mirror of
https://github.com/valitydev/signature-base.git
synced 2024-11-07 02:25:19 +00:00
21 lines
548 B
Plaintext
21 lines
548 B
Plaintext
|
/*
|
||
|
|
Yara Rule Set
|
||
|
|
Author: Florian Roth
|
||
|
|
Date: 2016-02-17
|
||
|
|
Identifier: Locky
|
||
|
|
*/
|
||
|
|
|
||
|
|
rule Locky_Ransomware {
|
||
|
|
meta:
|
||
|
|
description = "Detects Locky Ransomware (matches also on Win32/Kuluoz)"
|
||
|
|
author = "Florian Roth (with the help of binar.ly)"
|
||
|
|
reference = "https://goo.gl/qScSrE"
|
||
|
|
date = "2016-02-17"
|
||
|
|
hash = "5e945c1d27c9ad77a2b63ae10af46aee7d29a6a43605a9bfbf35cebbcff184d8"
|
||
|
|
strings:
|
||
|
|
$o1 = { 45 b8 99 f7 f9 0f af 45 b8 89 45 b8 } // address=0x4144a7
|
||
|
|
$o2 = { 2b 0a 0f af 4d f8 89 4d f8 c7 45 } // address=0x413863
|
||
|
|
condition:
|
||
|
|
all of ($o*)
|
||
|
|
}
|