YARA · Telekom Security malware analysis
TELEKOM_SECURITY_Crylock_Binary
Detects CryLock ransomware v2.3.0.0
- Author
- Thomas Barabosch, Telekom Security
- Date
- 2021-06-28
- Modified
- 2021-07-08
- Score / Quality
- 75 / 70
What this rule detects
Detects CryLock ransomware v2.3.0.0
Associated malware family: Crylock.
Targets: Windows PE.
It defines 14 patterns (14 text, 0 hex, 0 regex).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Telekom Security malware analysis, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: Thomas Barabosch, Telekom Security
Source repository: Telekom Security malware analysis @ 755efb6658
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 5d46adf6-3ea4-5e3d-ac33-1292c076c0df
Tags:FILE
Related rules
- TELEKOM_SECURITY_Crylock_HtaMetadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-06-28
- MalwareditekSHen detection· ditekSHen· 2020-11-06
- ARKBIRD_SOLG_RAN_Crylock_Oct_2020_1Metadata onlyMalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-10-14
- TELEKOM_SECURITY_Win_Iceid_Core_202104Metadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-12
- TELEKOM_SECURITY_Win_Iceid_Core_Ldr_202104Metadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-13
- TELEKOM_SECURITY_Fake_Gzip_Bokbot_202104Metadata onlyGenericTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-20