Skip to content
yararules.org
Menu

YARA · Arkbird SOLG (DailyIOC)

ARKBIRD_SOLG_RAN_Medusalocker_Aug_2021_1

Detect MedusaLocker ransomware

MalwareMedusalockerArkbird SOLG (DailyIOC)No licence (all rights reserved)Compiles with YARA-X (with warnings)
Author
Arkbird_SOLG
Date
2021-08-08
Score / Quality
75 / 73

What this rule detects

Detect MedusaLocker ransomware

Associated malware family: Medusalocker.

Targets: Windows PE.

It defines 10 patterns (2 text, 8 hex, 0 regex).

YARA-X says: warning[text_as_hex]: hex pattern could be written as text literal

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from Arkbird SOLG (DailyIOC), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHubOpen the repository

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 4f9a833e79092006c06203a66b41fc9250bcebcee148fea404db75d52035131c
  • 212e7f5ed4a581b4d778dfef226738c6db56b4b4006526259392d03062587887
  • a25c0227728878c386ab6dba139976cb10e853dd3cd1eb3623f236ee8e1df212
  • c2a0a317d73c96428ab088a8f0636ec4ccace7ca691c84ed66a83a70183f40dc
  • 0abb4a302819cdca6c9f56893ca2b52856b55a0aa68a3cb8bdcd55dcc1fad9ad
  • f5fb7fa5231c18f0951c755c4cb0ec07b0889b5e320f42213cbf6bbbe499ad31

Licence & attribution

Author: Arkbird_SOLG

Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298

Licence: No licence (all rights reserved) (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 9e647371-b37a-53af-bfb6-cde72855b564

Metadata

tlpwhite
adversaryRaaS

Tags:FILE

Related rules

More Medusalocker rules