YARA · Trellix Advanced Research Center

TRELLIX_ARC_Nefilim_Ransomware

Rule to detect Nefilim ransomware

MalwareNefilimTrellix Advanced Research CenterApache License 2.0Compiles with YARA-X

Author: Marc Rivero | McAfee ATR Team
Date: 2020-03-17
Modified: 2020-04-03
Score / Quality: 75 / 70

What this rule detects

Rule to detect Nefilim ransomware

Associated malware family: Nefilim.

Targets: Windows PE.

It defines 8 patterns (4 text, 4 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

nefilim-ransomware.yarApache License 2.0

rule TRELLIX_ARC_Nefilim_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Nefilim ransomware"
		author = "Marc Rivero | McAfee ATR Team"
		id = "55d9cb20-5071-5dce-a46f-a20816ba379f"
		date = "2020-03-17"
		modified = "2020-04-03"
		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_NEFILIM.yar#L3-L48"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "5ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c6"
		logic_hash = "d8cd5d2dd552d3e9f57f7bd244e941fe89a96ab16bbcc71911e8e2a519f53f03"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Nefilim"
		actor_type = "Cybercrime"
		actor_group = "Unknown"

	strings:
		$s1 = "C:\\Users\\Administrator\\Desktop\\New folder\\Release\\NEFILIM.pdb" fullword ascii
		$s2 = "oh how i did it??? bypass sofos hah" fullword ascii
		$s3 = " /c timeout /t 3 /nobreak && del \"" fullword wide
		$s4 = "NEFILIM-DECRYPT.txt" fullword wide
		$op0 = { db ff ff ff 55 8b ec 83 ec 24 53 56 57 89 55 f4 }
		$op1 = { 60 be 00 d0 40 00 8d be 00 40 ff ff 57 eb 0b 90 }
		$op2 = { 84 e0 40 00 90 d1 40 00 08 }
		$bp = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????53568D??????????E8????????33??6A??5939????76??5783????75??8B????8D????A5A5A58D??????????A5508D????E8????????596A??588B????8D????80????75??48C6????79??EB??FE????33??8A??????8B????30????43413B????72??5F8B????8B????6A??2B??5E8A????88??404E75??5E5BC9C3558B??81??????????53FF????8D??????????50FF??????????68????????8D??????????50FF??????????33??53536A??535368????????8D??????????50FF??????????89????3B??0F84????????56578D????5053BE????????5689????FF??????????5056E8????????83????85??75??53FF??????????FF????8B??????????53FF??50FF??????????8D????51505689????FF??????????5056E8????????83????85??74??8B????89????8D????50FF????E8????????59595385??74??8D????50FF????FF????FF????FF??????????FF????53FF??50FF??????????5F5E5BC9C3558B??83????81??????????535657FF????8D????????????50FF??????????8B??????????68????????8D????????????50FF??8D??????508D????????????50FF??????????89??????83????0F84????????8B??????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????F6????????FF????8D????????????5074??FF??????????8D??????508D????????????50FF??68????????8D????????????50FF??8D????????????50E8????????E9????????FF??????????8D??????508D????????????50FF??8D??????50E8????????8B??C7????????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????8D??????50FF??85??74??8D????????????50E8????????598D??????50FF??????FF??????????85??0F85????????FF??????FF??????????5F5E5B8B??5DC3558B??81??????????53565768????????FF??????????8B??????????5033??57FF??8B??????????50FF??68????????89????FF??????????89????B8????????39????74??8B????2B??8A??FF????88????4039????75??57576A??575768????????FF????FF??????????89????3B??0F84????????8D????5150FF??????????6A??57FF??50FF??6A??5789????FF??50FF??FF????89????E8????????FF????E8????????595968????????57FF??50FF??68????????5789????FF??50FF??FF????8B????89????E8????????FF????8B????E8????????8B??????????59595757FF????FF????FF????FF??57FF??????????578D????5068????????FF????FF????FF??????????FF??????????83????0F84????????FF??????????83????0F84????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF????FF????FF??????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF??????????50FF????FF????FF??????????8B????8B????3B??0F8C????????7F??81??????????0F86????????89????89????3B??0F8C????????7F??3B??0F86????????EB??8B????2B????1B????89????0F88????????7F??81??????????0F82????????68????????57FF??50FF??????????5757FF????89????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????5757FF????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF??FF????5750FF??????????81????????????8B????11????39????0F8C????????0F8F????????8B????39????0F82????????E9????????3B??7C??7F??81??????????76??68????????57FF??50FF??????????575733??89????5133??50FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????575733??5050FF????FF??578D????5068????????EB??5157FF??50FF??????????575733??89????5133??50FF????FF??578D????50FF????FF????FF????FF??????????FF????8B????FF????FF????FF????E8????????83????575733??5050FF????FF??578D????50FF????FF????FF????FF??????????FF????57FF??50FF??????????FF????FF??????????FF????57FF??8B??????????50FF??FF???? }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or all of ( $op* ) or $bp
}

Strings (8 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"C:\\Users\\Administrator\\Desktop\\New folder\\Release\\NEFILIM.pdb"	fullword ascii
$s2	text	"oh how i did it??? bypass sofos hah"	fullword ascii
$s3	text	" /c timeout /t 3 /nobreak && del \""	fullword wide
$s4	text	"NEFILIM-DECRYPT.txt"	fullword wide
$op0	hex	{ db ff ff ff 55 8b ec 83 ec 24 53 56 57 89 55 f4 }
$op1	hex	{ 60 be 00 d0 40 00 8d be 00 40 ff ff 57 eb 0b 90 }
$op2	hex	{ 84 e0 40 00 90 d1 40 00 08 }
$bp	hex	{ 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89 …

Condition

uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or all of ( $op* ) or $bp

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 200KB (a cheap guard that skips large files).
All patterns in ( $s* ) must match.
All patterns in ( $op* ) must match.
Pattern $bp must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

5ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c6

Licence & attribution

Author: Marc Rivero | McAfee ATR Team

Source repository: Trellix Advanced Research Center @ 1919562a59

Licence: Apache License 2.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 55d9cb20-5071-5dce-a46f-a20816ba379f

Metadata

rule_version	v1
malware_type	ransomware
malware_family	Ransom:W32/Nefilim
actor_type	Cybercrime
actor_group	Unknown

Tags:RANSOMWARE FILE

TRELLIX_ARC_RANSOM_Nefilim_Go
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-07-13
TRELLIX_ARC_Nefilim_Signed
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-02
MALPEDIA_Win_Nefilim_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
TRELLIX_ARC_Cryptonar_Ransomware
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2026-09-01
TRELLIX_ARC_Rietspoof_Loader
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2026-09-01
TRELLIX_ARC_Nemty_Ransomware
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-02-23
TRELLIX_ARC_Nemty_Ransomware_2_6
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-06
TRELLIX_ARC_RANSOM_Darkside
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-08-11

More Nefilim rules