YARA · Trellix Advanced Research Center

TRELLIX_ARC_Nefilim_Ransomware

Rule to detect Nefilim ransomware

MalwareNefilimTrellix Advanced Research CenterApache License 2.0Compila con YARA-X

Autor: Marc Rivero | McAfee ATR Team
Fecha: 2020-03-17
Modificada: 2020-04-03
Puntuación / Calidad: 75 / 70

Qué detecta esta regla

Rule to detect Nefilim ransomware

Familia de malware asociada: Nefilim.

Objetivos: PE de Windows.

Define 8 patrones (4 de texto, 4 hex, 0 regex).

Resumen generado a partir de los metadatos y la condición de la regla.

Código de la regla

Descargar .yar

nefilim-ransomware.yarApache License 2.0

rule TRELLIX_ARC_Nefilim_Ransomware : RANSOMWARE FILE
{
	meta:
		description = "Rule to detect Nefilim ransomware"
		author = "Marc Rivero | McAfee ATR Team"
		id = "55d9cb20-5071-5dce-a46f-a20816ba379f"
		date = "2020-03-17"
		modified = "2020-04-03"
		reference = "https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/"
		source_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/ransomware/RANSOM_NEFILIM.yar#L3-L48"
		license_url = "https://github.com/advanced-threat-research/Yara-Rules//blob/1919562a59f190bda60c982424f6a24c542ee3e0/LICENSE"
		hash = "5ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c6"
		logic_hash = "d8cd5d2dd552d3e9f57f7bd244e941fe89a96ab16bbcc71911e8e2a519f53f03"
		score = 75
		quality = 70
		tags = "RANSOMWARE, FILE"
		rule_version = "v1"
		malware_type = "ransomware"
		malware_family = "Ransom:W32/Nefilim"
		actor_type = "Cybercrime"
		actor_group = "Unknown"

	strings:
		$s1 = "C:\\Users\\Administrator\\Desktop\\New folder\\Release\\NEFILIM.pdb" fullword ascii
		$s2 = "oh how i did it??? bypass sofos hah" fullword ascii
		$s3 = " /c timeout /t 3 /nobreak && del \"" fullword wide
		$s4 = "NEFILIM-DECRYPT.txt" fullword wide
		$op0 = { db ff ff ff 55 8b ec 83 ec 24 53 56 57 89 55 f4 }
		$op1 = { 60 be 00 d0 40 00 8d be 00 40 ff ff 57 eb 0b 90 }
		$op2 = { 84 e0 40 00 90 d1 40 00 08 }
		$bp = { 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89????29????89????29????89????29????8D????8D????89????29????89????29????8B????89????29????8D????F6??????8B????8A????8B????8A????8A??88????8B????8A????88????75??0FB6??8A??????????0FB6??88????8A??????????0FB6????8A??????????88????0FB6????8A??????????88????8B????C1????32??????????8B????8A????32??8B????88????8A????32??88????8A??32????83????88????8B????8A????32????FF????88??83????83????83??????0F82????????5F5E5BC9C3558B??560FB6??57C1????03????6A??5F6A??5E8A??30??40414E75??4F75??5F5E5DC356576A??5F6A??8B??5E0FB6??8A??????????88??83????4E75??414F75??5F5EC38A????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????8A????88????88????C3558B??5153566A??83????5E8A????32??8A????8A????88????32??32??88????88????32??8A??C0????B3??F6??02??32??32????8A????32????32??88????8A??C0????F6??02??32??32????8A????32????88????8A??C0????F6??02??32??32??8A????32????32????88??8A??C0????F6??02??32??32????83????32????4E88????75??5E5BC9C3558B??53FF????8B??32??E8????????59B3??8B??E8????????8B??E8????????8B??E8????????FF????8B??8A??E8????????FE??5980????72??8B??E8????????8B??E8????????5B8B??B0??5DE9????????558B??81??????????53568D??????????E8????????33??6A??5939????76??5783????75??8B????8D????A5A5A58D??????????A5508D????E8????????596A??588B????8D????80????75??48C6????79??EB??FE????33??8A??????8B????30????43413B????72??5F8B????8B????6A??2B??5E8A????88??404E75??5E5BC9C3558B??81??????????53FF????8D??????????50FF??????????68????????8D??????????50FF??????????33??53536A??535368????????8D??????????50FF??????????89????3B??0F84????????56578D????5053BE????????5689????FF??????????5056E8????????83????85??75??53FF??????????FF????8B??????????53FF??50FF??????????8D????51505689????FF??????????5056E8????????83????85??74??8B????89????8D????50FF????E8????????59595385??74??8D????50FF????FF????FF????FF??????????FF????53FF??50FF??????????5F5E5BC9C3558B??83????81??????????535657FF????8D????????????50FF??????????8B??????????68????????8D????????????50FF??8D??????508D????????????50FF??????????89??????83????0F84????????8B??????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????68????????8D??????50FF??85??0F84????????F6????????FF????8D????????????5074??FF??????????8D??????508D????????????50FF??68????????8D????????????50FF??8D????????????50E8????????E9????????FF??????????8D??????508D????????????50FF??8D??????50E8????????8B??C7????????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??0F84????????68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????57FF??85??74??68????????8D??????50FF??85??74??8D????????????50E8????????598D??????50FF??????FF??????????85??0F85????????FF??????FF??????????5F5E5B8B??5DC3558B??81??????????53565768????????FF??????????8B??????????5033??57FF??8B??????????50FF??68????????89????FF??????????89????B8????????39????74??8B????2B??8A??FF????88????4039????75??57576A??575768????????FF????FF??????????89????3B??0F84????????8D????5150FF??????????6A??57FF??50FF??6A??5789????FF??50FF??FF????89????E8????????FF????E8????????595968????????57FF??50FF??68????????5789????FF??50FF??FF????8B????89????E8????????FF????8B????E8????????8B??????????59595757FF????FF????FF????FF??57FF??????????578D????5068????????FF????FF????FF??????????FF??????????83????0F84????????FF??????????83????0F84????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF????FF????FF??????????8B????8B????5705????????5713??5150FF????FF??578D????5068????????FF??????????50FF????FF????FF??????????8B????8B????3B??0F8C????????7F??81??????????0F86????????89????89????3B??0F8C????????7F??3B??0F86????????EB??8B????2B????1B????89????0F88????????7F??81??????????0F82????????68????????57FF??50FF??????????5757FF????89????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????5757FF????FF????FF????FF??578D????5068????????FF????FF????FF??????????FF??FF????5750FF??????????81????????????8B????11????39????0F8C????????0F8F????????8B????39????0F82????????E9????????3B??7C??7F??81??????????76??68????????57FF??50FF??????????575733??89????5133??50FF????FF??578D????5068????????FF????FF????FF??????????FF????8B????FF????68????????FF????E8????????83????575733??5050FF????FF??578D????5068????????EB??5157FF??50FF??????????575733??89????5133??50FF????FF??578D????50FF????FF????FF????FF??????????FF????8B????FF????FF????FF????E8????????83????575733??5050FF????FF??578D????50FF????FF????FF????FF??????????FF????57FF??50FF??????????FF????FF??????????FF????57FF??8B??????????50FF??FF???? }

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or all of ( $op* ) or $bp
}

Cadenas (8 patrones)

Identificador	Tipo	Valor	Modificadores
$s1	texto	"C:\\Users\\Administrator\\Desktop\\New folder\\Release\\NEFILIM.pdb"	fullword ascii
$s2	texto	"oh how i did it??? bypass sofos hah"	fullword ascii
$s3	texto	" /c timeout /t 3 /nobreak && del \""	fullword wide
$s4	texto	"NEFILIM-DECRYPT.txt"	fullword wide
$op0	hex	{ db ff ff ff 55 8b ec 83 ec 24 53 56 57 89 55 f4 }
$op1	hex	{ 60 be 00 d0 40 00 8d be 00 40 ff ff 57 eb 0b 90 }
$op2	hex	{ 84 e0 40 00 90 d1 40 00 08 }
$bp	hex	{ 558B??83????53565789????29????6A??8D????8D????5A8B??89????8A????88????8B????8A????88??8A????88????8A??88????03??03??FF????75??89????8D????8D????8D????89????89 …

Condición

uint16( 0 ) == 0x5a4d and filesize < 200KB and all of ( $s* ) or all of ( $op* ) or $bp

En palabras sencillas (Heurística)

El archivo debe empezar por «MZ»: un ejecutable de Windows (PE).
El archivo debe ocupar menos de 200KB (un límite barato que descarta archivos grandes).
Deben coincidir todos los patrones de ( $s* ).
Deben coincidir todos los patrones de ( $op* ).
El patrón $bp debe estar presente.

Prueba esta regla en tu navegador

Arrastra un archivo para escanearlo con esta regla usando YARA-X compilado a WebAssembly. No se sube nada.

Arrastra un archivo aquí o haz clic para elegirSe escanea en local con YARA-X. Archivos de hasta 200 MB.

Abrir en el editor

Referencias

https://www.bleepingcomputer.com/news/security/new-nefilim-ransomware-threatens-to-release-victims-data/

Hashes de muestras

Hashes de las muestras que el autor lista en los metadatos de la regla (búscalos en tu plataforma de threat intelligence).

5ab834f599c6ad35fcd0a168d93c52c399c6de7d1c20f33e25cb1fdb25aec9c6

Licencia y atribución

Autor: Marc Rivero | McAfee ATR Team

Repositorio de origen: Trellix Advanced Research Center @ 1919562a59

Licencia: Apache License 2.0 (licencia del repositorio)

Regla original

Obtenida a través de YARA Forge 20260927, que añade a los nombres el prefijo de la fuente y campos meta normalizados.

Id de la regla: 55d9cb20-5071-5dce-a46f-a20816ba379f

Metadatos

rule_version	v1
malware_type	ransomware
malware_family	Ransom:W32/Nefilim
actor_type	Cybercrime
actor_group	Unknown

Etiquetas:RANSOMWARE FILE

TRELLIX_ARC_RANSOM_Nefilim_Go
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-07-13
TRELLIX_ARC_Nefilim_Signed
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-02
MALPEDIA_Win_Nefilim_Auto
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
TRELLIX_ARC_Cryptonar_Ransomware
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2026-09-01
TRELLIX_ARC_Rietspoof_Loader
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2026-09-01
TRELLIX_ARC_Nemty_Ransomware
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-02-23
TRELLIX_ARC_Nemty_Ransomware_2_6
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-04-06
TRELLIX_ARC_RANSOM_Darkside
MalwareTrellix Advanced Research Center· Marc Rivero | McAfee ATR Team· 2020-08-11

Más reglas de Nefilim