YARA · Trellix Advanced Research Center

TRELLIX_ARC_Nemty_Ransomware

Rule to detect Nemty Ransomware

MalwareNemtyTrellix Advanced Research CenterApache License 2.0Compiles with YARA-X

Author: Marc Rivero | McAfee ATR Team
Date: 2020-02-23
Modified: 2020-08-14
Score / Quality: 75 / 70

What this rule detects

Rule to detect Nemty Ransomware

Associated malware family: Nemty.

Targets: Windows PE.

It defines 20 patterns (20 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

nemty-ransomware.yarApache License 2.0

rule TRELLIX_ARC_Nemty_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Nemty Ransomware"
		author = "Marc Rivero | McAfee ATR Team"
		id = "e9b133d6-fd77-5201-995d-c42bae7cde46"
		date = "2020-02-23"
		modified = "2020-08-14"
		reference = "https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_Nemty.yar#L1-L45"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "73bf76533eb0bcc4afb5c72dcb8e7306471ae971212d05d0ff272f171b94b2d4"
		logic_hash = "d055286670516318c14dcf4e5873b96eede5e1dfb3ee978553fc11f1ac6b3252"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Nemty"
		actor_type = "Cybercrime"
		actor_group = "Unknown"

	strings:
		$x1 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default}" fullword ascii
		$s2 = "https://pbs.twimg.com/media/Dn4vwaRW0AY-tUu.jpg:large :D" fullword ascii
		$s3 = "MSDOS.SYS" fullword wide
		$s4 = "/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} " ascii
		$s5 = "recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete" fullword ascii
		$s6 = "DECRYPT.txt" fullword ascii
		$s7 = "pv3mi+NQplLqkkJpTNmji/M6mL4NGe5IHsRFJirV6HSyx8mC8goskf5lXH2d57vh52iqhhEc5maLcSrIKbukcnmUwym+In1OnvHp070=" fullword ascii
		$s8 = "\\NEMTY-DECRYPT.txt\"" fullword ascii
		$s9 = "rfyPvccxgVaLvW9OOY2J090Mq987N9lif/RoIDP89luS9Ouv9gUImpgCTVGWvJzrqiS8hQ5El02LdEvKcJ+7dn3DxiXSNG1PwLrY59KzGs/gUvXnYcmT6t34qfZmr8g8" ascii
		$s10 = "IO.SYS" fullword wide
		$s11 = "QgzjKXcD1Jh/cOLBh1OMb+rWxUbToys2ArG9laNWAWk0rNIv2dnIDpc+mSbp91E8qVN8Mv8K5jC3EBr4TB8jh5Ns/onBhPZ9rLXR7wIkaXGeTZi/4/XOtO3DFiad4+vf" ascii
		$s12 = "NEMTY-DECRYPT.txt" fullword wide
		$s13 = "pvXmjPQRoUmjj0g9QZ24wvEqyvcJVvFWXc0LL2XL5DWmz8me5wElh/48FHKcpbnq8C2kwQ==" fullword ascii
		$s14 = "a/QRAGlNLvqNuONkUWCQTNfoW45DFkZVjUPn0t3tJQnHWPhJR2HWttXqYpQQIMpn" fullword ascii
		$s15 = "KeoJrLFoTgXaTKTIr+v/ObwtC5BKtMitXq8aaDT8apz98QQvQgMbncLSJWJG+bHvaMhG" fullword ascii
		$s16 = "pu/hj6YerUnqlUM9A8i+i/UhnvsIE+9XTYs=" fullword ascii
		$s17 = "grQkLxaGvL0IBGGCRlJ8Q4qQP/midozZSBhFGEDpNElwvWXhba6kTH1LoX8VYNOCZTDzLe82kUD1TSAoZ/fz+8QN7pLqol5+f9QnCLB9QKOi0OmpIS1DLlngr9YH99vt" ascii
		$s18 = "BOOTSECT.BAK" fullword wide
		$s19 = "bbVU/9TycwPO+5MgkokSHkAbUSRTwcbYy5tmDXAU1lcF7d36BTpfvzaV5/VI6ARRt2ypsxHGlnOJQUTH6Ya//Eu0jPi/6s2MmOk67csw/msiaaxuHXDostsSCC+kolVX" ascii
		$s20 = "puh4wXjVYWJzFN6aIgnClL4W/1/5Eg6bm5uEv6Dru0pfOvhmbF1SY3zav4RQVQTYMfZxAsaBYfJ+Gx+6gDEmKggypl1VcVXWRbxAuDIXaByh9aP4B2QvhLnJxZLe+AG5" ascii

	condition:
		( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) and 4 of them ) )
}

Strings (20 patterns)

Identifier	Type	Value	Modifiers
$x1	text	"/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default}"	fullword ascii
$s2	text	"https://pbs.twimg.com/media/Dn4vwaRW0AY-tUu.jpg:large :D"	fullword ascii
$s3	text	"MSDOS.SYS"	fullword wide
$s4	text	"/c vssadmin.exe delete shadows /all /quiet & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} "	ascii
$s5	text	"recoveryenabled no & wbadmin delete catalog -quiet & wmic shadowcopy delete"	fullword ascii
$s6	text	"DECRYPT.txt"	fullword ascii
$s7	text	"pv3mi+NQplLqkkJpTNmji/M6mL4NGe5IHsRFJirV6HSyx8mC8goskf5lXH2d57vh52iqhhEc5maLcSrIKbukcnmUwym+In1OnvHp070="	fullword ascii
$s8	text	"\\NEMTY-DECRYPT.txt\""	fullword ascii
$s9	text	"rfyPvccxgVaLvW9OOY2J090Mq987N9lif/RoIDP89luS9Ouv9gUImpgCTVGWvJzrqiS8hQ5El02LdEvKcJ+7dn3DxiXSNG1PwLrY59KzGs/gUvXnYcmT6t34qfZmr8g8"	ascii
$s10	text	"IO.SYS"	fullword wide
$s11	text	"QgzjKXcD1Jh/cOLBh1OMb+rWxUbToys2ArG9laNWAWk0rNIv2dnIDpc+mSbp91E8qVN8Mv8K5jC3EBr4TB8jh5Ns/onBhPZ9rLXR7wIkaXGeTZi/4/XOtO3DFiad4+vf"	ascii
$s12	text	"NEMTY-DECRYPT.txt"	fullword wide
$s13	text	"pvXmjPQRoUmjj0g9QZ24wvEqyvcJVvFWXc0LL2XL5DWmz8me5wElh/48FHKcpbnq8C2kwQ=="	fullword ascii
$s14	text	"a/QRAGlNLvqNuONkUWCQTNfoW45DFkZVjUPn0t3tJQnHWPhJR2HWttXqYpQQIMpn"	fullword ascii
$s15	text	"KeoJrLFoTgXaTKTIr+v/ObwtC5BKtMitXq8aaDT8apz98QQvQgMbncLSJWJG+bHvaMhG"	fullword ascii
$s16	text	"pu/hj6YerUnqlUM9A8i+i/UhnvsIE+9XTYs="	fullword ascii
$s17	text	"grQkLxaGvL0IBGGCRlJ8Q4qQP/midozZSBhFGEDpNElwvWXhba6kTH1LoX8VYNOCZTDzLe82kUD1TSAoZ/fz+8QN7pLqol5+f9QnCLB9QKOi0OmpIS1DLlngr9YH99vt"	ascii
$s18	text	"BOOTSECT.BAK"	fullword wide
$s19	text	"bbVU/9TycwPO+5MgkokSHkAbUSRTwcbYy5tmDXAU1lcF7d36BTpfvzaV5/VI6ARRt2ypsxHGlnOJQUTH6Ya//Eu0jPi/6s2MmOk67csw/msiaaxuHXDostsSCC+kolVX"	ascii
$s20	text	"puh4wXjVYWJzFN6aIgnClL4W/1/5Eg6bm5uEv6Dru0pfOvhmbF1SY3zav4RQVQTYMfZxAsaBYfJ+Gx+6gDEmKggypl1VcVXWRbxAuDIXaByh9aP4B2QvhLnJxZLe+AG5"	ascii

Condition

( uint16( 0 ) == 0x5a4d and filesize < 400KB and ( 1 of ( $x* ) and 4 of them ) )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 400KB (a cheap guard that skips large files).
At least 1 patterns in ( $x* ) must match.
At least 4 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.mcafee.com/blogs/other-blogs/mcafee-labs/nemty-ransomware-learning-by-doing/

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

73bf76533eb0bcc4afb5c72dcb8e7306471ae971212d05d0ff272f171b94b2d4

Licence & attribution

Author: Marc Rivero | McAfee ATR Team

Source repository: Trellix Advanced Research Center @ 1919562a59

Licence: Apache License 2.0 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: e9b133d6-fd77-5201-995d-c42bae7cde46

Metadata

rule_version	v1
malware_type	ransomware
malware_family	Ransom:W32/Nemty
actor_type	Cybercrime
actor_group	Unknown

Tags:RANSOMWARE FILE

TRELLIX_ARC_Nemty_Ransomware_2_6
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-06
MALPEDIA_Win_Nemty_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
DITEKSHEN_MALWARE_Win_Nemty
MalwareditekSHen detection· ditekSHen· 2020-11-06
CAPE_Nemty
MalwareCAPE Sandbox (CAPEv2)· kevoreilly· 2020-04-03
ARKBIRD_SOLG_RAN_Nemty_June_2021_1Metadata only
MalwareArkbird SOLG (DailyIOC)· Arkbird_SOLG· 2021-06-12
DITEKSHEN_INDICATOR_KB_Gobuildid_Nemty
Suspicious / huntingditekSHen detection· ditekSHen· 2021-01-21
TRELLIX_ARC_Cryptonar_Ransomware
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2026-09-01
TRELLIX_ARC_Rietspoof_Loader
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2026-09-01

More Nemty rules