YARA · Telekom Security malware analysis
TELEKOM_SECURITY_Crylock_Hta
Detects CryLock ransomware how_to_decrypt.hta ransom note
- Author
- Thomas Barabosch, Telekom Security
- Date
- 2021-06-28
- Modified
- 2021-07-08
- Score / Quality
- 75 / 70
What this rule detects
Detects CryLock ransomware how_to_decrypt.hta ransom note
Associated malware family: Crylock.
It defines 14 patterns (14 text, 0 hex, 0 regex).
YARA-X says: warning[duplicate_pattern_value]: duplicate pattern value
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from Telekom Security malware analysis, which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Licence & attribution
Author: Thomas Barabosch, Telekom Security
Source repository: Telekom Security malware analysis @ 755efb6658
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: cf6ba6d2-beca-5da0-bb2d-0b8b52418a5e
Tags:FILE
Related rules
- TELEKOM_SECURITY_Crylock_BinaryMetadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-06-28
- MalwareditekSHen detection· ditekSHen· 2020-11-06
- ARKBIRD_SOLG_RAN_Crylock_Oct_2020_1Metadata onlyMalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2020-10-14
- TELEKOM_SECURITY_Win_Iceid_Core_202104Metadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-12
- TELEKOM_SECURITY_Win_Iceid_Core_Ldr_202104Metadata onlyMalwareTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-13
- TELEKOM_SECURITY_Fake_Gzip_Bokbot_202104Metadata onlyGenericTelekom Security malware analysis· Thomas Barabosch, Telekom Security· 2021-04-20