YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2

Detects Lazarus VHD Ransomware

APT / threat actorVhd RansomwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Florian Roth (Nextron Systems)
Date: 2020-10-05
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detects Lazarus VHD Ransomware

Associated malware family: Vhd Ransomware.

Targets: Windows PE.

It defines 3 patterns (0 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

apt-mal-nk-lazarus-vhd-ransomware-oct20-2.yarDetection Rule License 1.1

rule SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_2 : FILE
{
	meta:
		description = "Detects Lazarus VHD Ransomware"
		author = "Florian Roth (Nextron Systems)"
		id = "b75668de-93e6-57e7-90f0-fa335295be7c"
		date = "2020-10-05"
		modified = "2023-12-05"
		reference = "https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/apt_lazarus_vhd_ransomware.yar#L26-L43"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b"
		hash = "73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79"
		logic_hash = "cf28771a854b3bacc911375c09f6c6bc6ddebff95612a509890c56a5a14e8921"
		score = 75
		quality = 85
		tags = "FILE"

	strings:
		$op1 = { f9 36 88 08 8d ad fc ff ff ff 66 ff c1 e9 72 86 }
		$op2 = { c6 c4 58 0f a4 c8 12 8d ad ff ff ff ff 0f b6 44 }
		$op3 = { 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them
}

Strings (3 patterns)

Identifier	Type	Value
$op1	hex	{ f9 36 88 08 8d ad fc ff ff ff 66 ff c1 e9 72 86 }
$op2	hex	{ c6 c4 58 0f a4 c8 12 8d ad ff ff ff ff 0f b6 44 }
$op3	hex	{ 88 02 66 c1 f0 54 8d bf fc ff ff ff 0f ba e0 19 }

Condition

uint16( 0 ) == 0x5a4d and filesize < 9000KB and all of them

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 9000KB (a cheap guard that skips large files).
All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://securelist.com/lazarus-on-the-hunt-for-big-game/97757/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

097ca829e051a4877bca093cee340180ff5f13a9c266ad4141b0be82aae1a39b
73a10be31832c9f1cbbd798590411009da0881592a90feb472e80025dfb0ea79

Licence & attribution

Author: Florian Roth (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: b75668de-93e6-57e7-90f0-fa335295be7c

Tags:FILE

SIGNATURE_BASE_APT_MAL_NK_Lazarus_VHD_Ransomware_Oct20_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2020-10-05
SEKOIA_Apt_Lazarus_Vhd_Ransomware_Downloader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-11-28
SEKOIA_Apt_Lazarus_Vhd_Ransomware_Loader
APT / threat actorSEKOIA.IO Community· Sekoia.io· 2022-11-28
MALPEDIA_Win_Vhd_Ransomware_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_2
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_HKTL_Wiper_Whispergate_Jan22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-01-16
SIGNATURE_BASE_APT_UA_Hermetic_Wiper_Scheduled_Task_Feb22_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2022-02-25
SIGNATURE_BASE_APT_MAL_NK_3CX_ICONIC_Stealer_Mar23_1
APT / threat actorSignature Base (Florian Roth / Nextron)· Florian Roth (Nextron Systems)· 2023-03-31

More Vhd Ransomware rules