YARA · Arkbird SOLG (DailyIOC)

ARKBIRD_SOLG_RAN_ELF_Revil_Jun_2021_1

Detect the ELF version of REvil ransomware

What this rule detects

Detect the ELF version of REvil ransomware

Associated malware family: Revil.

Targets: Linux ELF.

It defines 4 patterns (0 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule text not reproduced

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

Author: Arkbird_SOLG

Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: b4b9d60e-a352-5045-8be3-e9a08d70ef6b

tlp	White
adversary	RAAS

Tags:FILE

SIGNATURE_BASE_MAL_RANSOM_Revil_Oct20_1
MalwareSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-13
MALPEDIA_Win_Revil_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SEKOIA_Loader_Win_Revil_Loader
MalwareSEKOIA.IO Community· Sekoia.io· 2021-07-19
SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-07-02
SIGNATURE_BASE_APT_MAL_Revil_Kaseya_Jul21_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2021-07-02
ARKBIRD_SOLG_MAL_Bazarloader_Oct_2021_1Metadata only
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-10-30
ARKBIRD_SOLG_MAL_Beacon_Vermilion_Strike_Sep_2021_1Metadata only
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-09-14
ARKBIRD_SOLG_MAL_Cadelspy_Stealer_May_2021_1Metadata only
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-05-30