YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1

Detects Lazarus VHD Ransomware

APT / threat actorVhd RansomwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2020-10-05
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects Lazarus VHD Ransomware

Associated malware family: Vhd Ransomware.

Targets: Windows PE.

It defines 6 patterns (3 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-mal-nk-lazarus-vhd-ransomware-oct20-1.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1 : FILE
{
	meta:
		description = "Detects Lazarus VHD Ransomware"
		author = "Florian Roth (Nextron Systems)"
		id = "5cb3c136-ec5c-5596-8dcc-e4c6ef33050a"
		date = "2020-10-05"
		modified = "2023-12-05"
		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_vhd_ransomware.yar#L2-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6"
		hash = "5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473"
		hash = "6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306"
		logic_hash = "95c56c5111bb227da8f8a3f8aa4f23e1348bc76ff76a05fc3cae89f9fad1bb52"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "HowToDecrypt.txt" wide fullword
		$s2 = "rsa.cpp" wide fullword
		$s3 = "sc stop \"Microsoft Exchange Compliance Service\"" ascii fullword
		$op1 = { 8b 8d bc fc ff ff 8b 94 bd 34 03 00 00 33 c0 50 }
		$op2 = { 8b 8d 98 f9 ff ff 8d 64 24 00 8b 39 3b bc 85 34 }
		$op3 = { 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them
}

Strings (6 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"HowToDecrypt.txt"	wide fullword
$s2	text	"rsa.cpp"	wide fullword
$s3	text	"sc stop \"Microsoft Exchange Compliance Service\""	ascii fullword
$op1	hex	{ 8b 8d bc fc ff ff 8b 94 bd 34 03 00 00 33 c0 50 }
$op2	hex	{ 8b 8d 98 f9 ff ff 8d 64 24 00 8b 39 3b bc 85 34 }
$op3	hex	{ 8b 94 85 34 03 00 00 89 11 40 83 c1 04 3b 06 7c }

Condition

uint16( 0 ) == 0x5a4d and filesize < 400KB and 2 of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 400KB (a cheap guard that skips large files).
At least 2 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

52888b5f881f4941ae7a8f4d84de27fc502413861f96ee58ee560c09c11880d6
5e78475d10418c6938723f6cfefb89d5e9de61e45ecf374bb435c1c99dd4a473
6cb9afff8166976bd62bb29b12ed617784d6e74b110afcf8955477573594f306

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 5cb3c136-ec5c-5596-8dcc-e4c6ef33050a

Tags:FILE

SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-05
SEKOIA_Apt_Lazarus_Vhd_Ransomware_Downloader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-11-28
SEKOIA_Apt_Lazarus_Vhd_Ransomware_Loader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-11-28
MALPEDIA_Win_Vhd_Ransomware_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31

More Vhd Ransomware rules