
Threat Analyst
@@ -10,6 +10,7 @@ rule Win32_Exploit_CVE20200601 : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "EXPLOIT"
|
||||
exploit = "CVE-2020-0601"
|
||||
description = "Yara rule that detects CVE-2020-0601 exploit."
|
||||
|
||||
tc_detection_type = "Exploit"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Infostealer_MultigrainPOS : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "MULTIGRAINPOS"
|
||||
description = "Yara rule that detects MultigrainPOS infostealer."
|
||||
|
||||
tc_detection_type = "Infostealer"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Infostealer_ProjectHookPOS : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "PROJECTHOOKPOS"
|
||||
description = "Yara rule that detects ProjectHookPOS infostealer."
|
||||
|
||||
tc_detection_type = "Infostealer"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Linux_Ransomware_KillDisk : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "KILLDISK"
|
||||
description = "Yara rule that detects KillDisk ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -0,0 +1,146 @@
|
||||
rule Linux_Ransomware_LuckyJoe : tc_detection malicious
|
||||
{
|
||||
meta:
|
||||
|
||||
author = "ReversingLabs"
|
||||
|
||||
source = "ReversingLabs"
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "LUCKYJOE"
|
||||
description = "Yara rule that detects LuckyJoe ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
tc_detection_name = "LuckyJoe"
|
||||
tc_detection_factor = 5
|
||||
|
||||
strings:
|
||||
|
||||
$main_call_p1 = {
|
||||
55 48 89 E5 48 81 EC ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? 48
|
||||
C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ??
|
||||
48 89 45 ?? 48 8B 55 ?? 48 8B 45 ?? 48 89 D6 48 89 C7 E8 ?? ?? ?? ?? 48 8D 75 ?? 48
|
||||
8B 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? BE ?? ??
|
||||
?? ?? BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 05 ?? ?? ?? ?? 48 89 C7 E8
|
||||
?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ??
|
||||
?? 48 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? E8 ?? ??
|
||||
?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 35 ?? ?? ?? ?? 48 83 EC ?? 48 8B 45
|
||||
?? 6A ?? 41 B9 ?? ?? ?? ?? 41 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? 48 89 C7
|
||||
E8 ?? ?? ?? ?? 48 83 C4 ?? 48 8B 15 ?? ?? ?? ?? 48 8B 45 ?? 48 89 D6 48 89 C7 E8 ??
|
||||
?? ?? ?? 48 8B 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ??
|
||||
?? ?? 48 98 48 89 45 ?? 48 8B 45 ?? B9 ?? ?? ?? ?? BA ?? ?? ?? ?? BE ?? ?? ?? ?? 48
|
||||
}
|
||||
|
||||
$main_call_p2 = {
|
||||
89 C7 E8 ?? ?? ?? ?? 48 98 48 89 45 ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ??
|
||||
?? 48 89 45 ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45
|
||||
?? 89 C2 48 8B 4D ?? 48 8B 45 ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 89 C2
|
||||
48 8B 4D ?? 48 8B 45 ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ?? 48 8B 55 ?? 48 8B 45 ?? 48
|
||||
01 D0 C6 00 ?? 48 8B 55 ?? 48 8B 45 ?? 48 01 D0 C6 00 ?? 48 8B 45 ?? 48 8B 55 ?? 48
|
||||
89 D6 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? ?? 75 ?? BF ?? ?? ?? ?? E8 ??
|
||||
?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ??
|
||||
?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? B8
|
||||
?? ?? ?? ?? E9 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 45 ??
|
||||
48 83 7D ?? ?? 74 ?? 48 8B 55 ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8
|
||||
}
|
||||
|
||||
$main_call_p3 = {
|
||||
E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 79 ?? 48 8B 45 ?? 89 C7 E8 ?? ?? ?? ?? B8 ?? ??
|
||||
?? ?? E9 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 89 C7 E8 ?? ??
|
||||
?? ?? 48 C7 45 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 45
|
||||
?? 48 83 7D ?? ?? 74 ?? EB ?? BF ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
|
||||
?? ?? 48 8B 55 ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
|
||||
89 45 ?? 83 7D ?? ?? 79 ?? 48 8B 45 ?? 89 C7 E8 ?? ?? ?? ?? EB ?? 48 8B 45 ?? 48 89
|
||||
C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 89 C7 E8 ?? ?? ?? ?? EB ?? BF ?? ?? ?? ?? E8 ?? ?? ??
|
||||
?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ??
|
||||
?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 48 98 48 8B 84
|
||||
C5 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 48 98
|
||||
48 8B 84 C5 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 83 45 ?? ?? 83 7D ?? ?? 74 ?? BF ??
|
||||
?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8
|
||||
?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? C9 C3
|
||||
}
|
||||
|
||||
$encrypt_files_p1 = {
|
||||
55 48 89 E5 53 48 81 EC ?? ?? ?? ?? 48 89 BD ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? BA ??
|
||||
?? ?? ?? B9 ?? ?? ?? ?? 48 89 C7 48 89 D6 F3 48 A5 48 89 F2 48 89 F8 0F B7 0A 66 89
|
||||
08 48 8D 40 ?? 48 8D 52 ?? 48 C7 45 ?? ?? ?? ?? ?? 48 C7 85 ?? ?? ?? ?? ?? ?? ?? ??
|
||||
48 C7 45 ?? ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 48 89 D7
|
||||
F3 48 AB 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? ?? 75
|
||||
?? 48 8B 85 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ??
|
||||
?? ?? ?? E9 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8D 85 ?? ?? ?? ?? 48 89 D6 48 89 C7
|
||||
E8 ?? ?? ?? ?? 48 8B 45 ?? 0F B6 40 ?? 3C ?? 0F 85 ?? ?? ?? ?? 48 8B 85 ?? ?? ?? ??
|
||||
48 89 C7 E8 ?? ?? ?? ?? 48 89 C3 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48
|
||||
01 D8 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 85 ?? ?? ?? ?? BE ?? ??
|
||||
?? ?? 48 89 C7 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8B 45 ?? 48 8D 48 ?? 48 8B 95 ?? ?? ??
|
||||
?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB ?? 48 8B 45
|
||||
?? 48 8D 48 ?? 48 8B 95 ?? ?? ?? ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ??
|
||||
?? E8 ?? ?? ?? ?? 48 8D 95 ?? ?? ?? ?? 48 8B 4D ?? 48 8D 85 ?? ?? ?? ?? 48 89 CE 48
|
||||
89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? EB ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 C7 E8 ?? ?? ??
|
||||
?? 48 89 C2 48 8B 45 ?? 48 89 C6 48 89 D7 E8 ?? ?? ?? ?? 85 C0 75 ?? 48 8B 45 ?? 48
|
||||
}
|
||||
|
||||
$encrypt_files_p2 = {
|
||||
89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ??
|
||||
?? EB ?? 48 8D 95 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C6 BF ?? ?? ?? ?? E8 ?? ?? ?? ?? 48
|
||||
89 45 ?? 48 83 7D ?? ?? 75 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 48
|
||||
8B 45 ?? 0F B6 40 ?? 3C ?? 0F 85 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C0 ?? BE ?? ?? ?? ??
|
||||
48 89 C7 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C0 ?? BE ?? ?? ??
|
||||
?? 48 89 C7 E8 ?? ?? ?? ?? 85 C0 0F 84 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C0 ?? 48 89 45
|
||||
?? 48 8B 85 ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C3 48 8B 45 ?? 48 89 C7 E8 ??
|
||||
?? ?? ?? 48 01 D8 48 83 C0 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 85 ?? ?? ??
|
||||
?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 84 C0 74 ?? 48 8B 45 ?? 48 8D 48 ?? 48 8B
|
||||
95 ?? ?? ?? ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EB
|
||||
?? 48 8B 45 ?? 48 8D 48 ?? 48 8B 95 ?? ?? ?? ?? 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7
|
||||
B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89
|
||||
C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 83 7D ?? ?? 0F
|
||||
85 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 81 C4 ?? ?? ?? ?? 5B 5D C3
|
||||
}
|
||||
|
||||
$encrypt_internal_message_p1 = {
|
||||
55 48 89 E5 53 48 83 EC ?? 48 89 7D ?? 48 89 75 ?? 48 C7 45 ?? ?? ?? ?? ?? BF ?? ??
|
||||
?? ?? E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 89 45 ?? 48 8B
|
||||
45 ?? 48 89 C7 E8 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 83 C0 ?? 48 98 48 89 C7 E8 ?? ?? ??
|
||||
?? 48 89 45 ?? 8B 45 ?? 83 C0 ?? 48 63 D0 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ??
|
||||
?? ?? ?? 8B 45 ?? 48 63 D0 48 8B 4D ?? 48 8B 45 ?? 48 89 CE 48 89 C7 E8 ?? ?? ?? ??
|
||||
8B 45 ?? 48 98 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? C7 45 ?? ?? ?? ?? ?? C7 45 ?? ??
|
||||
?? ?? ?? 8B 45 ?? 83 E8 ?? 89 45 ?? C7 45 ?? ?? ?? ?? ?? 66 0F EF C0 F2 0F 2A 45 ??
|
||||
66 0F EF C9 F2 0F 2A 4D ?? F2 0F 5E C1 E8 ?? ?? ?? ?? F2 0F 2C C0 89 45 ?? 8B 45 ??
|
||||
0F AF 45 ?? 48 98 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 8B 45 ?? 0F AF 45 ?? 48 63 D0
|
||||
48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 45 ?? 0F AF 45 ?? 89 C3 48 8B
|
||||
45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C6 8B 45 ?? 89 C1 89 DA BF ?? ?? ?? ?? B8 ?? ??
|
||||
?? ?? E8 ?? ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 48 C7 45 ?? ?? ?? ?? ?? C7 45 ?? ?? ?? ??
|
||||
?? E9 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? 3B 45 ?? 7D ?? 8B 45 ?? 2B 45 ?? 89 45 ?? 8B 45
|
||||
?? 48 63 D0 48 8B 45 ?? BE ?? ?? ?? ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 45 ?? 2B 45 ?? 89
|
||||
}
|
||||
|
||||
$encrypt_internal_message_p2 = {
|
||||
C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 48 63 D0 48 8B 45 ?? 48 8D
|
||||
34 02 48 8B 4D ?? 48 8B 55 ?? 8B 45 ?? 41 B8 ?? ?? ?? ?? 89 C7 E8 ?? ?? ?? ?? 89 45
|
||||
?? 8B 45 ?? 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 7D ?? ?? 75 ?? E8
|
||||
?? ?? ?? ?? E8 ?? ?? ?? ?? 48 89 C2 48 8B 45 ?? 48 89 C6 48 89 D7 E8 ?? ?? ?? ?? 48
|
||||
8B 05 ?? ?? ?? ?? 48 8B 55 ?? BE ?? ?? ?? ?? 48 89 C7 B8 ?? ?? ?? ?? E8 ?? ?? ?? ??
|
||||
48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ??
|
||||
48 89 C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E9 ?? ??
|
||||
?? ?? 8B 45 ?? 48 63 D0 8B 45 ?? 48 63 C8 48 8B 45 ?? 48 01 C1 48 8B 45 ?? 48 89 C6
|
||||
48 89 CF E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 48 89 C6 BF ?? ?? ?? ??
|
||||
B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 01 45 ?? 8B 45 ?? 01 45 ?? 48 8B 45 ?? 48 89
|
||||
C7 E8 ?? ?? ?? ?? 83 45 ?? ?? 8B 45 ?? 3B 45 ?? 0F 8E ?? ?? ?? ?? 48 8B 45 ?? 48 89
|
||||
C7 E8 ?? ?? ?? ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ?? 8B 4D ?? 48 8B 45 ?? BA ?? ??
|
||||
?? ?? 89 CE 48 89 C7 E8 ?? ?? ?? ?? 48 89 45 ?? 48 8B 45 ?? 48 89 C7 E8 ?? ?? ?? ??
|
||||
48 89 C6 BF ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 48 8B 45 ?? 48 83 C4 ?? 5B 5D
|
||||
C3
|
||||
}
|
||||
|
||||
condition:
|
||||
uint32(0) == 0x464C457F and
|
||||
(
|
||||
all of ($main_call_p*)
|
||||
) and
|
||||
(
|
||||
all of ($encrypt_files_p*)
|
||||
) and
|
||||
(
|
||||
all of ($encrypt_internal_message_p*)
|
||||
)
|
||||
}
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_5ss5c : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "5SS5C"
|
||||
description = "Yara rule that detects 5ss5c ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_ASN1Encoder : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "ASN1ENCODER"
|
||||
description = "Yara rule that detects ASN1Encoder ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Afrodita : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "AFRODITA"
|
||||
description = "Yara rule that detects Afrodita ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Ako : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "AKO"
|
||||
description = "Yara rule that detects Ako ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -10,6 +10,7 @@ rule Win32_Ransomware_Archiveus : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "ARCHIVEUS"
|
||||
description = "Yara rule that detects Archiveus ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Armage : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "ARMAGE"
|
||||
description = "Yara rule that detects Armage ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Atlas : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "ATLAS"
|
||||
description = "Yara rule that detects Atlas ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_BKRansomware : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "BKRANSOMWARE"
|
||||
description = "Yara rule that detects BKRansomware ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_BadBlock : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "BADBLOCK"
|
||||
description = "Yara rule that detects BadBlock ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_BandarChor : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "BANDARCHOR"
|
||||
description = "Yara rule that detects BandarChor ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -10,6 +10,7 @@ rule Win32_Ransomware_BitCrypt : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "BITCRYPT"
|
||||
description = "Yara rule that detects BitCrypt ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Blitzkrieg : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "BLITZKRIEG"
|
||||
description = "Yara rule that detects Blitzkrieg ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_BrainCrypt : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "BRAINCRYPT"
|
||||
description = "Yara rule that detects BrainCrypt ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Buran : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "BURAN"
|
||||
description = "Yara rule that detects Buran ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Clop : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CLOP"
|
||||
description = "Yara rule that detects Clop ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Cryakl : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CRYAKL"
|
||||
description = "Yara rule that detects Cryakl ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Crypmic : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CRYPMIC"
|
||||
description = "Yara rule that detects Crypmic ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Crypren : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CRYPREN"
|
||||
description = "Yara rule that detects Crypren ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_CryptoBit : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CRYPTOBIT"
|
||||
description = "Yara rule that detects CryptoBit ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_CryptoFortress : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CRYPTOFORTRESS"
|
||||
description = "Yara rule that detects CryptoFortress ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_CryptoJoker : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CRYPTOJOKER"
|
||||
description = "Yara rule that detects CryptoJoker ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -10,6 +10,7 @@ rule Win32_Ransomware_CryptoLocker : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CRYPTOLOCKER"
|
||||
description = "Yara rule that detects CryptoLocker ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -10,6 +10,7 @@ rule Win32_Ransomware_CryptoWall : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CRYPTOWALL"
|
||||
description = "Yara rule that detects CryptoWall ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Crysis : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CRYSIS"
|
||||
description = "Yara rule that detects Crysis ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Cuba : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "CUBA"
|
||||
description = "Yara rule that detects Cuba ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_DMALocker : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "DMALOCKER"
|
||||
description = "Yara rule that detects DMALocker ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_DMR : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "DMR"
|
||||
description = "Yara rule that detects DMR ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Defray : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "DEFRAY"
|
||||
description = "Yara rule that detects Defray ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Delphimorix : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "DELPHIMORIX"
|
||||
description = "Yara rule that detects Delphimorix ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_DenizKizi : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "DENIZKIZI"
|
||||
description = "Yara rule that detects DenizKizi ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_DesuCrypt : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "DESUCRYPT"
|
||||
description = "Yara rule that detects DesuCrypt ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Dharma : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "DHARMA"
|
||||
description = "Yara rule that detects Dharma ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -10,6 +10,7 @@ rule Win32_Ransomware_DirtyDecrypt : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "DIRTYDECRYPT"
|
||||
description = "Yara rule that detects DirtyDecrypt ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_District : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "DISTRICT"
|
||||
description = "Yara rule that detects District ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Erica : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "ERICA"
|
||||
description = "Yara rule that detects Erica ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_FCT : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "FCT"
|
||||
description = "Yara rule that detects FCT ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_FLKR : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "FLKR"
|
||||
description = "Yara rule that detects FLKR ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Fantom : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "FANTOM"
|
||||
description = "Yara rule that detects Fantom ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_FenixLocker : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "FENIXLOCKER"
|
||||
description = "Yara rule that detects FenixLocker ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Ferrlock : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "FERRLOCK"
|
||||
description = "Yara rule that detects Ferrlock ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -0,0 +1,83 @@
|
||||
rule Win32_Ransomware_GPGQwerty : tc_detection malicious
|
||||
{
|
||||
meta:
|
||||
|
||||
author = "ReversingLabs"
|
||||
|
||||
source = "ReversingLabs"
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "GPGQWERTY"
|
||||
description = "Yara rule that detects GPGQwerty ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
tc_detection_name = "GPGQwerty"
|
||||
tc_detection_factor = 5
|
||||
|
||||
strings:
|
||||
|
||||
$find_files_p1 = {
|
||||
56 53 89 D3 81 EC ?? ?? ?? ?? 8D 54 24 ?? 89 04 24 89 54 24 ?? E8 ?? ?? ?? ?? 83 EC
|
||||
?? 83 F8 ?? 89 C6 74 ?? 31 C0 8D 4B ?? 66 89 43 ?? 31 C0 EB ?? 0F B7 43 ?? 83 C0 ??
|
||||
66 3D ?? ?? 66 89 43 ?? 83 D1 ?? 0F B7 C0 0F B6 44 04 ?? 84 C0 88 01 75 ?? 8B 44 24
|
||||
?? 24 ?? 83 F8 ?? 76 ?? C7 43 ?? ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 89 F0 5B 5E C3 66 90
|
||||
89 43 ?? 81 C4 ?? ?? ?? ?? 89 F0 5B 5E C3 E8 ?? ?? ?? ?? 89 C3 E8 ?? ?? ?? ?? 83 F8
|
||||
?? 89 03 74 ?? E8 ?? ?? ?? ?? 81 38 ?? ?? ?? ?? 74 ?? E8 ?? ?? ?? ?? 83 38 ?? 74 ??
|
||||
E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? EB ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? EB ?? E8 ??
|
||||
?? ?? ?? C7 00 ?? ?? ?? ?? EB ?? 90 56 53 89 D3 81 EC ?? ?? ?? ?? 8D 54 24 ?? 89 04
|
||||
24 89 54 24 ?? E8 ?? ?? ?? ?? 83 EC ?? 85 C0 89 C6 74 ?? 31 C0 8D 4B ?? 66 89 43 ??
|
||||
31 C0 EB ?? 0F B7 43 ?? 83 C0 ?? 66 3D ?? ?? 66 89 43 ?? 83 D1 ?? 0F B7 C0 0F B6 44
|
||||
04 ?? 84 C0 88 01 75 ?? 8B 44 24 ?? 24 ?? 83 F8 ?? 77 ?? 89 43 ?? 81 C4 ?? ?? ?? ??
|
||||
89 F0 5B 5E C3 8D B4 26 ?? ?? ?? ?? C7 43 ?? ?? ?? ?? ?? 81 C4 ?? ?? ?? ?? 89 F0 5B
|
||||
5E C3 E8 ?? ?? ?? ?? 83 F8 ?? 74 ?? E8 ?? ?? ?? ?? C7 00 ?? ?? ?? ?? 81 C4 ?? ?? ??
|
||||
?? 89 F0 5B 5E C3
|
||||
}
|
||||
|
||||
$find_files_p2 = {
|
||||
8B 45 ?? 89 45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 89 45 ?? 83 7D ?? ?? 0F 95 C0 84
|
||||
C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ??
|
||||
?? 85 C0 74 ?? 8B 45 ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85
|
||||
C0 74 ?? C6 85 ?? ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ??
|
||||
?? ?? ?? 8B 45 ?? 83 C0 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 8D
|
||||
85 ?? ?? ?? ?? 89 45 ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 94 C0 84 C0 0F 84
|
||||
?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ??
|
||||
?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
|
||||
?? ?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ??
|
||||
?? C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
|
||||
C7 44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7
|
||||
44 24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44
|
||||
24 ?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? C7 44 24
|
||||
?? ?? ?? ?? ?? 8B 45 ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45 ?? 83
|
||||
C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ?? 8B 45
|
||||
?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ?? ?? ??
|
||||
8B 45 ?? 83 C0 ?? C7 44 24 ?? ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? 85 C0 0F 85 ?? ??
|
||||
?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E8
|
||||
}
|
||||
|
||||
$encrypt_files = {
|
||||
C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ??
|
||||
C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 83
|
||||
C0 ?? 89 44 24 ?? 8B 45 ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ??
|
||||
E8 ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24
|
||||
?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? C7 44
|
||||
24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ??
|
||||
?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7
|
||||
04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89 44
|
||||
24 ?? 8D 85 ?? ?? ?? ?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8
|
||||
?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? 89 44 24 ?? 8D 85 ?? ?? ??
|
||||
?? 89 44 24 ?? C7 44 24 ?? ?? ?? ?? ?? C7 04 24 ?? ?? ?? ?? E8 ?? ?? ?? ?? C7 04 24
|
||||
?? ?? ?? ?? E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? B9 ?? ?? ?? ?? 89 C2 B8
|
||||
?? ?? ?? ?? 89 D7 F2 AE 89 C8 F7 D0 8D 50 ?? 8D 85 ?? ?? ?? ?? 01 D0 66 C7 00 ?? ??
|
||||
8B 45 ?? 83 E8 ?? 89 44 24 ?? 8D 85 ?? ?? ?? ?? 89 04 24 E8 ?? ?? ?? ?? E9
|
||||
}
|
||||
|
||||
condition:
|
||||
uint16(0) == 0x5A4D and
|
||||
(
|
||||
all of ($find_files_p*)
|
||||
) and
|
||||
(
|
||||
$encrypt_files
|
||||
)
|
||||
}
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_GandCrab : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "GANDCRAB"
|
||||
description = "Yara rule that detects GandCrab ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_GarrantyDecrypt : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "GARRANTYDECRYPT"
|
||||
description = "Yara rule that detects GarrantyDecrypt ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Gibon : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "GIBON"
|
||||
description = "Yara rule that detects Gibon ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_GlobeImposter : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "GLOBEIMPOSTER"
|
||||
description = "Yara rule that detects GlobeImposter ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Good : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "GOOD"
|
||||
description = "Yara rule that detects Good ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_GPCode : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "GPCODE"
|
||||
description = "Yara rule that detects Gpcode ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_HDDCryptor : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "HDDCRYPTOR"
|
||||
description = "Yara rule that detects HDDCryptor ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_HDMR : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "HDMR"
|
||||
description = "Yara rule that detects HDMR ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Hermes : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "HERMES"
|
||||
description = "Yara rule that detects Hermes ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_HydraCrypt : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "HYDRACRYPT"
|
||||
description = "Yara rule that detects HydraCrypt ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_IFN643 : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "IFN643"
|
||||
description = "Yara rule that detects IFN643 ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_JSWorm : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "JSWORM"
|
||||
description = "Yara rule that detects JSWorm ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Jamper : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "JAMPER"
|
||||
description = "Yara rule that detects Jamper ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Jemd : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "JEMD"
|
||||
description = "Yara rule that detects Jemd ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Kangaroo : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "KANGAROO"
|
||||
description = "Yara rule that detects Kangaroo ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_KillDisk : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "KILLDISK"
|
||||
description = "Yara rule that detects KillDisk ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Kovter : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "KOVTER"
|
||||
description = "Yara rule that detects Kovter ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Linux_Ransomware_Kraken : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "KRAKEN"
|
||||
description = "Yara rule that detects Kraken ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Ladon : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "LADON"
|
||||
description = "Yara rule that detects Ladon ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_LeChiffre : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "LECHIFFRE"
|
||||
description = "Yara rule that detects LeChiffre ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_LockBit : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "LOCKBIT"
|
||||
description = "Yara rule that detects LockBit ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_LooCipher : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "LOOCIPHER"
|
||||
description = "Yara rule that detects LooCipher ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_MZP : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "MZP"
|
||||
description = "Yara rule that detects MZP ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Mafia : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "MAFIA"
|
||||
description = "Yara rule that detects Mafia ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Magniber : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "MAGNIBER"
|
||||
description = "Yara rule that detects Magniber ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Maktub : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "MAKTUB"
|
||||
description = "Yara rule that detects Maktub ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_MarsJoke : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "MARSJOKE"
|
||||
description = "Yara rule that detects MarsJoke ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Matsnu : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "MATSNU"
|
||||
description = "Yara rule that detects Matsnu ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_MedusaLocker : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "MEDUSALOCKER"
|
||||
description = "Yara rule that detects MedusaLocker ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Montserrat : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "MONTSERRAT"
|
||||
description = "Yara rule that detects Montserrat ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_NanoLocker : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "NANOLOCKER"
|
||||
description = "Yara rule that detects NanoLocker ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Nefilim : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "NEFILIM"
|
||||
description = "Yara rule that detects Nefilim ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Nemty : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "NEMTY"
|
||||
description = "Yara rule that detects Nemty ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -9,6 +9,7 @@ rule Win32_Ransomware_NotPetya : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "NOTPETYA"
|
||||
description = "Yara rule that detects NotPetya ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_OphionLocker : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "OPHIONLOCKER"
|
||||
description = "Yara rule that detects OphionLocker ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Ouroboros : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "OUROBOROS"
|
||||
description = "Yara rule that detects Ouroboros ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_PXJ : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "PXJ"
|
||||
description = "Yara rule that detects PXJ ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Pacman : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "PACMAN"
|
||||
description = "Yara rule that detects Pacman ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Paradise : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "PARADISE"
|
||||
description = "Yara rule that detects Paradise ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -11,6 +11,7 @@ rule Win32_Ransomware_Petya : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "PETYA"
|
||||
description = "Yara rule that detects Petya ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_PrincessLocker : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "PRINCESSLOCKER"
|
||||
description = "Yara rule that detects PrincessLocker ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_RagnarLocker : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "RAGNARLOCKER"
|
||||
description = "Yara rule that detects RagnarLocker ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Ragnarok : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "RAGNAROK"
|
||||
description = "Yara rule that detects Ragnarok ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Ransoc : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "RANSOC"
|
||||
description = "Yara rule that detects Ransoc ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_RansomPlus : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "RANSOMPLUS"
|
||||
description = "Yara rule that detects RansomPlus ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_RetMyData : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "RETMYDATA"
|
||||
description = "Yara rule that detects RetMyData ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Retis : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "RETIS"
|
||||
description = "Yara rule that detects Retis ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Reveton : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "REVETON"
|
||||
description = "Yara rule that detects Reveton ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Revil : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "REVIL"
|
||||
description = "Yara rule that detects Revil ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Rokku : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "ROKKU"
|
||||
description = "Yara rule that detects Rokku ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Ryuk : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "RYUK"
|
||||
description = "Yara rule that detects Ryuk ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Sage : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "SAGE"
|
||||
description = "Yara rule that detects Sage ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Satan : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "SATAN"
|
||||
description = "Yara rule that detects Satan ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
@@ -8,6 +8,7 @@ rule Win32_Ransomware_Satana : tc_detection malicious
|
||||
status = "RELEASED"
|
||||
sharing = "TLP:WHITE"
|
||||
category = "MALWARE"
|
||||
malware = "SATANA"
|
||||
description = "Yara rule that detects Satana ransomware."
|
||||
|
||||
tc_detection_type = "Ransomware"
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user