YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_PY_Dimorf

Detection for Dimorf ransomeware

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Silas Cutler
Date: 2023-01-03
Modified: 2023-12-05
Score / Quality: 75 / 85

What this rule detects

Detection for Dimorf ransomeware

It defines 5 patterns (5 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

mal-py-dimorf.yarDetection Rule License 1.1

rule SIGNATURE_BASE_MAL_PY_Dimorf
{
	meta:
		description = "Detection for Dimorf ransomeware"
		author = "Silas Cutler"
		id = "78b53433-6926-58cd-8ec0-2195af803aab"
		date = "2023-01-03"
		modified = "2023-12-05"
		reference = "https://github.com/Ort0x36/Dimorf"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/gen_100days_of_yara_2023.yar#L224-L242"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		logic_hash = "7499b21f77d07364983b94134a60f7c99e71a5392386437d459a196bf71852fb"
		score = 75
		quality = 85
		tags = ""
		version = "1.0"

	strings:
		$func01 = "def find_and_encrypt"
		$func02 = "def check_os"
		$comment01 = "checks if the user has permission on the file."
		$misc01 = "log_dimorf.log"
		$misc02 = ".dimorf"

	condition:
		all of them
}

Strings (5 patterns)

Identifier	Type	Value
$func01	text	"def find_and_encrypt"
$func02	text	"def check_os"
$comment01	text	"checks if the user has permission on the file."
$misc01	text	"log_dimorf.log"
$misc02	text	".dimorf"

Condition

all of them

In plain words (Heuristic)

All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://github.com/Ort0x36/Dimorf

Licence & attribution

Author: Silas Cutler

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 78b53433-6926-58cd-8ec0-2195af803aab

Metadata

version	1.0

SIGNATURE_BASE_MAL_ELF_Torchtriton
MalwareSignature Base (Florian Roth / Nextron)· Silas Cutler· 2023-01-02