YARA · SecuInfra Falcon Team
SECUINFRA_RANSOM_Magniber_LNK_Jan23
Detects Magniber Ransomware LNK files from fake Windows Update delivery method
- Author
- SECUINFRA Falcon Team
- Date
- 2023-01-13
- Score / Quality
- 75 / 70
What this rule detects
Detects Magniber Ransomware LNK files from fake Windows Update delivery method
Associated malware family: Magniber.
It defines 2 patterns (1 text, 1 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from SecuInfra Falcon Team, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- 16ecec4efa2174dec11f6a295779f905c8f593ab5cc96ae0f5249dc50469841c
Licence & attribution
Author: SECUINFRA Falcon Team
Source repository: SecuInfra Falcon Team @ 2d7c66d7d1
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 2459a9e9-a6bb-50fc-9920-7632fdec7e91
Metadata
| tlp | CLEAR |
|---|
Related rules
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
- SECUINFRA_DROPPER_Njrat_VBSMetadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-27
- SECUINFRA_DROPPER_WSHRAT_Stage_1Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-11-02
- SECUINFRA_MALWARE_Formbook_Filename_Stage_2Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-19
- SECUINFRA_OBFUS_Javascript_Wscript_Hex_Strings_UsageMetadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-12-02
- SECUINFRA_DROPPER_Asyncrat_VBS_February_2022_1Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-21
- SECUINFRA_DROPPER_Valyria_Stage_1Metadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-02-18
- SECUINFRA_MAL_Nw0RmMetadata onlyMalwareSecuInfra Falcon Team· SECUINFRA Falcon Team· 2022-03-02