Skip to content
yararules.org
Menu

YARA · Cado Security (via Open-Source-YARA-rules)

CADOSECURITY_Linux_Wiper_SOLOSHRED

Detects SOLOSHRED wiper used against Ukrainian ICS

MalwareCado Security (via Open-Source-YARA-rules)Apache License 2.0Compiles with YARA-X
Author
mmuir@cadosecurity.com
Date
2022-04-12
Modified
2022-07-06
Score / Quality
75 / 80

What this rule detects

Detects SOLOSHRED wiper used against Ukrainian ICS

It defines 5 patterns (5 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
linux-wiper-soloshred.yarApache License 2.0
rule CADOSECURITY_Linux_Wiper_SOLOSHRED
{
	meta:
		description = "Detects SOLOSHRED wiper used against Ukrainian ICS"
		author = "mmuir@cadosecurity.com"
		id = "1772a047-6b67-5d6c-9f82-0be0b49967ac"
		date = "2022-04-12"
		modified = "2022-07-06"
		reference = "https://github.com/cado-security/DFIR_Resources_Industroyer2"
		source_url = "https://github.com/mikesxrs/Open-Source-YARA-rules/blob/ec0056f767db98bf6d5fd63877ad51fb54d350e9/Cado Security/Linux_Wiper_SOLOSHRED.yar#L1-L17"
		license_url = "N/A"
		hash = "87ca2b130a8ec91d0c9c0366b419a0fce3cb6a935523d900918e634564b88028"
		logic_hash = "bc3e574406c635922c278723f6eebd97562123b42b372d2b023fd6f433581e8d"
		score = 75
		quality = 80
		tags = ""
		license = "Apache License 2.0"

	strings:
		$a = "printenv | grep -i \"ora\"" ascii
		$b = "shred" ascii
		$c = "--no-preserve-root" ascii
		$d = "/dev/dsk" ascii
		$e = "$(ls /)" ascii

	condition:
		all of them
}

Strings (5 patterns)

IdentifierTypeValueModifiers
$atext"printenv | grep -i \"ora\""ascii
$btext"shred"ascii
$ctext"--no-preserve-root"ascii
$dtext"/dev/dsk"ascii
$etext"$(ls /)"ascii

Condition

all of them

In plain words (Heuristic)

  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 87ca2b130a8ec91d0c9c0366b419a0fce3cb6a935523d900918e634564b88028

Licence & attribution

Author: mmuir@cadosecurity.com

Source repository: Cado Security (via Open-Source-YARA-rules) @ ec0056f767

Licence: Apache License 2.0 (stated in the rule's own meta)

“Apache License 2.0”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 1772a047-6b67-5d6c-9f82-0be0b49967ac

Related rules