Skip to content
yararules.org
Menu

YARA · Arkbird SOLG (DailyIOC)

ARKBIRD_SOLG_Ran_Ruyk_Oct_2020_1

Detect RYUK ransomware (Sept_2020_V1)

MalwareArkbird SOLG (DailyIOC)No licence (all rights reserved)Compiles with YARA-X (with warnings)
Author
Arkbird_SOLG
Date
2020-10-25
Modified
2020-10-27
Score / Quality
75 / 75

What this rule detects

Detect RYUK ransomware (Sept_2020_V1)

Targets: Windows PE.

It defines 16 patterns (16 text, 0 hex, 0 regex).

YARA-X says: warning[unintended_pattern_in_set]: pattern `$ref1` may be unintendedly or redundantly included in pattern set `$r*`

Summary generated from the rule's metadata and condition.

Rule source

Rule text not reproduced

This rule comes from Arkbird SOLG (DailyIOC), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:

View the rule on GitHubOpen the repository

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • bbbf38de4f40754f235441a8e6a4c8bdb9365dab7f5cfcdac77dbb4d6236360b
  • cfe1678a7f2b949966d9a020faafb46662584f8a6ac4b72583a21fa858f2a2e8
  • e8a0e80dfc520bf7e76c33a90ed6d286e8729e9defe6bb7da2f38bc2db33f399

Licence & attribution

Author: Arkbird_SOLG

Source repository: Arkbird SOLG (DailyIOC) @ a873ff1298

Licence: No licence (all rights reserved) (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 7ade43ef-cd31-5308-b5ab-71f04d27018b

Tags:FILE

Related rules