Skip to content
yararules.org
Menu

YARA · Arkbird SOLG (DailyIOC)

ARKBIRD_SOLG_Ran_Ranzy_Locker_Nov_2020_1

Detect Ranzy Locker (RAAS)

MalwareRanzylockerArkbird SOLG (DailyIOC)No licence (all rights reserved)Compiles with YARA-X (with warnings)
Author
Arkbird_SOLG
Date
2020-11-19
Score / Quality
75 / 75

What this rule detects

Detect Ranzy Locker (RAAS)

Associated malware family: Ranzylocker.

Targets: Windows PE.

It defines 20 patterns (18 text, 2 hex, 0 regex).

YARA-X says: warning[unintended_pattern_in_set]: pattern `$seq1` may be unintendedly or redundantly included in pattern set `$s*`

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from Arkbird SOLG (DailyIOC), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHubOpen the repository

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 393fd0768b24cd76ca653af3eba9bff93c6740a2669b30cf59f8a064c46437a2
  • 90691a36d1556ba7a77d0216f730d6cd9a9063e71626489094313c0afe85a939
  • ade5d0fe2679fb8af652e14c40e099e0c1aaea950c25165cebb1550e33579a79
  • bbf122cce1176b041648c4e772b230ec49ed11396270f54ad2c5956113caf7b7
  • c4f72b292750e9332b1f1b9761d5aefc07301bc15edf31adeaf2e608000ec1c9

Licence & attribution

Author: Arkbird_SOLG

Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298

Licence: No licence (all rights reserved) (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 7e81d73a-ef18-5f89-b6b3-f56212d30b4a

Tags:FILE

Related rules

More Ranzylocker rules