IronWall_0[.]1[.]3_x64-setup[.]exe

resource
IronWall_0.1.3_x64-setup.exe
unpack001/$PLUGINSDIR/StartMenu.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/$PLUGINSDIR/nsis_tauri_utils.dll
unpack001/ironwall.exe

IronWall_0.1.3_x64-setup.exe

IMPHASH 46ce5c12b293febbeb513b196aa7f843
SHA256 2d04cfa3c07412d163c6640e9d867fe9bff1e6877629c138c1cc10d9d0e43f3f
MD5 3e05137b38e598ea7c62064b2edd4af7
SHA1 b4470c7a979e2cc8b548e18fe559c958f9394a31
SHA512 f8be1c163f867f17c9c36932633296c3407d22441d3575bc4837f265102572feaef786f09c2d76a7f6c9e47897f638eb7bfc2598b5c70e7643924330f557203a
SSDEEP 786432:dtc2PrvlqDfO8//vaFDcpNO5djkwtEny/Q5p/Tvu2KdrCn1EdyjZFXPelcxkV5o:dt9JqDRaFDcpNO5lfmy/Ep/TvMJCnDZH
TLSH
T1D1A733B14AC0D2A8E51877B3AA76377C58930FED5020B1EAE441A5F009BEE7D7E15393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

meow

Minor OS version

0

Major OS version

4

Entry point

13983

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegEnumValueW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyExW RegCreateKeyExW

shell32

SHGetPathFromIDListW SHBrowseForFolderW SHGetFileInfoW SHFileOperationW ShellExecuteExW

ole32

CoCreateInstance OleUninitialize OleInitialize IIDFromString CoTaskMemFree

comctl32

ImageList_Destroy ord17 ImageList_AddMasked ImageList_Create

user32

MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW CreatePopupMenu AppendMenuW TrackPopupMenu OpenClipboard EmptyClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW IsWindowEnabled SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CharPrevW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint GetClientRect FillRect DrawTextW EndPaint CharNextA wsprintfA DispatchMessageW CreateWindowExW PeekMessageW GetSystemMetrics

gdi32

GetDeviceCaps SetBkColor SelectObject DeleteObject CreateBrushIndirect CreateFontIndirectW SetBkMode SetTextColor

kernel32

RemoveDirectoryW lstrcmpiA GetTempFileNameW CreateProcessW CreateDirectoryW CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW WriteFile GetCurrentProcess GetModuleFileNameW GetLastError GetFileSize CreateFileW GetTickCount Sleep SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW MulDiv lstrcpyA MoveFileExW lstrcatW GetSystemDirectoryW GetProcAddress GetModuleHandleA GetExitCodeProcess WaitForSingleObject ExitProcess

$PLUGINSDIR/StartMenu.dll

IMPHASH 646971a3aef724d6f553f40ae84fe26b
SHA256 fe330320459637d8dd2b5d84d07925c38ec264152ffd3b1760a4d44d76536caa
MD5 b9b71990b37e04a56cadbcbfa694f30f
SHA1 3b7627deb793446d6b12b7b94266cc592982a5c2
SHA512 b4aa947aba471ce0ba37ab859391f6a157887c882c920a3081d482f63a83317ae75b428ebae226f835798517abb676114ee42bf13bd4c4291cebbb5e9658f2e5
SSDEEP 96:VIt3J2Gl0eVe0+Cfo0UkXt6+o69UiGdPh5/utta/x3lkCTcaqHCI:ShE+A0+sF6piUFkA1lncviI
TLSH
T1FFF1C776F3D20673F9AB427428632F231B2AF521576581A7890316CE7A61DE3FD34B11
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

meow

Minor OS version

0

Major OS version

4

Entry point

6430

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/System.dll

IMPHASH 509a34b3a68a773e0afb4259e68f9f82
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

meow

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

$PLUGINSDIR/nsDialogs.dll

IMPHASH 3b477381217c97b22146297f93df2a92
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

meow

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/nsis_tauri_utils.dll

IMPHASH 2030931b38a854dde8cdd69245a8096a
SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
MD5 948eaa3cb78c2dcdd9eb1ab120ae0f65
SHA1 75197fee3c6a814fe035788d1c34ead39349b860
SHA512 f7c511e8c73ef6ee9b72c88cd73b2d454a6ffc12144118df2276ea3f5c34175df0d9d15a435035575ca2b171789fe348d7a9028b702b47dda749ee17e03ae7c1
SSDEEP 768:K/wOD4gzTVpAVk2h5Rsekk55aCukBFKpnp0jdhK7W+qVG:8wODZzTrAV5Oevq4DtXHVG
TLSH
T188F24A48FDC57EBAE2CF05710809467E4A6FC8081700C96BE3722EA3D5A67329ED525F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Password

meow

Minor OS version

0

Major OS version

6

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nsis_tauri_utils.pdb

$TEMP/MicrosoftEdgeWebview2Setup.exe

IMPHASH 7899cb8ba886a0690bdc28d8b481bbd1
SHA256 cb9b76a6dace90f5d4635f2d49cbb55a62f41e5e365a22cef4265c013af0bcdd
MD5 7d771a8de0076f9fc5169cf1ba088586
SHA1 180865c9fb67008f5f1900350be6bfd10c4ac0a1
SHA512 1143ac711e8589b7918091306b99ce70f534b0b6aa8c820dfb080f1d567969cdff2948a46adf3de36efdfd96715f214469c2c678eb6ffa494a970c0a14b7c472
SSDEEP 49152:X0iGA3AiBEIBB/4lR9Sk2qzV3dJnRoj8:Eix/7/4PzV3dlA8
TLSH
T14275222476D48031E5F3293159F4CAB25F7AFDB24A72598F13520E2D2E35AE2E235363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Password

meow

PE Signature issue

Digest

78:7b:a2:60:a6:f5:3d:ab:99:c2:5e:4c:be:cb:03:a8:23:db:5f:05:d0:cc:f6:95:5b:48:fd:b4:ee:5e:6b:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Chains

Nov 13, 2026

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Digest

78:7b:a2:60:a6:f5:3d:ab:99:c2:5e:4c:be:cb:03:a8:23:db:5f:05:d0:cc:f6:95:5b:48:fd:b4:ee:5e:6b:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 25, 2026

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Subject

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:33:4e:c2:48:56:4c:2b:5c:6f:00:00:00:00:02:33

Issuer

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 16, 2026 - Apr 15, 2027

Subject

CN=Microsoft Code Signing PCA 2024,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:39:3b:b6:37:19:bf:06:1d:67:00:00:00:00:00:39

Issuer

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 8, 2024 - Mar 22, 2036

Subject

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Serial Number

64:57:97:41:81:d1:09:95:4f:1c:10:95:8c:65:4e:63

Issuer

CN=EdgeBuild,O=EdgeBuild,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageKeyEncipherment

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jun 15, 2020 - Dec 31, 2039

Subject

CN=Microsoft Time-Stamp Service,OU=Microsoft America Operations+OU=nShield TSS ESN:DC00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:02:24:3b:84:21:b0:2c:ac:64:22:00:01:00:00:02:24

Issuer

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Feb 19, 2026 - May 17, 2027

Subject

CN=Microsoft Time-Stamp PCA 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:15:c5:e7:6b:9e:02:9b:49:99:00:00:00:00:00:15

Issuer

CN=Microsoft Root Certificate Authority 2010,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 30, 2021 - Sep 30, 2030

Minor OS version

1

Major OS version

5

Entry point

33792

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType RaiseException LCMapStringW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx CreateFileW CloseHandle WriteConsoleW DecodePointer VirtualProtect EncodePointer LoadLibraryExW QueryPerformanceCounter GetProcAddress FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection SetLastError GetLastError RtlUnwind TerminateProcess GetCurrentProcess GetModuleHandleW IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStringTypeW CreateDirectoryW SizeofResource FindFirstFileW Wow64DisableWow64FsRedirection RemoveDirectoryW GetTempPathW FormatMessageW Wow64RevertWow64FsRedirection GetFileAttributesExW GetDiskFreeSpaceExW LockResource DeleteFileW FindResourceExW LoadResource FindResourceW HeapDestroy LocalFree VerSetConditionMask CopyFileW VerifyVersionInfoW GetTempFileNameW lstrcmpiW CreateMutexW WaitForSingleObject ReleaseMutex CreateEventW SetEvent CreateThread UnmapViewOfFile CreateFileMappingW MapViewOfFile VirtualQuery CreateProcessW GetExitCodeProcess ResetEvent WaitForSingleObjectEx GetSystemInfo LoadLibraryExA

advapi32

RegSetValueExA SetSecurityDescriptorDacl GetAclInformation SetSecurityDescriptorOwner GetSidSubAuthority GetSidLengthRequired CopySid InitializeSid IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD SetSecurityDescriptorGroup RegOpenKeyExW RegQueryValueExW GetSecurityDescriptorSacl GetSecurityDescriptorDacl GetSecurityDescriptorGroup GetSecurityDescriptorControl GetSecurityDescriptorOwner RegCloseKey RegQueryValueExA RegCreateKeyExA RegSetValueExW RegOpenKeyExA RegDeleteValueA

ole32

CoTaskMemFree CoUninitialize CoInitializeEx

shell32

SHGetKnownFolderPath ord680 CommandLineToArgvW SHGetFolderPathW

user32

CharLowerBuffW MessageBoxW

Name

.text

Size

108KB

Virtual Size

107KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

44B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

data/malicious_urls.bin

SHA256 d9442919e87a17681ee63c76767110409523e6a667aea9721f8e75401ce5e323
MD5 b63eccd4fdcf6545e63146e3315ef8ac
SHA1 443cf49386c5491b84e0e5b97741118522638594
SHA512 bba1675de2e4be2b8e6089d3ec115eecbc1dab453e136d2de1514f3554ec991589a0e8c63a00932524752f8378e16ffe9ef103dfd9c47c8ad6584aa82cb648ac
SSDEEP 49152:2gPqp/Y3TK1kJu2/WXjxMxKHKdPaVUpN8xXnbzmN3fCT3mCSRblN1cs9XLs7md3h:Lj
TLSH
T1E01662EF3A948A226F99CEF9B4F0297DD29743DA9CD2D8CCC6D14C109C46362799E740
MD5 SHA1 SHA512 SSDEEP TLSH

data/manifest.json

SHA256 c376a835f4b400af0759d9efc13d25d3bbf15e79b835a28f7737b8e30883f9c1
MD5 30aaf7f23e98aeb041691077cf036842
SHA1 045614a27ea7f012811efe00fa76ba1884cff221
SHA512 461758a5ecff7be0731232d5726dc8995806114f4c598d286d3233b4853be016578160586ffcffa9682118c34632c300bec99239b2dbcf8d62733e86033d880c
TLSH
T190E0C22590584DA333E0EA7101B922436F539847A8127C09726A87284F1E83C27B9217
MD5 SHA1 SHA512 TLSH

data/models/README.txt

SHA256 0abd362eb5487d1ac1878dbe5f48df03a2f5c90738b6862b2f99e93f8e733fd7
MD5 7aa356222de517c486897e642dfb634b
SHA1 e0d8ec5b19d544d3237edad3e8b8abb127d91fbc
SHA512 d2878a74c5c6b74ff33627d9825c32d038e71e027c293b908c56db95b5fafcc41491709fc113f726c8b7552b5ae25dafcbf0b1b8ed88d58eeda1989472d18336
TLSH
T1D0314E011CE0BE71C237D671A3DDD9BAEF1366D76A502A2C70CC510827A9790C2EDBC2
MD5 SHA1 SHA512 TLSH

data/signatures.bin

SHA256 2ebabbf67a0bbcb06c4b3427f26fc899fdc3298c05f6e5049cebfaaa43332888
MD5 c100d29384245f8e880f8bf8f7f851a7
SHA1 5507906be704bdb3f8114954267920b21dbedbab
SHA512 6176ede9aa8ee4eee4a05b9c11a914971215f3ac80a24bf36f6162bf16b256ec0ed84c9c604569bcb6dcd75a1731d26af4d7f1c4f8a0f367cc3cc3d337551339
SSDEEP 786432:51l5U5WMpRyd5+Qeu5eOLqNCARGJSx6mC:Dle5EA+eSAR3smC
TLSH
T17FA78CD0BBE6BB18621E6E56D51176564E048CEF8C0BDE8B2399233F4871DAE70211DF
MD5 SHA1 SHA512 SSDEEP TLSH

data/signatures.json

SHA256 7d78a7130aa63638a234d5835b113735f673acd3d597e3b8bc3c96ad0c3569a9
MD5 2774bc7f077b3be12c737c9a13c7d377
SHA1 41447f9dccc0ab49d24580925124e22f1ae44c1a
SHA512 81a5ee246cd95c78f69036bc0b65ff5bb7e7981a830f7da7b5a14895aba9bc1e91da2b44e93e67f34081e4587ba0d50b16804df58d4af1e8e628f21e023bad8b
SSDEEP 6144:z+3HWwtCBSt9t0K2qZxI9xmMe18T5Tu5FNfCVTy6Y3H3oZCzm/qny84xbaG6vCHD:Tc9gnw+XUi20SxXlrha/SgOkUiztH
TLSH
T1AEE47AA2D4784CB7740D1E7B21261AF26A3084570CEA3F8B37C8459D1F7E50E5ABB939
MD5 SHA1 SHA512 SSDEEP TLSH

ironwall.exe

IMPHASH fe4f600d7f81d3a70c446a64a7c31446
SHA256 4102d889402536d90c39e21c89f1ff2f250512001f6a5f30a7457c3cc634e9f2
MD5 d4806994851abf878c8afcfa6906c79b
SHA1 c741455853161a17ba303b35d32d6816684bd0b5
SHA512 dc7c83bfd932cf5570211397f23eb0386f0312ee01f5e18d1f6944563f8b69a4eb13d05b3b3cbe5048f7bafdd4d491b14e98408ecdd27fc8d2779412a7c4ffb9
SSDEEP 98304:sq4Vzd1Pb2vb5Rz5Qxx1ruEVFh8gyolVB9DjP2aq61ITqP1SQRDBz9A83tKLjwz1:EzG5kb8gyW6m1SQRcIyXYSp4CqtqIt7
TLSH
T126F67D03F6A581ECC06EC1B5835A9733EB76B88D493476AF5BE40A212F66F506F1D708
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

meow

Minor OS version

0

Major OS version

6

Entry point

11425220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ironwall.pdb

kernel32

OpenProcess GetCurrentThreadId LocalFree LoadLibraryW WaitForSingleObjectEx ReleaseSemaphore GetFullPathNameW SetLastError LCIDToLocaleName GetUserDefaultUILanguage GetModuleHandleW ReleaseSRWLockExclusive GetFileInformationByHandle AcquireSRWLockExclusive RtlLookupFunctionEntry GetCurrentProcessId WideCharToMultiByte ReleaseMutex WaitForSingleObject MultiByteToWideChar SleepEx FormatMessageW SetHandleInformation SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandleEx FlushFileBuffers ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW WaitForMultipleObjects GetExitCodeProcess GetTempPathW DeleteFileW MoveFileExW CreateSymbolicLinkW SetWaitableTimer FindNextFileW GetProcessTimes GetSystemTimes GetProcessIoCounters ReadProcessMemory VirtualQueryEx WakeAllConditionVariable GlobalMemoryStatusEx SleepConditionVariableSRW RtlPcToFileHeader FlsAlloc FlsGetValue VirtualProtect GetSystemInfo FindClose SwitchToThread DeleteCriticalSection TryEnterCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection K32GetPerformanceInfo GetCommandLineW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext CreateFileMappingW SetEnvironmentVariableW lstrlenW UnmapViewOfFile MapViewOfFile FlsSetValue UnlockFileEx CreateMutexW FlsFree CreateFileA LockFileEx GetSystemTimePreciseAsFileTime HeapReAlloc GetCurrentThread SetThreadStackGuarantee EncodePointer GetCurrentProcess CreateWaitableTimerExW DeviceIoControl CreateProcessW CreateDirectoryW CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA GetModuleHandleA Sleep GetProcAddress GetLastError CloseHandle RtlUnwind InitializeSListHead DuplicateHandle SetUnhandledExceptionFilter GetFinalPathNameByHandleW SetFileCompletionNotificationModes RtlUnwindEx HeapAlloc VirtualFree VirtualAlloc RtlDeleteFunctionTable FlushInstructionCache RtlAddFunctionTable SetNamedPipeHandleState LoadLibraryExA FreeLibrary CancelIo ReadDirectoryChangesW CreateSemaphoreW CreateFileW CancelIoEx RemoveVectoredExceptionHandler GetTickCount FormatMessageA GetSystemTime GetSystemTimeAsFileTime GetFileSize UnlockFile HeapDestroy HeapCompact DeleteFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI RaiseException LoadLibraryExW CreateIoCompletionPort HeapFree GetQueuedCompletionStatusEx ReadFile GetProcessHeap PostQueuedCompletionStatus LoadLibraryA TerminateProcess SystemTimeToFileTime CreateEventW SystemTimeToTzSpecificLocalTime WriteFile GetOverlappedResult AddVectoredExceptionHandler GetTimeZoneInformationForYear InitializeCriticalSectionEx

oleaut32

GetErrorInfo SysStringLen SysFreeString SetErrorInfo

bcryptprimitives

ProcessPrng

ntdll

NtReadFile NtOpenFile RtlNtStatusToDosError RtlGetVersion NtQueryInformationProcess NtQuerySystemInformation NtCreateFile NtCancelIoFileEx NtDeviceIoControlFile NtCreateNamedPipeFile NtWriteFile

user32

IsIconic IsWindowVisible CreateWindowExW SetWindowPos GetMessageA TranslateMessage EnableWindow SetPropW GetKeyboardState SetWindowTextW GetWindowTextW DispatchMessageA GetWindowTextLengthW SetWindowDisplayAffinity MonitorFromRect ToUnicodeEx MapVirtualKeyExW GetKeyboardLayout ClipCursor GetSystemMetrics GetClipCursor ShowCursor SystemParametersInfoW IsWindow SetWindowLongW GetSystemMenu SetFocus RegisterTouchWindow GetMonitorInfoW GetAsyncKeyState GetKeyState SetParent RegisterClassExW ScreenToClient SetCapture MonitorFromPoint SetWindowRgn DestroyIcon GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW DefWindowProcW RegisterRawInputDevices AdjustWindowRectEx GetTouchInputInfo GetWindowLongW GetWindow CloseTouchInputHandle GetWindowLongPtrW KillTimer InvalidateRgn ReleaseCapture UpdateWindow FlashWindowEx RegisterWindowMessageA GetForegroundWindow LoadCursorW SetTimer TrackMouseEvent SetCursor IsWindowEnabled IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetCursorPos EnableMenuItem DrawIconEx GetDC VkKeyScanW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyMenu PostMessageW RedrawWindow AdjustWindowRect EnumDisplayMonitors FindWindowExW SetCursorPos TranslateAcceleratorW MsgWaitForMultipleObjectsEx MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetRawInputData GetMenuItemInfoW SendMessageW ChangeWindowMessageFilterEx RegisterClassW SetWindowLongPtrW MessageBoxW DispatchMessageW GetMessageW DestroyWindow InvalidateRect GetMenu GetParent EnumChildWindows

advapi32

RegCloseKey EventUnregister EventWriteTransfer EventSetInformation GetLengthSid IsValidSid GetTokenInformation EventRegister OpenProcessToken SystemFunction036 RegGetValueW RegEnumValueW RegOpenKeyExW RegQueryInfoKeyW CopySid RegDeleteValueW RegSetValueExW RegQueryValueExW

shell32

ILFree ILCreateFromPathW ShellExecuteW ShellExecuteExW SHCreateItemFromParsingName SHOpenFolderAndSelectItems CommandLineToArgvW Shell_NotifyIconGetRect DragQueryFileW DragFinish SHGetKnownFolderPath IsUserAnAdmin Shell_NotifyIconW SHAppBarMessage

ole32

CoIncrementMTAUsage RevokeDragDrop CoCreateInstance CoInitializeEx OleInitialize CoCreateFreeThreadedMarshaler CoTaskMemAlloc CoInitialize RegisterDragDrop CoUninitialize CoTaskMemFree

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

comctl32

TaskDialogIndirect DefSubclassProc RemoveWindowSubclass SetWindowSubclass

shlwapi

SHCreateMemStream

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow DwmGetWindowAttribute

gdi32

BitBlt CombineRgn DeleteObject CreateRectRgn CreateDIBSection SelectObject CreateSolidBrush DeleteDC SetTextColor SetBkMode CreateCompatibleDC GetDeviceCaps

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

bcrypt

BCryptGenRandom

ws2_32

WSASend listen WSADuplicateSocketW accept recv freeaddrinfo getaddrinfo send getpeername shutdown WSACleanup WSAIoctl setsockopt bind WSAStartup getsockopt getsockname WSAGetLastError WSASocketW ioctlsocket connect closesocket

crypt32

CertAddEncodedCertificateToStore CertGetCertificateChain CertOpenStore CertFreeCertificateContext CertVerifyCertificateChainPolicy CertFreeCertificateChain CertSetCertificateContextProperty CertFreeCertificateChainEngine CryptProtectData CertCreateCertificateChainEngine CertCloseStore CryptUnprotectData

psapi

GetModuleFileNameExW

pdh

PdhGetFormattedCounterValue PdhRemoveCounter PdhCloseQuery PdhAddEnglishCounterW PdhCollectQueryData PdhOpenQueryA

powrprof

CallNtPowerInformation

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil trunc floorf ceilf truncf rint round log10 fma _dclass floor rintf roundf fmaf fabs log pow fmodf log2 fmod

api-ms-win-crt-string-l1-1-0

strlen wcscmp strspn strcpy_s _wcsicmp strncmp strcspn wcslen strcmp

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _beginthreadex _endthreadex abort terminate _crt_atexit _register_onexit_function _seh_filter_exe _initialize_onexit_table _get_initial_narrow_environment _set_app_type _initterm exit _register_thread_local_exe_atexit_callback _c_exit _initialize_narrow_environment _exit _cexit _configure_narrow_argv _initterm_e

api-ms-win-crt-heap-l1-1-0

realloc free _set_new_mode _callnewh _msize malloc calloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-convert-l1-1-0

wcstol _wtoi _ultow_s

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

11.3MB

Virtual Size

11.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

3.8MB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

51KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

258KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.linkme_

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.linkm2_

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

78KB

Virtual Size

78KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

rules/community/reversinglabs/yarabackdoorByteCode.MSIL.Backdoor.AgentRacoon.yara

SHA256 ad94587b8bd057e0063a58764454c0d446acb18ce5d375b4a96ba6e293f7b2e6
MD5 c7d100aa98c823ec5cbfd82ae6dbb6bb
SHA1 77032e9aee82b7d7556845ff9d22b5bad54a137d
SHA512 7102feb125b7c79203ee35baecf5c0d0f9bd149563e1a707a61d241e5de7ee07a34bc750f3b7504c9715350c4e3d760108ca5f93c6e6d4ca418d79140e214c02
SSDEEP 48:CLUMVFVhEwlzSxJ9+3FhAJDl0szjbpbqTwGUxE91u7M8ct9:+UMqye+VhWOXwG3jIM8cP
TLSH
T156F16E48D4FB15805C74BF74AFB58AE636A6C1F708240E1BB11E64B84F7BB572393889
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorByteCode.MSIL.Backdoor.AsyncRAT.yara

SHA256 e8f58a326ea72c929c1556a699fd348fb39b26df97111403a58598ad59ea0158
MD5 d6427e84985092d68eabf89b9c2a4340
SHA1 7c23a6159cee1aa1b077cf9c79cb0a04b1bb8f93
SHA512 88cb3b46f89a9d96b01765b80d001e54159fa8868a5280b43bcf6476e0dfd63ee1aebb9a0d8c3c0b278be1a9cfe9850bdffcd2a06e99a238ce2aac5939a61a52
SSDEEP 96:4/RRE8r/Df4a3p3qJnmaCnWZrIQd5zDaAe:4/RRE8lI7DaAe
TLSH
T111123C9CCCBB264048A5BFF4FF75919B2A37C8A305140E0F734E58785FAE6166393816
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorByteCode.MSIL.Backdoor.LimeRAT.yara

SHA256 4d60335497222846e00fc8a8e1260e43655a7fbf35bdcc2183f9253893564bbf
MD5 a91ab34dad055ad8ca0ec70068f4a092
SHA1 426f1252e277328500e11eb2cc8817f47385f68c
SHA512 9c17a06a68d56dabeaa29f41e9006f07a85df3cd16534c431fe950fcd4cc29e363fd37f184be1462568fed06a9c09b62d267eef495ed13b2038739794928e01c
SSDEEP 24:C1w1qlwalozoHac/YpqA9dvnVtOfvFlhM4d4PzQ13d30dYLja8CF8In8E5ZHF+cy:Cqr6d0ufNlhMfdpPLiMJNatarKl
TLSH
T173A13D4CECFB115048A9AFB4BFB1D32A76BAC16B04240E6F719D48740FBEA0B5397254
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorByteCode.MSIL.Backdoor.Menorah.yara

SHA256 98dfb256119e169f86b8761c8ae1cffa9dcb5474d7a3dc77c51420267e81a2cb
MD5 eb69a2e1c4bdaa6a9a98698fcfd078bb
SHA1 58d2db6a56b95ab3c7edbea872403a3e2ace6f2d
SHA512 45893f50ddb2eb00a4de06fafb60380a3449755d5d95968a89d475f84793bfcb4b3625bc5837e0b14e1440fce8eaacdb4dc5cad6963692e5c3210d8799007153
SSDEEP 192:tten1Kk3NkIUkJTkgknXlsOw9luEim8VlBkXkERBNB:Wn1Kk3NkfkFkgkmObEB4kXkQNB
TLSH
T1B9427E4AECFF014105396FE0AFF1036A1AF682AF14144E3B70AE55B85BBE913735B265
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorByteCode.MSIL.Backdoor.NjRAT.yara

SHA256 3dc65ad7d050ad3f82340ec6e10be54adb5e02dfab50540423e9443090939a59
MD5 b19c71a758408de2ea282aa33ca92365
SHA1 6de21e33d69ba6a602ce54c1c794b8dc3bca7241
SHA512 6dc09fd9acae173eb5cc192d98d90cf752e69511993e22b7827615d2e6f467042f78e2e797b348c3901769323a6c792255d64f8c61ebee158f4c83e25d4cfd84
SSDEEP 96:mB0bbnyHHX1YwYeFEN3IgG9fCruv89BWIbvhca8DSTerEHY/GDaXDkple:mEy+XQCqKfaXDkple
TLSH
T12C82EA8CD8F7168188746FE8FFB1D68A3A7AC1D704240E9F725D64784F7E90A6793848
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorByteCode.MSIL.Backdoor.OrcusRAT.yara

SHA256 0fe971291d8ed49bcc7180384d046d17c368cf1aa7c7217a74b27d5190e5353b
MD5 d76d476b0a6a3eb8ac9953a3482b18ac
SHA1 11ebd10b1926240168548183ed4fbc1f69ce041f
SHA512 298b034dcd2a72e0bec0f76a0af65fa16451994d05a8af5d5dd5c1362f806bfacecce2a76cfcff7e3aac34052484f06b41cd8518100f6942a271d49529b64dcc
SSDEEP 96:+9O1SYQIqQIHmomkHPHahrrCHfPIpoYQI5OI:+9OsIVIH1r/PIpiIoI
TLSH
T1D6026C98D8BB12404C75BFB4FFB2426B26BAC1A704140E1B725D58384FAFA57B393558
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorByteCode.MSIL.Backdoor.ResolverRAT.yara

SHA256 4c45f9143bd07042ceeba93a853fb6d7949c1a64f148ff68344604fe6e011a05
MD5 eea4dd2bc81fa2a5c89b3e0396c5c329
SHA1 28b4d12d51221134204c8f8da545f5b42484a9d4
SHA512 e4f69f453a384efd67b58f9055bc4feb5e41ba0576eb48a856f6c1776746b3a0d0ef17e8001d22e7c8a471dc9822e9ff4a39732b533f380065780d272e6df59b
SSDEEP 48:C0CqD/ZcE1heJ1C/uvC7w1dftRGW19/SEGTwjpk:06ZcmheJ0/ua7KNGwIwjS
TLSH
T1E2B1F05CD9B3225180A56FB1BFB5C94A7A3BC05305200F0F764D68B84FBEA4FA293559
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorByteCode.MSIL.Backdoor.Veaty.yara

SHA256 a7f5298ac29b341bbfa6fc22d3579bdf395c5744bb68d50dc9a289c7f8faa6b3
MD5 942b6b317a747b3b4c7a1f04c05e2fdb
SHA1 111255e7a7b733d197c35363ea5b0914ee4d1665
SHA512 05a263bed78be8cadb511748779e1046b0f9fc3bd411efc2bc4f78f75d072cd59af0806766ed29c0e09f227ba5c671ccb7301610f06762e8f50b2efc8fd40ebd
SSDEEP 24:C+w1qsGx5MpoblIQYZDYsb6S3uvia9ypTLgkiNFSsXorSsV873GABZ5XC5XMFtS7:CxyMbvpl6XGV8+lLlyJuEi78pSM6JONQ
TLSH
T16DA139A8C8B711504C75FFB4FFB6955B662AC1B304240E1B720EA9781F7FA1BA393449
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.AutoColor.yara

SHA256 ea5910563d78c6c6371fa8b05a550596dab18f92948ae2f72b187903d1a71e6f
MD5 449f8d1b11c7f2d95e2133c73df8f2f1
SHA1 0ba4526b6397a40f349080c1d3d5e7bb8ffc3d03
SHA512 e144e9edcb7b4eb572a89b7fbb21bb93d303ac3aa323d4b68257438737b0ad853faa0f4986e0ac2252be3ce07d3d82a2ce3492c103028ab3c789a0faf758d88d
SSDEEP 96:WEI2SWB08mu2q+DgTD+suZDuQcazeoM6zBHCNXPqjD7a6y+Ond/9Alc8Ev7A8pUB:Whh8mu2qtTKsupuXeJCNymXkBrDR3f
TLSH
T14D42F88A884352DD53267E396F33449C96BB892B1E110E4BF66D55312B6FD3B3B33502
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.BPFDoor.yara

SHA256 e9842659f6226bab6da5b46a8dd3fc85cc6ec536ba1499ccbc998c06e13aaf17
MD5 d8431f3d10c0581c83d6bf467fe2afd3
SHA1 5fcfd097c08879d39fe5ae87225c238b23dbf17f
SHA512 8afa2d1cbb8164950f27cded017a2bb872bc86349f9936485c5032bd97135f931f16280876627648eec90bae95992af7784a13672336bd39e4252d31c5c51d6b
SSDEEP 96:IPp0WL7m0Y65SV4289j1pdfEuZpgV5SMK+p37dZMBq193nOOKZuahO:IB0WHmF6gQ1pdMuZpXA7TbB/KZuahO
TLSH
T18DB24885A803528DD7613F3D6FB394986A7BCA2B19020E4BF25F55305F9ED2F6637006
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.ChaosRAT.yara

SHA256 a6b2f6de153bc135a88c0053fc24812b2b757bc9a5e5f1b68d3bfbfed6a8d55d
MD5 608d12a0d48172ae73e1ace712ca3a7a
SHA1 78b54d69303f0b3e475421e81d97004164dca717
SHA512 593c6c5c5b77c5564f67f17ac0d2d43ee19fc226cf34f85045f9181acdd8c4dd37c8f8082022fb198d7928f233b68ef5d75fddfe51987076a5d3d2e3ad0b5981
SSDEEP 384:hxuh9kxTtmetz4N3zH/AdowdKAqYRNju+:hxu2RmUzSDH/AdowsAqYRNju+
TLSH
T135821089984352CDC3237F366FB344B8986798171A412F0BF86E25B56FAE9277773006
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.GTPDOOR.yara

SHA256 0151ee1a8d9fced85f5a863d2d110c28354f12062460b62e7b31b3f529e3fd96
MD5 c0a132a181163b7df709171aa356edd4
SHA1 2887ec72a6cd0ef08edea89036c0a33104e8321d
SHA512 3caf614913b1a3006b845759b27f6abfb2575327b8ad60d524c7f6f760dd8eea4bd74077f1a7fc8cdeb664a5906af3f415b01620eb8b8e938910afcf715d8c48
SSDEEP 96:JhGKsaE4piZIR9TQm1o0zc3c6CGRvxJO1lkvkjAGAgvlwnhwilTs+wQSVV24E1s:JhG5aE+fQSQ3DvxsQgS6VV24Ss
TLSH
T17D8230D99803529DE3213E3DAFB398945677CA1719130D4BF24E68706F9ED2FA23710A
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.GobRAT.yara

SHA256 6baa9aad35ae4c2424a6c9f8d86936e4a4345d5be4bcc7c8ddcdb00521ef34f0
MD5 a9fcbea31904e5236b7e4c091304c344
SHA1 4e4629ec4e357172e543b6a34d1ac069bf2aafa3
SHA512 d96c91994adfaa9e8fdc6c677094d107f4f7bb34660bf28e1159b1bf628714d4dbed0e7a0b2d56f449078ea9a16b47ea1fc8a24f5d7d6f40191e2a082106bf56
SSDEEP 192:rOwOKHKxw8kSj+TYWuNl9tqX9e/6+0mIIcoZAl7jaYh:sxEHTTuNl9ti9e/67mIRoZAl3aYh
TLSH
T1C8328985985312CEC3233F316FB284B8A427895719112F0BF86E2475AF9EE2B7773516
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.Krasue.yara

SHA256 d85f8ab809708e2bbe5b91245f15fcb94eddbf9a5fc40a533a7fbcdb2ed3d954
MD5 cf9be468ecd92f660229cc8e9885c12b
SHA1 1973dc8f760d4fc387a0617e7b4208aa26a79839
SHA512 c4d8ca449ad3f25d363bf7b75c261032477d54b0037abd34f2552e7703e67787ad6a6e0f3b6c8ae27f91a5ff1097f64dc7c0f110f9d3ac6901f6b3aa7eeb8074
SSDEEP 96:zfYgdmx1LPlPxdSn6rLpj5mruYUhQF3S+gL3urjbzo:zQgdQli6hUrTUhui+gL3urjno
TLSH
T1CFF18D8C9C4343CC8222BF2D5F73849956BBC9A719200D0BFA5E64746FBEE2A7633415
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.Linodas.yara

SHA256 336d0396c0aaa00670a518e69dd325c0de49e4b49e00874649858f69a95922e2
MD5 67ffb9c83ca65cc2c013fdbf6baf30e0
SHA1 f0b3b9e75815c6d126196ef1e75e48edcb5ef8bf
SHA512 ea99c1106737470b22fc4bfe3abf30f3e08bd6626ff02a450fa65045c60c1790d422e0ec30149ddad043935e5e1f6c4126e09a692825b6a5d2fcb46c9355e615
SSDEEP 192:G7i1xPqw6hCgJbPEax1ettTaANJajmBHdK4uUfWmn:Guw8sEUkqANN9K4uUemn
TLSH
T105626D895C5752DCC323BF295F7384B865BB882B19242F0BF91E10786FBEA263673415
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.NoodRAT.yara

SHA256 09119abfffbd3faa4240a603128718820b6611d79fddad08ac1ffdc10068ebec
MD5 90d2520ddf7860af207b2a73e28e7a40
SHA1 1dfe832a97ebb04c723d1436ad44bde1e0440820
SHA512 d7a7bebea9cf7341d8f2e85838db395ec688579ae34912eff5d6c492dca9a3f726728b9a9daab1eb04a3f1f7c46787f4075affbdca11a634143f371376abb561
SSDEEP 192:vo4zJygZqywWy4E1RIXxuKyLLFx5ogJSzsg:Lly4E16XlLzsg
TLSH
T1273246885C5352DCC223BF295F7380F866A7C96709501F0BF92F24B46FAEA663A33515
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.PondRAT.yara

SHA256 f5bff4eda87a25e038ed6edcd9321a1d989b6529fff7e0d041e9dd76116d11f1
MD5 0639ca41e0e1d44f45a42287e7f65e39
SHA1 19fd7bd1f937e7795ee2775cdfeff24290b8fcd3
SHA512 07ba28475ea64a3ff76254042aeb52d5da456931abfdad0c044c14f57c4e811fd66f7e3620299681c1aad0279573149eb244bb7a138584a6e6f327747f1f5b12
SSDEEP 48:Sfi4QHmGcw+VTNgrlGIw79p3oCljpPO/AMUnvPyX7IL7PPZDC1BBl7lsFM2G7Yju:SSNyXXpfoCuEN2tMe6iwS59ZKBBi7
TLSH
T128C1AF8C585352DDC227BF389F7340A9A6B3896319600E0BF55F65705FBEA263B7301A
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.PygmyGoat.yara

SHA256 c51f0a22516d7f8da42cb6b6e6c187024debdf00e4e03b1ddef4c9cd53b02daf
MD5 5a19fbc8be35b4d55b6519dfd4f76a9a
SHA1 7a53d45a497dc72c9adf08797609e1ffbb22d182
SHA512 2fbaa11a0bb4b598f18140c32a8e1b9a63dc13c3370f9f256073ba745d5f7469a70e00e502204b5c561c543cd89a213c006d89aa40e90f86dadcc367e65b2459
SSDEEP 96:RzI000IAnVJJwlyT0Q8+T8/mrpO060KrqVE:Rc0qQX8+l8060KrqVE
TLSH
T12A022A89EC83A50896763F2CAF33A5987577C85B0A120D5BF61F94706F4EE7B5533802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.Sshdinjector.yara

SHA256 79829c936d3991ff80317593ca4b1b30caaf16d5d408c71c0749eb9c6a5098db
MD5 d4f194855ca6f67f4bf2e15376b17b19
SHA1 b0b7311c94befb94130c39962cfd0299d75232c8
SHA512 67a33dd642b30f6f5a9ce244c9c10af2228c6ef56a8a567019014c7c3a5cb522cff7e7ec9ba6f8e3e7051d9ea7de192df57e8bed354383649835280aff35d6b4
SSDEEP 192:yYfY2dmkPJRxr8gdiGvgaQus6M4Yswneywp6:LfpCvwp6
TLSH
T1A252D6895C4742CD93237E3A6F7244DC96BA89271E120E0BF65D65301BAEE3B7B33506
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Backdoor.WolfsBane.yara

SHA256 1dc1ae5f2dc3713a2a89ed38f154b0809c37c6d574c12bab8e237b052c7b0082
MD5 4cfca4bea60e975c20a2a7e91b9d6e65
SHA1 45b917a8b16cc1cd65803c544dbd42433289a211
SHA512 cf7e50da024da6e6684680da57ec3b348a81e1372bb64b87f3672589b2b6049f34b9c27493816e1c85fa40410691388712c3cb3cc8b743bc2cb7f035465a537d
SSDEEP 48:xR89kIaZ4O/7owuu3gNk68MjUjy2PGUG1Z0eg1FV+bV+uhcFiCZITtQ0RPJjSVC0:xfEUt+LhRR15xMrXXO71qF+uRJ11T
TLSH
T1A40279855D03A2ECC363BF395F7240ACA636886719111F0BF95F20756FAE9263B7311A
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorLinux.Trojan.ChinaZ.yara

SHA256 9b2adf035601910953d70d9a3e5d6069c1c5c14f065d4b4910a54394ed5b546a
MD5 428f76b3d856d0003fe1dd1cc07fd7a3
SHA1 b5fad4787fd5e34c37257e828a950c68db49a351
SHA512 4510a996aaf3d1a55c5477331968b6b84ddacce926204a9b775aeef2cfff16014948760024488baf757a3349dce1dc12ca30732bb2cc37f49155516095409511
SSDEEP 96:iZwp/8uAJxwsO8uAUT942sfY2a8lpDhDW8BRAP2r6QAXv7SKbbdjJIuswPVC5lO7:iqpQRDhDz040v1bbdlDPVCrOTui
TLSH
T1D77245886853529CC2267E3C9F7350F81A7BD92B29501F0BF64F60356FAED276A33116
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorWin32.Backdoor.Konni.yara

SHA256 65d58c6c5932d9be2bc3379fd543c5e00ac49f126d5f2e64ffec2a5694211ceb
MD5 e3a3a0613a13dfb60f6c81e3efe060dd
SHA1 a5e8d2dce4a6dd943818fc7d7722dee59ffb8965
SHA512 35dd59f4540eaaa19142f18d048f43aa3fecee9d493837408d4404e2d43284cfaef1c4601d64713ed2c600994b552281d85b4c15ae8bd2da7ee970302bf1f5fa
SSDEEP 96:cjf3jjQJzVqABdX/0ar0zndiGF2dTSvVcqTMeEnOTp:GkXcDdio2dTSv1yOTp
TLSH
T198523BA5D88382499B363F2CEF72A7846577C89B09054C5FF21E95392F5BE378573802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorWin64.Backdoor.BackConnect.yara

SHA256 04caad9a456b45712a3f1efff376d1dc16b0d10203a0e5465e433e7c82ed885f
MD5 7958b9964e5550ad74d394594a5484c0
SHA1 ef081b921988d4f3bc7cf38d291c957c5b1815ff
SHA512 4e82aacc0286722b17a844b4beb3c7fefef96d57b217bbe254c6391c6b0394b2db88a37053cf9366ad4b05d81326cc2c5b68fba76591e0152aa17933afdc26fb
SSDEEP 192:1bLcwiBBVhfQ043ra5IBIITm9u1Is6ss2ssHOp0Ws6J:lcPhfn43eyKITN1bC0Ws6J
TLSH
T15322AE89CC0751CD8336BF296F7644B82A76885B1A414E0FF91E24B46F5EE7B3273816
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorWin64.Backdoor.EggStremeFuel.yara

SHA256 776b989c2e22b8fe21dd1426c4a14084f6e96f6fcef4ab88e220de3a323a4aec
MD5 a7320cdcd9b2249b2a3526720a8fa436
SHA1 500688f1054e6eb444ce74e9d39ea24682c14bc0
SHA512 12e9ab512750343d98faffefc7ec392162b5480aad99ab284183b3663e2521f67e226ed946e608f369c6c4d1db85c0da2b686a892d976bf22e206d83026ce3fa
SSDEEP 96:bKqCor6qJY3Avtl/RntZ9g40pVeOMw69nbsqUwIyn39oa59Jh:bKm3tl/XL8eOunb6w5Ga59Jh
TLSH
T1611236C98C4741DDC322BE286F3244FC167798171A124E0BF92E68752F5EA277673516
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorWin64.Backdoor.Konni.yara

SHA256 ff76606ee18d15a6de590dbdbbb55e9b75efedf38f9c1bac7c54fa3cc68e7e28
MD5 cf46733b0440511833cbda7fde836570
SHA1 8c68acfbb81bfb5e6d3488bd2f45390fbb3f95a4
SHA512 d0bd208331c31cfb56facdf1dc91d989c43f09db2e2c755ea4def189879a86378924bfdafef3ca1871e001f4473db608c04282b93b37b5110c98f0f536cecce7
SSDEEP 384:r1a4+XaZeJ+DoZ5JswTMJNLrAk96wrI69m7OTj:r1l8CuvJjwJNLrAk96wrI69m7OTj
TLSH
T1F0623889981781DDC3226F386FB344B81A7B8C4B19415E0BF92E24B46F8FE677673416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorWin64.Backdoor.Minodo.yara

SHA256 8ba9d4051e0f81f14118c1e6dbe082111958a82ac864f5bb2c4c2a9b5b750757
MD5 f22201f471654514fdbe5c6b2337be9b
SHA1 f84c4e4a77998f38e4ee94334e0a80725bcf54bd
SHA512 8742327a55210bd8ee20fe3e3613d2369b2d64712cea062c72180670ca910ab24fccc9ac92d7e34cfa355979122a3a9792dbc904f1050643ee837e0c27232566
SSDEEP 96:9smgWIWEWM2jQDb3NXVd8hH9uH3HbHl8mq4XKGD9k5:9smBIWyYei9sXbF8XIzJk5
TLSH
T112D1BF84981781DDC3367F285F7384F82636981B1A010F0BF96EA4B16F5ED2BB673916
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorWin64.Backdoor.MiyaRAT.yara

SHA256 774c8df0f403cb7f7b6edd7c6421c22dfeeed9108fd4d58b5ad18e50ea770807
MD5 ca713303cf50e57f7325960891f82e6f
SHA1 746c4533a64b7ea496f3d6b0338d494a083e994c
SHA512 afd89c5132c32296908b7ce74616218507429ff3b1c36fa22dc3189a803539f0ea8857ce7cff3b44076771dfc86b2858ff44714a806444472b2a2251204a9aa9
SSDEEP 192:sSni8gx2FjvA5b2w8TXgDR2QNevjbu+JjSZHX8Jb9f:x9JFjvJw6XgDR2QNevj6+ZSp8JbN
TLSH
T1449243C4980351DEC3327F29AFB240B82A679C2719916F0BF96E24722F8ED633673515
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorWin64.Backdoor.SideTwist.yara

SHA256 801deaef65ec02d48b9a8feec2c8d87f114cbf26cf3f52dc49f7faa9491162a9
MD5 9acbf1e880961f276786c856185b7599
SHA1 c01d46e9133244a1f7f10c01078ebf3e1c9e732b
SHA512 f04bb366de88c2310b1d88d549331bb0b06114e3f8f55f2a754a3bfad9b8d90e80cbe875b8a982df762ee1d24d647ef93b9d65d9bd64a6b4ff4a183f8a709779
SSDEEP 192:ES1uxB2vzIGeDx+x1e6CIGI62IxezTGnr:vzTGnr
TLSH
T1AA228785A80B41DC93277E246F7A989C953AC8071E420E0BF8ADB9355B5EE3B7773407
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorWin64.Backdoor.Voldemort.yara

SHA256 e8874906bd89b94d2c1c589f29cf3de9012bee3214c74252a4f123317d6e043a
MD5 63e72f936613cb3ad056efcba6dc3702
SHA1 3c54286759db7d87596f25f6e60f93a333c40aa2
SHA512 398db00b5200cc7a553443899dba786d7340ddfc66781b92a2721022b3dacb9cc983abecf91ef44acbdca39280e8a9aa84ac09e30a212bfcec79042a29211744
SSDEEP 192:y15ZgvCm5cN+fOroQDsdzeYhBydmrpJBGpcYSjwH:aP+Cm5cNEOxDslDimrpJBGpcYSjwH
TLSH
T11C6299858C1751CC83227F296F7345B8267A889B0E505E0FFE5E14F92F5EA6AB573802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarabackdoorWin64.Backdoor.wmRAT.yara

SHA256 c70afc36253e5fdafe4cd948093edb2a370a718993393b78316ae14fa8d9a59a
MD5 de32dcf20e615d16518789eff0fcb0c7
SHA1 96e95999c67b861cef5a56ee223b3a9c41315ad2
SHA512 74844729f7522b9f775d185047c3faf9dd2084f0878e325ea9afb4e1a85890571eed889511a32276c0a1494a2dd24e7f8df41a660f343884824bfbab90f9ed3f
SSDEEP 96:J5VxCVQOgUet/Ibvev0RVGeJ01m1kDvrMX9UX4YVINf8w7SS:J1Mj3JR7SS
TLSH
T12712A394A8439299C66A3E3C9F7361F52577DC6B0A801F1BF62EA4342F4FD235A33406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yaracertificateblocklist.yara

SHA256 d56f31e58a17e82fd7c4815bfa3dd28cd06ff34b1551c9ab5c2f240f03b42986
MD5 5a54d4987480de0a576ca6d6b1b031fa
SHA1 fde6a1b1d0f0e9674335c094cf9c008b1c5756f0
SHA512 28515d0f24b45d0529710f3c9075637234fa08978c4adec4278f7473c799fc21fad8ad781329a78f632c2a7c621695cdb0a817c9ee3711f6a4e9a942f7e530ed
SSDEEP 3072:Q/UUPmkjACwMl1IcMXHzfg7B7RrQnnUX39c:QcUuCKMl1IJXz0NrSnUXi
TLSH
T16CD49E3EC514A9F3108FE1154DA39C49AB51A86361851C8879CEC7CD1F6FA328BFA673
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yaradownloaderWin32.Downloader.dlMarlboro.yara

SHA256 abb2f1e2cda49b2011815917d699e86a7d03fbffbcb27b9b1476583658774680
MD5 70b58953ecda81136c4643bdc51fb6f4
SHA1 7f60697edfb41fd08c9fca860d10bf75ade39356
SHA512 6f8a91338141e489a101986d09952b68bd40c9eed43e80a0c5bdd9bb41d2237b1f30873e873df586e9be2f62ecd776d2affb802b00e61a1c55c1cfc5ccd854dd
SSDEEP 48:UG7eA5WJHjZL3nxFdK+rTcG9cXUpJ4+dWb3X88r:UGqA5WJHBx++rS6J4+daXn
TLSH
T1D7B10A96988352598BAA3E0C9F73EAD825B6CC6F0D024D5BF12E91782F57E378473407
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yaraexploitWin32.Exploit.CVE20200601.yara

SHA256 0693dfc62c4c397cdec5573fe5fe41b3bf445cd634b0a2b278a6f5ba8cf8e43b
MD5 de2755a11f4479b5513611cb052795c3
SHA1 e0fc3066c844929a91c298fe32b0fdfdbc9ebfdb
SHA512 18d06ff8462f466631384f95fa67548e3dc2ba596ba6a90718164b748eaf2f2f8fe9250cbc262d2499d97f2d5d69df0196c24de6b0d7abc93dc520c2bc0e8a1d
SSDEEP 192:3UaOwlJOfgUJUbhiWOFPJdhtvWOQ0mJI0bbH6Xl:kabTm43gRtvLmJI0z6Xl
TLSH
T1E022A68878A2228DC031BF4456BA4546E7728A270D155C07F5DDB1B01FFFD2E5BB2A2B
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarainfostealerByteCode.MSIL.Infostealer.GomorrahStealer.yara

SHA256 d44ce257485dcf25e7da11364e41e7eb3aeedd91c49d2193c04eefc548fab181
MD5 9e99cc6b79014bf6204605415858ef26
SHA1 47bc961341333bf5bea02d94ebe3d5665257fad3
SHA512 16b9da85704ac0d677dd414186934ee4b4772bce674ce6c7bbfe661365ef57d6826684c46c282e9caac1c9cbab83b06f90aeac2d8f106155569cab8df05261ad
SSDEEP 48:CU/FW2h5SVLCduGJ8qCaqzvDW2h5JjspX0z:xtW2PSRuuqZavDW2PhspX0z
TLSH
T16DD125A8C8BB11918C74AFA8FFB1854B2766C1A304240E6B721E64784F7F916B797489
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarainfostealerWin32.Infostealer.LumarStealer.yara

SHA256 7945d24a6578df97eb1cae81fa65eb8681cf164feeef9c7027f9ee3448195730
MD5 68e4d7110b5e7c97025de2d84980d57e
SHA1 e116de42b2f370c807862070fa999714558adbbd
SHA512 26c837c309919d0c6f79d6a3c68ed48550b8b652a9211ed94f8c83b96ae80dfdb9f4997f06a5abe8d08e94ba88fba5f71f33f9c97d7adfe31fe85c5f8e5b583c
SSDEEP 96:xPxM/cXKR97n1AIF4Bef9qhOuSgS3qpQjlutgbd+TxS9HG0GY9:xPxM/ciX2e1qPy+8GY9
TLSH
T133521EA89C87471457763E3CDF72AAD525B7C86709020D1FF25EA8386F8AD3B9237502
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarainfostealerWin32.Infostealer.MultigrainPOS.yara

SHA256 2e353e8b0a938aef7b4cfc9ef7fe442bf9f6418f3f8ef6a676bf1bfef99189c5
MD5 0fd0251252ccdd481d37c24b24c169cc
SHA1 3c4bdef51a0523498df7de1b0aeee142a9947b77
SHA512 2b21b9bd73c10082d2ba9f710df58c72c2b15590f3915981cd608e00f75b79567412f806710b81d11b0941d5607a7981a5f0ea0c5374902153ad73ce140d002f
SSDEEP 48:n4OoHjflVe0dJfjMtsxc0K0N30hmgfpo0DF+j0tgO+F4c7:nmHjfHfjusxc0K010hmgfEjcgX
TLSH
T120A1C291E8838505C6753F8C9F73E2A4E6B6C89B1A121D1FF61E91342F7BE274173906
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarainfostealerWin32.Infostealer.ProjectHookPOS.yara

SHA256 3fb527a13f2c39d1e84f03c143bc59060d322d4bc72d692bf5a891877249b3c6
MD5 3af27a72f01349aee5ffc93dfc47483f
SHA1 d8068d1b3be3bfda1fc5612ef75823019ce0baa6
SHA512 a44f128b9ddab3a0396894a7eaf04dd1362cac98f4de1b43aeec1025fa00183dc473dc42b5fb87d383bcdbf1e7600770fbb8484285895eb01dff3fa8273481ea
SSDEEP 96:5G9pDVCCfELcLHuP7aFzNZx/ai4gK9QcQA0S/:5mMm1zS/
TLSH
T14CC14B989C8B534567713E5C5F72549CE2BAD0270A030E9FF15EA4787FA6E3BA033906
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarainfostealerWin32.Infostealer.StealC.yara

SHA256 be63d6aecc38d123fb74fcc36a2ef15d647c41b2525c1f42d096bf73977bfa76
MD5 0b6bfe22fc62de2d374460efd6bb2c37
SHA1 30f0898253d02b6e4f1b03fb00f3791716d4d2e2
SHA512 57f51d8ea32c18e514eb80e8b8bf17e0d8e5c3fd45f4a6754c428dfb6ddb153e12cd70270d8f668fc45f69eb759eac64c2ee87acc659bc62a516ea874901e958
TLSH
T18051E384F413A365C36A3E28CF7765A529B2C80B0E410E4BF50D95B42F9FD37557320A
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yarainfostealerWin64.Infostealer.Daolpu.yara

SHA256 68ed8dd25401b00a2d0c5adc0dae396d1748b98bfb009201123fefc09721bb76
MD5 9857ea1903102b7a18c548331a4bd60f
SHA1 1f549ab6870952a0989cedbcfb46774a9d2fb081
SHA512 359ccc4e081b88d1cbdd49021ed054c1ddc5e8baa4da723d85d9923f2fb0366bc555fe32df89ee6a53a8cc1ef22c67165ca7df9444515d7171b6b9a013016993
SSDEEP 192:wkRDAubJhqxRVggbciDvw7G4BAPekU+nthGe+jEozDIuI3s2MKe9d9THM:auC5DvW36PekUVeg5PIuI3s2kd9THM
TLSH
T1E8B21F858C4711CDC726BF289F7288A826B788571D121E0FFA6E68753F5EE273233516
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarainfostealerWin64.Infostealer.Skuld.yara

SHA256 3d00b5d8f71140ea8b3b145249cc250854e2938ca4582b29bedf3f35cb57a715
MD5 62d6478dc02452ceccb3430467de9363
SHA1 6409e1785072ace58ddfa3ad9deb06ca9154efd2
SHA512 33180c67b018b5ffb0e19e3ccc98305d7fcdda58c3789475212580ddb18fc172ad938bc85c44ba713cb6bcefa1939b6a2bbf6d31ed3ac315e7dd9d41b384a66f
SSDEEP 384:zNwtaGmOmZBuWFwV0M9t4mrom2QwQxY64+GkYv4:zNwtaGmOmjuWFwV0Mb4mrom2QwQxz4+T
TLSH
T14B525688580362CDC3237E365F7244B8946BD82309912F0BF96D2576AFADE2B3773416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarainfostealerWin64.Infostealer.WeaselStore.yara

SHA256 72f2fea93afc71108c3ee4bd480d7df18139ee0e2c57b357d34c3028af8eaef3
MD5 bf0ad96f81d220c309cf7bf3562eec26
SHA1 dad6bc74f34c3d3e93bd0f132dceea29b3f6f0b9
SHA512 959cdf34d84bd2405c50b726755f7d5e9a20d67e4ba0b6a1cc24b28a94622da9a5ee8165bbc88d5417e31546b0c257b937b36a8347de1009cdf09046d1b17e74
SSDEEP 192:rOaciwJCbnwUChUHJkQsviXUz1YGolsIrbCToO:qaciwynwnUpkQsaXUz1YrbrbCToO
TLSH
T1D6525884580352CDC3237E396FB250B89567D82319922F0BF96E65721F5EE2B7773016
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yarapuaWin32.PUA.Domaiq.yara

SHA256 b5a918c1d491842400c1f1c8c081f036df994a4ef2c39b9ded4bc9b4b9080476
MD5 5dc657949149522a382f52da0bf05d56
SHA1 7e0b6f9adb7e409d5afd70c57301e0ff763e24a3
SHA512 f7bc939175686bc5530cb502b52599b0bffde0de2b10655662a4d838ba057c6f9a36fc5dfbc542f0eabb2424ba94dcc6a03263e6acca68f9cd109f025cc5124d
SSDEEP 48:NbIUocpB+OLXQXM+C9mOa/2NzRYcGwkavW9CPQFIGL1lFO:NbI4pBTcXM+CYeNzRYcfkIWFFdLXs
TLSH
T10412ADA6AC8391188A663F2CDF77B6846672C95B09450D1FF20EE0746F5FE378673806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Apis.yara

SHA256 bd3f9c6001a6a82defbc9ee06dd8cec933776845a5db405095fc07c0f019f31b
MD5 4dca6d6713a7e6c4083835bbdcc7e773
SHA1 b38b4cc1ec844c79f9187cd8fcbafc770b92ea98
SHA512 c1c5dfdf8a4c458b80a3b0e66b4ed61ed466a12f6206ee4167e24f5931e5980f8da05535f88ad1409b25199d5e093554ecbd39ff1d67b8c9388530a88e08a28c
SSDEEP 24:CIw1qZRVizoHw4Qvl35+bX9IJ0Z/IQr6Bc1QyUp+Y:Cv9YQS5l/V4Mo+Y
TLSH
T1E691E44CDCF7259448B56FF4BFB1864E3A3AD09301240F0F754EA4788F7EA5A2293498
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.ChupaCabra.yara

SHA256 b984be6ac76e243d243bdce1becc883bf6118f5206615beca4ca525f392de4f0
MD5 cfb56fffecdf8e0ece92877cee39ecd5
SHA1 88e935741b4ec9df3d5f609bb768d8054453c146
SHA512 2a30d2b9d04514fdb23a881f0ff6d764a2b59f859bb2916cce42fc409cb7105422b9083922be964a77a6911a9b1a5ba81895aa396524d5a067604dd8a74f742c
SSDEEP 48:CiB26STU5+TY1Ja6+2zAzv5wBNJX7rD50rEcH:HB6T613Aaj7rDSwcH
TLSH
T1BCB18C58ECBB11508878AFE8BFF1855B66B6C2A700140F2F719D54744FBFA1B2397168
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Cring.yara

SHA256 151d19aca6ecbc913c3d10d6a5f0ffeb488ad5588f6b4867906dbc0ac0761775
MD5 3c7371eee31ee905a83b6835f65fd0b0
SHA1 fc757eb16863b58edcb1ad7fe0e773d718254fe7
SHA512 4c8ae1f6470bcc0207e9e738cc10d269219b34c55c3c345011eb027c1d952b1fa1d8aa9dd25916d4517fd185cc35c2e2243c96a1956da9a5b895940b1c65b4ea
TLSH
T1F5719795D87B11908C79BF94FFB28A657616D4B30D200E2BF14CA0786F7FB4A13A3859
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Dusk.yara

SHA256 e98078489c7381ed30aa7d720d744c5b47797207392ac02a1c280abb7abdd12f
MD5 00b4e35a191289a8bac1b5d117f43026
SHA1 b126623450b850db22e0820e63e25afc4a15ae50
SHA512 6748aa1fc8d4c0ff02528d131d89839182b30d56670202a56fc4eed39f83bde528759aa6f6f1b0e0c15d937f1cac79d18dd4bd4059ebf3c038216d97f879b6bf
TLSH
T142719558ECBB20904825FFF8BFF2825A66B6C16704140F2F719E64744FAFA1B6393558
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.EAF.yara

SHA256 d29fd25149f7c5fe5d8d93f4cf68f3368e60e4a716516ed292800e8cc50385f4
MD5 c34e8dc8060aec841a5fa4d1d09aa4de
SHA1 16bf88534066d97db9d6fc2ff5d76c2b48602fec
SHA512 5572f2dca9553f69063e5dc0860c66862653f04b7f3d447e6e4e7de66327213e5c1df1e61ef6676f1c829ae55c0f1ae1c557a2cd7fe408ae93d8a6b25126364f
SSDEEP 24:Cpw1qScViOo0a6+SZTpVrTeFTvvz49+5TVDYYDiYnCgiq1gshcYOR/oWmmF+Lx0Q:CWX8rDoze4vpuW0rEF
TLSH
T1B7A19F88D8F31990CC74BFA8BFF1D4552666C0A721200E8B715D64B98F7FE1A6783898
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Eternity.yara

SHA256 2acf8704a83cd60f844d44a11ca07155dce777692ca2f065ad0c7c4208673e58
MD5 d8c086cb7a3b9299afd1d3eb69cfe9a4
SHA1 efb20a858080622f2cc3f47f65660f7567ac091f
SHA512 ce814e1b7991fc20cb6e1a64ea689bbff949defd592b315ccb0bbb0e7b80107ee6c0c0211e625c2e438ef8f8d46b8dbf9bb7bc7321ac1e64a48f3b0c64dd1e4d
TLSH
T1D271AF98E8B724A04CB5FFB4FFF285066626C0B305240E1B324DA5784F7FA1A63D3599
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Fantom.yara

SHA256 ce63d044e4deb44d2c56735517d61b7ecf66008da635c6d06b8c79c84a39f84f
MD5 3eb37ac185dce037e406ef8f7d6b5941
SHA1 397cf9670aa7a796d24ad55a7e50b404263fcd19
SHA512 b3b8c6aea5b0ef3e6ed84190d314e6470ca6c040eb8ae2ab657a7207aaa9fd86efc5cd4818f7e88722222f4c2c8960139ae7894b41f3daee5a9634a58f1d3d62
SSDEEP 48:CDxOa9LAMZQQQDBgLHByxxBLeMaee+mVH:0x7LKSkBLna3XVH
TLSH
T186B1D684E8BF50504834EFA8AFF143E635D682AB05080E7B703E64784FBAA5633D3599
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.GhosTEncryptor.yara

SHA256 fa6f57aa5f846b711a20c0a47a52eaf33682ad650fb68c868878b00781c3842b
MD5 2e485b5a4da3f9ec8bd7b10d8b72d3ce
SHA1 4bb21fa0c1c0705cfa0e6c5a47adcedad8d2f477
SHA512 ba36f80e4ec778e0463e8f8686154c3ac279c4e9c8fc1791955d15b25f8076f3f9c052fe8e2b3c6203f8a4fcc797b6c3c278a272e96aaa1a725c23e67893cba2
TLSH
T19A517988E87F24904C79EF2CBFF1450532A2C0A709180E1B765F91B88F6FA2763D3559
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Ghostbin.yara

SHA256 2d927ce92241c79f0c6a68359ec5152718f7d94b5e950b04f7f7c4ed94bbd837
MD5 7c867ad94fb9f59663bb59c987eb80bb
SHA1 4d6492430e8998a465de57f2009f594f65bcaac9
SHA512 1e7063e4f903870dbd3920b6b0335f3b474d5a7288770ab10080700b1b50b1a791889d69295878188c74acc7bc6f92f6f80bd533a28b554f7d99046d67976514
TLSH
T1D951DE88ACB721E4886ABFE4BFB2818F6636D17701240F0F358D94B45F3E61A17E3464
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.GoodWill.yara

SHA256 bdb69e5881e82dc5bf1652f7c639d8bb7f7a366b740d5f1562ac967b2bc5cd55
MD5 6a0b2e99c66774fa0e00d231266e59be
SHA1 490e9d6eaac5a19ca0615cdf5308bf0fd070bd57
SHA512 4762a8e31cfd541575f5ca686d1c7f027b0a50fc35477cad77df63bc14d84116d216767d58f37febcaf73fd0e2042fa78b8f280f66ea33b9c7da38608108c49d
SSDEEP 24:C8w1q4y1PViPo7c+h03GL82atecJ7JE6Tb+mZF1tJFWWUR/t6IRjrT8IRjGrW4yJ:CrdTkmJbN5YT8lHUTvxDPEQTGSG07MzC
TLSH
T13DA1FB98D8B716904C75BFB0FFF28556262AC0F305240E0B768DA4784F7FA5AA39349D
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.HarpoonLocker.yara

SHA256 28c2225547c583b71e652f4992145c025723afc29f16018a54d711cce9b644de
MD5 00f2385d1493df011262dbe2be9d55d7
SHA1 28f3d2eac78cd99c8a236f92e403a62bab209922
SHA512 dd0d3758ef4103be9b130df0d3d6c485b4a5c0a0123179bfb440b21fdbc68ac87532660d140c939a756bd1a36d6d280a8ba89af370e377f36600a24a43c50f75
SSDEEP 48:C9tAlT/HkI/GCJJDBCik+L8cxBGj838m8h0Yldt65uDX+rK:CilwI/GCJJFxlBGj838m8CYl765uDX+O
TLSH
T12DC11949D8B715908874BFF4BFF5855A263AC0E704240F0F724DA4789F7FA5A2393899
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Hog.yara

SHA256 bf5f7f640e5db47118ef47f5eb60fec5101cabef2850ee41e8285ae303a5cbd3
MD5 6dc6992bf3617074203399af93718b14
SHA1 d9557ab3fe196132b61f714f2c14d98f603d5eb8
SHA512 c52fe1a6bedad4991b32881f91f1f549ae79bf9bb77e2914bc17dad19e881d9dfe37e19ec47ba1bf4811a043312bb139a2ad1406ccce4187ef123bffd022a2fc
TLSH
T1EE618F9C98A326A08995FFB4FFB2C18B6636C03715200E0F764D58708F7E61E26E3429
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Invert.yara

SHA256 bbda15406528d674b32d00d9b69b50a46eb64fef5f6f79f52fc63ecc78666399
MD5 8ae884f786ee176cead476f971faaee2
SHA1 d4d6127b371212e13d64bc14753c0e3512d760bb
SHA512 49e807bd1bb19299abeb04404731692f1a238aa78a9dff382321267768ce8ce526813df304400fa093e98226a141405b5a9e3486a61fac17835d41b621f261bd
TLSH
T1BA61BF8CD8F7246084A9AFA8BFB5E64A7675C16314100F9FB24D45B0CF6EB1F21A3915
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Janelle.yara

SHA256 91db7e1a8905848436286d6fc06bca787cb3cccb2dcf1628b5e1dae022c36037
MD5 c9f186fd687ac609a8775dd2c7f361ef
SHA1 8f12882ff6e1d52d9ff871dbe7362ab11c11d331
SHA512 3daadabac2923140a24ba6c7b26b4e502efdc0c52744f15c3ba3220177db471742b78e929274463e23d24c4899b22b9648cd33c28ea0b63f15c143fd75b73190
SSDEEP 48:CbpVr7Ap3zdxFsSUaXrPPK4UvU7U8wEU+Y:ipYDdxqSnXrPC4WK2+Y
TLSH
T141C1E6A8DCF72190CC75AFF8FFB1D55A6A26C0A324140F9F720D65748F6EA066783858
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Khonsari.yara

SHA256 e93cedc50d57838c97152ab4b3f9f210260b0a153df7ab52cca77d782f66a766
MD5 bb2f0783c335e5a8346fa122551cf625
SHA1 ae454770930cf501df907b4e1a5c4a1e9cdd6f3f
SHA512 cf875ecfb3c35b3b10587c1c261765a616ad15d0fcc1b0bcd3d507a0479158115c5ada3b2918002d3ac75510267189ac250afe32f2df25a5c4daf4869a4217c7
TLSH
T17B712E98D8B725904CB5AFE4FFB5818A6726C0E704140E1B754DE4784F7FE1673934A8
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.McBurglar.yara

SHA256 a73b3c9d443adbd6385b53ec00fed162c445148b18e3c5ac7c2d0e5e28ce4ac3
MD5 c922f9e5ba801803076a1bdf0c6124ba
SHA1 4d8e8df0da361bf69a3ad2da6a31fbf1de6178ae
SHA512 eb0001a6c6353b80e4d39142082f656999dab8de8e0bada9c5b7e4c8cf4150820afd2a4f26e1f5e00fe6027c256e750eee6b44014e5368cc9f408ebc09433777
TLSH
T19361B698D8F32491CC75BF68FFB1D4466616C0A714100ECB714DA4B88F3F91AA793C99
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Moisha.yara

SHA256 993416e171abd4a41620c8377d06e775f85cadf42a107c4d20cb476ac9188195
MD5 0265acd04de2dee51131747374d2fb11
SHA1 bc866a0569701d78809c5cac6c9fe67d082b4a0d
SHA512 293b4c2ff55a2c7f13d855ed738cf1d898efa9d99c7d1c2b3534e5c89088699bef388ed42e237a9cace79deaf2f2f0182b55ad9d0185280ca5da160e5fa9a062
SSDEEP 48:C9o6HT1VptWNpRSkI+u0nNbWFbcbFp0Wl6Ms6bq0oY:MVT1VyNpRSkI+u0nNyYbn7loY
TLSH
T101A13DA9D8B715904C75BFA0FFF185966626C0F309200E0B724DA4785F7FA0A63934AD
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Namaste.yara

SHA256 7b9c89deb84fbdd183d5df6be9e24be5b6a6091bb22e2a6afe5214c0a9ad53d7
MD5 2386e814c94dbb96192036c463397b48
SHA1 5d398c11816461eaa74197b1b3bf4dfc4034055b
SHA512 da0d38f68d39b697534729c431d100d502e9a1b93d7535a7520a348264ff90018f82be70af2c82e7c08993c2efaf3e6600fb4fdb9f60f45cae1bd50a9c5e39ab
SSDEEP 24:Cb6w1q9pHPViRoyWIarw+G0V0I5k7k5knk5k7RCRERCRkRCRqCRCaI6KIkG07j8t:CJVmx2yrmmkCSpjbYtlbRr1A0Bh0rK
TLSH
T17091AEACDCB7259048B5FFB8FFB1859B7626C57305240F0FB24E48748F2E61A6293465
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Oct.yara

SHA256 15b3a06cbe1efd51d82cf416467e13d8c6d57643858ccbfc4ea1c34dfbdb048d
MD5 103f6281cc6c3c12664b9a923ffe06af
SHA1 ef6769adc1afb98b6132416d033a1db112de6a54
SHA512 bfd8b5b0e5d278292d86eeb2c597ec7bcc3311d85c17321fdf80fd0ac811d015429da8ec577e9c7099c66a78e8524fcb163ec5a4950713bfed41fd9f9e386305
TLSH
T11B61B454F8FF20D04C65EFB8AFB14356B6E2817B0A280E2B315E6478AFAE51573D3058
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Pacman.yara

SHA256 09b4a8723500d5e34fa8796bc5e98bc9afee5d9c8ba32dab8cc225986a822174
MD5 12e6deb093a8fa02a8b9c0f7ae8cb9da
SHA1 d58d3ce0205ec7362652746b139669c76ce37499
SHA512 82d4879a3612c4c3b0ca85b04b179c7bcd79d2ad28025523cffb5beb54c6360ea1ad28ddbfa028706a8a164444794d650b5dd33c342978487c280f0847ae5716
SSDEEP 48:CGRlPoSdPIYNmoSdExRLoy4SSdutxlkIj1dvKSUBpxHREtRoEuEZToSdgEVCSduR:HbxoyeIm9heH9FnnGFFIkMtsB
TLSH
T16A91CB8D547B37D5E0D96F5C3B6C728813E0D42B34A208C5B29D6EB2DFED98B2341285
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.PoliceRecords.yara

SHA256 e6c4edf91488e0da57b0c1fbc67b74ea6f8c781b4b5e8d513fa33dece992eb5e
MD5 e76fe7e614efb430bf1fadb35b4b5198
SHA1 7050abd9635fc932b0a67718f13e4d1cec2d6460
SHA512 95d6efb76aa5a30ce32d19ab9e84f8d00e63d88e03f7adbcfbeece12e74f49c3443d4730431fbc65dc36d951dff787ffb967436a0c71e0f15a2eb45837d2c598
TLSH
T19081A598D8F71590CC75BFACFFB19046772290A314180E9B314EA5B98F3F90A7793848
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Povlsomware.yara

SHA256 77a2ed413792d0e35ff1f704725c6eae7e425e4c09878b6a15c4b10a77508d8d
MD5 d067d0f7fcc35eee81c252e8afad5d67
SHA1 e059e6bb69062d609f64125b17ea1ad60787e6b4
SHA512 d6c24c36a2fc8c3fc93f16273b8a4a8f50cec54a5c133c242f54043bd7aacb9e7badc551395f8ec3beb5522087ab6ea17e5021a519d111e6f9ce422af3b303da
TLSH
T1A161D248D8B72990C879BF48FFF1D54A7A2580A314100FCF714DA2B88F3FB096693859
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Retis.yara

SHA256 c454ff1ac45469c375173d4c2b7365c3604a957b42ebaf75e1e1b8e86b34a7c4
MD5 10b27b1136d00bb15fd124c15dce425b
SHA1 c15bae32753c96f27c22e0a29f9e4991d66a4f9a
SHA512 6d52c3d1f453f01d22fc2304d7999bd02b96ca5ea7119dbafa9a488608cb02c4f08c384611c441f3f20bd273c96198fbe66225e47a820ae7f8d25d59054bebdf
TLSH
T1A5814C98DCF71591C878AFF8FF71D54A266691A320240EDF320E59B88F3E90A7783855
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.TaRRaK.yara

SHA256 1e2748cfe772fe5f273535a07b19058ff0938f82aaee3213b02075e45e0ca139
MD5 96ab0e8c79bc01fbe9bad3115738b19f
SHA1 5762bdf382adb60fbb8ee3175752b094e7a13515
SHA512 d18d3c4127316721f9026eb927a8e6dba53fa6e09b5ffda941a9bb255184a3ba6494d9a4380a33a468e3702560b33d02b70c9a62d2e94581df3732079fc43600
SSDEEP 48:C9d76gs/lxFnJeamZ8V7HiBIpPE0rEGcH:IR6P/lxma68V7HiBIpPjwGcH
TLSH
T14B919E98D8B721904C75FFB4FFB5858A6636C0B704140E0FB24D95B89F3FA1A6793498
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Thanos.yara

SHA256 639929aa672cead11cc6dbb98f8e7c5717eb0c73a8e8c2081757ba53e9ece1ca
MD5 a943d130279d0fb2b131a61abebe4982
SHA1 c338a9f702244909afcaa58034d97bc91a96a738
SHA512 fff909cc0b57c4860a35a80a27e56f4280080fb8a455f91f3dcb695b7aed525c397e48014619400bed3029e99d41dff092a7bd9d162b0fb4fa128c9a9091cc71
SSDEEP 24:Cv0w1qR5Vi/oxRvEwaEwGUGFRgMFM9Wc0GARGARwFARlWRGAZfOgKAk6AkNkQ498:CLtOUlXnU4UPUU2GBTBbdTL0WC
TLSH
T139E1F594C8F72594CC74BF48FFB1D9462A16D4B325540EDB724EA2788F7EB0AA383845
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.TimeCrypt.yara

SHA256 23b8963b05132230f5beefb1963b87e59d1ecdbde656e5b506b2bc2852782899
MD5 291d0e7d11f03bddad9e42fd7d468b3e
SHA1 6bf19692eaff69cf81c782216dec4fad73cb18fb
SHA512 b0a3f65cb4a74a968ac6356a0eda598e061542fd9cd38c34efe667fb1d071b8ed4d09de708fe2d27de740debe1556928211852880ad4ddaca418fcf91d8eef03
TLSH
T162510B98E8F711904459BF78FFB2456975A2D12300040E1FB28E04748F6FB1B76C3915
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.TimeTime.yara

SHA256 2a69f5563bacc62a3d3dfb5f69d15d0a95abf1f323541d3b177560e0cf3253f8
MD5 566286246b9dc336b63b48f33f862329
SHA1 f4cf35229b7063d40c48002d5f9baccf549bfa0e
SHA512 e90130df68ed9ea0f0a54eb2dccb75093f396ef60fba98056867b8e3364488ed90f36c0a6634898ecdec3a01b58ebf014517c92f6d3bdc5e4c3e588dee03fa5f
TLSH
T10E71B498D8B72990CC75BEA8BFB1C5851716C1A710100E9F314DA4B8CF3FE5A77838A8
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.Venom.yara

SHA256 94aa2cd071785a7a38837c2263876f795afa92cba7abcc4294455cfc8217a0bc
MD5 7c8938ee308802f8da2acb359fcd16c2
SHA1 1a82211360655f82e922272ddc5671dc1a34c9ba
SHA512 cf274b331ebb51e243a5649fa39e5dc5d3a76f0a3f4d48a6b7ff74360b34dbaa44edca2f196a03ae83200c728fbd77b06bba3760e70a940647524b67329cad40
TLSH
T16261A198D8FB2591C875BFACFFB1D04A6626C0A720140ECB724D61B4CF3E61A6793C58
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.WildFire.yara

SHA256 4cec769f9cbd8680d48728b8d658f91b117b047d6f886092db4049d6e34cc660
MD5 1796f052625e0760908601fc4d32c8e5
SHA1 551c89db4c430018fb2523c547a60e6dc50cb0ef
SHA512 ce6accc3c0b3363864056a32ce7d2e814f894c4d486fe9610c79abe3e4c7c74b8c585814cb632023b7c765706c2f968032e0098a093b6b8600168a904d692745
SSDEEP 48:CSE0vH+54ydnwvlC3l+flltmc/lh29g21xCAmMW:L9B7tMgZMW
TLSH
T1A6A1EB94D87310558C74AFA4EFF1D18A166AC3F710211E0739ACA9794F7FE0AA3D3498
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.WormLocker.yara

SHA256 598832f1ed3dee3ebbc3088286e57f6b287d67fff8caa926db77a72de4fde306
MD5 4bf55223cc85eb0ceddaf188666c7f60
SHA1 848b83c9635568539093964ead843bfb6cbf574d
SHA512 447e79334409144898834efc911edb4373cc306adc12e6986fac9ba6805e06742b60cbbd8b2996aca591fe06b34671056f3bda52cfcaac3e38157b572fa1c051
TLSH
T1A2618F98D8B71591CC75BFB8FFB5C40A6622C1A314140E8B710E64B48F3FA1A6793859
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareByteCode.MSIL.Ransomware.ZeroLocker.yara

SHA256 734ab1954b11242ccc594a95a10e58999db561302bc3731b108b23bcbfbf4237
MD5 e8b15e0eed33b63161e94575145445c3
SHA1 b82ea8e8ff78464fc46ba021ed06e577bc1d4e2b
SHA512 5b4e8c9dc7b0e5cbe8fb54579b3916a5972b46a2e55ad9e123b51b844a53e59538b79b78946bbd869994468862ad700802ce7defc7daed13b99350d078bced7f
SSDEEP 48:CbYNFVJL4FhlU6jFGBaSq19jwv8dMMMMMMM/GFjUf4Np7O/T:pb4lvjoBLWjM81fO/T
TLSH
T180A15F8C067336DED4A9AF8D3690F4915675AE2735F086EAB21E37D0DF2CA0D434249A
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareBytecode.MSIL.Ransomware.CobraLocker.yara

SHA256 ad00a9e74a43a8cc4a6db8586705aa9d30eff2fb9915d16c9b23bcff991511b4
MD5 95500fe940a8cb1a6c6e4a52a517119b
SHA1 fa9ea4f2d8299642f577db67d5d22d131dfc07e6
SHA512 9a4a2a59a9f064069a45ca51918c3fa976d204e3c5d7e38803c841cd02e31f59ce567cf6b74b5ab49c285f9f9c9285145d8ceb5ab76f1d718e49fee854417ab3
TLSH
T163618F44DCBB16918C39AE94AFF18585A62684E312140D4B721EB07C9F3FE16679389E
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareLinux.Ransomware.GwisinLocker.yara

SHA256 c621f649439429a5309636cab076f5d9e1cb0d3ef046336ab61e434549308873
MD5 1dd7799bbc70e7df880a3812835be83f
SHA1 7fc95f8b6f0c61484c273d90b960dc76e1522819
SHA512 da41bd4f95e2f4932751a16522453437e19e70364d8f6256802e86fe16711b848287da9bc613bdde68893694384b3a10fb3bfd922769972c6319dfc1706edefb
SSDEEP 192:hcHucLaEpTukCX+5iC+kpoBJZ1aQskN/1tlJZAnIJsNxLA3+cR:+OcsR/RJvndN/1tlJZAnUQxLA3+cR
TLSH
T1B7B28B986C4352CCC262BF2CAF7351B42977C9671A500F4BFA1F60786FAE9236A33115
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareLinux.Ransomware.Helldown.yara

SHA256 2da849b584be3feac589b05bb6c2004b9198db7f17d28a9e966a98f4b58d01a2
MD5 bc0164fcfe6e41d8d0bccf7a27c48d7e
SHA1 cc54fd88bc72f073d7f5742df7bb44e411e29b15
SHA512 ee095ea2919190ecae69dd209fa58481937384cc005f9a8ce7b00f48562f2d3c13bda62b4683cc24462dff281d7d855d82d82a921e53a378af993b1c982a012d
SSDEEP 192:fZkS7ZBqaJB/6nV6CqoQonSr/DdPphkhSQdwE0:mS2ZsTbyZwE0
TLSH
T114F17A889C4342CDC223FF356F7340A855B789670A210E0FF95E64796FAE9263773129
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareLinux.Ransomware.KillDisk.yara

SHA256 fcd856deff980bf45269cc800eef0aecf63ba85afcf6dfa7fc372f051238a3ff
MD5 e0ce599383e28df2d112e1ec8d66e7b1
SHA1 d9a55926fb8f1af59db3b3fd856781b7f731361e
SHA512 fe9632db066dac58449678bf937dc6794d17996ad922278537c183b9bf787eb4c8c243b0375d6960f14e3c740bef5ec9254a49453186006d0f1ac47f2908158d
SSDEEP 96:MLJRGlGuj6Bp1XxeXHRxX7D69Rysu+rX+5avMB26XXyulRx0hvL:MLJRKgXUXHR8c5axXvL
TLSH
T15C22909ADC0342DD93327E196F738488D2BAC83B4A124E1BB56E51741BBFE2B7633505
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareLinux.Ransomware.LuckyJoe.yara

SHA256 222bc37c7054891a8122ce6998512159ff04a5e77711d863e12fb89e082f4f32
MD5 ab85ec82c0d6d81625ee251c2aefc96f
SHA1 5ee2a9a0839ea6dac2fbc12508255d7552c43cf3
SHA512 3c78a6685e0ad147838b9482342d9613f74f06e1b57975b5692c6c73dff27887b89fa7ea5cc4073bfebe9939c6cd346f18ffcca0912a555824aed2518afd9915
SSDEEP 48:uuMPc8b0sAP1qN36PcPhyAG3BmPXRUR4FEwoEYlDCWlVjlnc7GDSXXeCGlesuwYw:uuMk8m1lncd86nX5QX9dkfAEobKi
TLSH
T13D228D895C4352CDE3277E1AAF728508A6BAC5371A130A0BF54E40746F9EE3F7A33505
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareLinux.Ransomware.RedAlert.yara

SHA256 a6b67e0ce0d93be4a77627508e3699a8f1d282e449f246c57b12af322d19e949
MD5 5137bb6aa0e732cf4828fe53217edae7
SHA1 86b5fd2aebf9c50d7d364e1d675c9b8292a303b3
SHA512 6441ff8c9a3b9f3a3dd5ac3fc5bf9af7971faccbf4e10c82accc11eccc8330177506acc6aca4a57351f85ef266d0ad036fb985cfd35acbaf40ec6034a411d446
SSDEEP 192:r8SbTqpdnRVVvdr58Art5w6ODYINVR9B9EflYww:T8LVMRJ8Yww
TLSH
T1BE227CC89C4342DDC223FF259F7384A969B7C9671A101E0BF90E24746FBEA2A7633115
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.5ss5c.yara

SHA256 5dca60728ed760001d1bcf973bcb70cd6ef8f417c250a003ac08b288d40c17dc
MD5 2d6e5b80ef23b62dc2628ddc2a4692d0
SHA1 c2a5fadf5be0050e915e72c7e81474567c81ef5c
SHA512 d035d6ee09cf37c68a467c0a6f46c1e11a9a1fc0858953ffc9c45050e016a85ebe4608c0130f05599b839514b38e2d566e7785afe4ce06a191ff7299d3e55a3e
SSDEEP 192:x5alerHiTrINv3I0hktorVSMl+peLIniMHH1tH1j2:UeDi/ovVsWwMYYLIniMHH1tH1j2
TLSH
T1A692DCA19C4346498A753F0C9F73A9D8A276C96F0D030D5FF26EA0791FABE275533806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.ASN1Encoder.yara

SHA256 1edb608652d817074548fdd41dbae46343684d21b4233d670ec6916e7ff84aeb
MD5 27379a8fe93b80ceec84774200d02b02
SHA1 c9296e70ce69c4c5fdc37c075ff53bdaa0be96af
SHA512 1600f39bc5709597a0064918e1eb0c81095b44a8854f1c1f04317f9ac503550eeae9e37fa0424fdb5d4e055b94f6befa6a087ae50d524a781cb7bcf4bfae4f33
SSDEEP 48:Ms4AG97prJEQILgYoeopvkvcf0XOzOk/YkiPQEqwE+tbHFjJM:3kNXIE50vc8YOk8e+tHF1M
TLSH
T18C1271919843965DCA363F0CAF73A2A4E1B6C96B06465E2BF21ED0382FBFD274573405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Acepy.yara

SHA256 41162df95eff134d30249ae6409bb69373562d091b5d5c3984d209ec49829fd3
MD5 100723619af134762fcd699f4a41bebf
SHA1 eb603509e480349271e593b326d863fab67580e4
SHA512 ff5f54c6a6158a548ef842ab2f5b60984be674566db59c454d6b5f009d5daa3debb1688e4c5592029fbb87c33a4257055e054f7f3de4e29388d047853b627781
TLSH
T12861FF896C839228E32B2D2AAF72E74864F3C42706030E6FF64ED9785F56E3B4573501
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Afrodita.yara

SHA256 5b125b67c93091f38ed7def35a027c10b436696f691631ae5f6d0df13596c18d
MD5 aa91023a4ed03e0de465c2b3df8bbf06
SHA1 9a497e14538640ca364437f99965ccfef382fb50
SHA512 f938de746067ffa3021dfba8db29f8a6937c4c6f84e05aad8ffc06c9092fe764462f1aea7b068bcccdb5127eb11a7b369864d7f993a52b942194f8a15284d70f
SSDEEP 48:A4VRpGXFF3fKHr0366Lgsc6siJj/QYL7At9wnYpRcnLrH1xwq:ACRW9CHr0jgsaiFb7k9wnYpRcnvH1xZ
TLSH
T15EF1F9559C47811896363E1C5F73ABD9E1B6C95B0E020D6FF62ED4382FAAE375173802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Ako.yara

SHA256 a6f406158600e9d20cf753024834068ad6f700d5b70151f3fb34801e61930fe5
MD5 4292da8b7e91e62d864416b3c7a31d8e
SHA1 baacb801471f091e04f50cf3b328e46e84275eb6
SHA512 e682123f027b7a0707b7c447355fa6c3a8e84c403614162410985898e3f2e43da88cf58e3043cd23c7e13d456ee7598c343ab47e86bc0ec9de99d929d19102fb
SSDEEP 96:1n1ggtfNpIurm3iDtYggSggCcYYbeJV3VhzrJalHBMgTg2eCogaFg1Mu/+6gIgiM:1a2won71N1D2
TLSH
T1C62291919C87411996757E1C9F72EEC9A2B6C86B0D030E6FF15EE4382FA6D279133807
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Alcatraz.yara

SHA256 e936eef0f065f928e048d1cd3db43436cfa88754f090400d6ba5ffab5d20a00e
MD5 00f143c8e2114fab0d23ca7abc60e6b5
SHA1 56cd70db8809b6037a1c8dca2a1a12cc62518b4e
SHA512 fed97f46c6dc4e1ce4d7a808fdffa50838d53943687c279d6e566fb61fe7d752133c30c89a58f3c2222023d2a6068a9438bfed5d5ab2bd102829823623af4046
SSDEEP 48:HRiwBPbxxg809IhxUywA+uYieW7j/s31BCzDM3Mc:xZhl+0M8c
TLSH
T1BDD1E4A598879A199B363E0CDE72FA847577C84B09024D5BF24F94746B4FF2B9173802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.AnteFrigus.yara

SHA256 3f6386792796c590f4045d201a535869bb4cca3ba9fa80368bde21a4f714f625
MD5 a9445da63e8bc956d241a73578318599
SHA1 65795e7a6f023dcf85badbab0cd4166e573ff3ca
SHA512 61b04521c02f8a1117f3fb13e884c5997594662bf632a96be30b88afe95881e26adaf51ac1e81b5b3436341267420a77eda81ae7c6be39f2adca046108935871
SSDEEP 96:d6UkWrCfdmUmQnttNTYzG/E+gwPinggNsbWogAqNHh0qgWcPABogg/F/RGEHrAGv:dzmtoSPFImF/ZHJZ0kSm
TLSH
T1CD6259959C8791588AA93E1C9F73EBD825B6C86F0D06091FF12EE0782F96E7B4473503
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Archiveus.yara

SHA256 d6240e7409a927259fd7ec1d98594cd59106c59a758d7e67c0c1a9b39472f6c7
MD5 d2ff2678818eb95460233325eeadff54
SHA1 2f1d46c992fea75e7c4fc0317226cee448aaee50
SHA512 aa462b240da376a767c4ce189a4864e87a4639eb5ce88cbc54fb602510ca146d8246886e10dadf7c9ddb9fd05b8e66fcb5692ceb5c81460b1375616d663191db
TLSH
T1F841C6E5F857552A4C7A3F04CE729444D33288AB1C960D6F764E95702F7BE2385B3906
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Armage.yara

SHA256 2527da25717027e38d90459c2c7fbdc93565f9bef666005ba289380aa9e949aa
MD5 c9536b7c0d3b5e57321a8926c8ddf85c
SHA1 c8cc1b53baa47402271a9ea197c81b3f9089c871
SHA512 ea1dc08471842858660ac1710360d30ac35b4d17fd7944cfe6a4568ce7fba3f5e40497145ea4c70dce68f8c2acf9303a3c18cf95348f291fdc77df3685adc7e6
SSDEEP 96:3Kn/UNsohOfvzwGB+tNjsD2UnRwlnH1vH2:3Na6UnRsnH1vH2
TLSH
T1D302FD52A8476200D3713E1C5F7399E9A6378A1F19034E9BF69E94345FBEE6B1233406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Atlas.yara

SHA256 c92f53e687c01c9002aa13ec4807a229f834c669f5ba058109a645a85ff233ff
MD5 7b9ccb5ca99a2f69cc958d0b41ff73ce
SHA1 661e0ba46925848d449f7e59819d6952600ac33c
SHA512 158da588147adb63d8f7ebf2b30b487a6a4a981fc080677e77124ada886ff7e791462f5dcab88e99adc4950827921ebfc0fc46ea6469bbf02c2182c0a38bfd4c
SSDEEP 96:/eVluOJryIbAJqvhUrwy37BOp/OWB05+GvkWLeMgD:/qeIwqvPOWGzLeMgD
TLSH
T19AE16C946847829CCA763E0CAF32A3E8A175C8671A465F2FF21EE0391F7DD275473816
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Avaddon.yara

SHA256 f44411bb37595195e72ca4a4098427882147a5115c7d86cdf7c6fe98efdc8b9c
MD5 0a58d68899767b45ccd0d000de8c09aa
SHA1 31878ff8b7b1900339831d2f624f6df3b780ff72
SHA512 25aacec414b9f27bb776555f8db59544a09ea78f9505a73d8bee6d965fa52242d29ba448989dac04fd6f908601a1befd1af1ede25e1a8410a4dd6c6a8a8529d8
SSDEEP 96:gvzLlfTSJvz9V/H/3+nvAhnZWNaPG6gBrQejKf9LXq140oO8zIwI:grRX+GvQPqeIwI
TLSH
T113123EE1948356088B753F1CAE72EAD43576C95B0D024D5BF21E90782F9FF2B99B3902
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.AvosLocker.yara

SHA256 fba577be9c664712bda995f24f62f90261473499f3e707f8fa57e1bcb0ef08e2
MD5 1527c3260a4e05b09a798f278795eac1
SHA1 01e203f0567685a9794021f24f496368eab3b241
SHA512 dcaadfc2140fce5912c92ab68410616cd3cba457e6f9e525af9340a265afff73aa59911e0f58301bb09e6a988e78eede8dbb225ec888c91088e4a20b562fd589
SSDEEP 48:wzR+1IKmeYSzWFsePdudDorKbTCa+bXAbgE1r4BEq6LQv56+8Y:wE10EzWFBPdupoubea4QMEp4Cb+8Y
TLSH
T1B6E18D9AD883524982793F3CEF73EAC425B7C95F0902191BF22ED4782F5BE2A5573402
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BKRansomware.yara

SHA256 c3f50744c0092ab40720229aa7057bd5d47035273445e1a6c97aa6e8ae4adf88
MD5 5874a443001faee36ee953c6dd2f5bfd
SHA1 263e1116aff962f6864d395473db58ffbd9c2539
SHA512 175566ad41f721881c50940b1e16e853ae4ba5d854a7d9647495b18dc1632ea4e01518a6a67b151b73b0cef6d26d6d926cad51aebf2fa0fe5fd1833f50b80595
SSDEEP 48:04IJUJAWRNqK8qmgDvGBZyqaK7y5V10JF8ElzbH2:0VUJAW3T8aDvKyqaK7WV10QsvH2
TLSH
T177A150A5D88395198A763F0CAF73A698E2B1C86F19020D2FF65ED0381F77E268473416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Babuk.yara

SHA256 f31fef8a0ec3d3857c900ed124d50bd7c4199d3909b76bb71b59b9b8f0ced05a
MD5 a76275017be2114f84b5470953650b59
SHA1 13f3150b611d8e7a8f53c7af563cc09d818df579
SHA512 4a9162c908e953b8ed7ee5a23717acd2f95293f76fddf97e96698fe2fdaf6936db5d943e3c4aacc82d476bbcfd21b1626cf2071af8b750bbe2d59c696cb7066c
SSDEEP 48:eDByladEiHPV4W6EKKQMcO6ra8PcCjCMYt49+wQ7Rc+T5gdX7AICrEg:eDFPsEGNCMYtuQDT5gHCwg
TLSH
T1F1F1E3A5D88346159B263E1CDE72EB9965B7C85B09018C9BF21ED0386F5BF378273902
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BadBlock.yara

SHA256 519662985d7eb18ed09425434c4717877c53e0b7635a7ce0403c00ca915a3471
MD5 2e379c28152be456ac6f2cdc300ca374
SHA1 5b57ee73eb52fdae904a9ef89599b297af1f318b
SHA512 02a8eeb1921ecf7bf05a3ceda424f4a8d470c4cf019fcb07979698cdaf10f322b2950b2e463c02cb5cc7ed572e97e08562ab05e3f30f8933ad2bfb0143a0b97d
SSDEEP 48:Q4YQDpAenyoFH306VbGM8gJERKeps2Vct+1D1oWUaYuGt76L:QQaenyorL8g202Va+1D1oWUaYuG16L
TLSH
T13FE123999C474700A7703E0C9F339598A2BBC4AB09130D9FF15EA4787FAAE3B5573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Badbeeteam.yara

SHA256 9418a2ee3930590a2660484b38d3d93ec72e8d06e3265193ec8580a49d0e14fd
MD5 70b8965625cee671be2f26d4cea0638c
SHA1 4aab0e28ae4e5f7885d3245d868e42eaeb16f4dd
SHA512 cb92861e9a84ba49e36b8028704fb7bf205777dbf4ede34627b3fbd131bf41f3c80bf28d39f00b3c0c14284f3d217a759adfccc88e93a4d6334fbf4f44c45227
SSDEEP 96:wyZW40JQUmIsU1F7OJzZ6HCQLlCaLVIMBGzlyPwMbIPRP2Zf8BzfBwR:wyZW4bUmw7GAMy4VwEBVwR
TLSH
T18A1282919C839588C66A3E5C9F73A7A825B7C96B09411F0FF25ED0392F5EF325A73401
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Balaclava.yara

SHA256 59f1f96e8e4f75ef1ab6884869ab84c054ad214034fafb55f43ab7504b611ba8
MD5 3f5508c8113387b34b9d82f9c649db8a
SHA1 ae38bfe42979361a8dbe79acff5a1887abff362c
SHA512 9ba17993f901d15116047c6deb0bccb002095bab28db651e4838231298f4b829fcb432f017cd5e26e8315fb7bf7a8637346c952e53520c5cb02f04fcaaeb0691
SSDEEP 96:qAxSvUfpZokUlFmbqc9HzWaStH8GWyyCxKX+pP4YO:qAhOlFmbbHIcw0a4YO
TLSH
T125E18FA1D88396198B393F4CAE72AAD43476C85B09424C5BF64EE4782F5FF3B8633415
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Bam2021.yara

SHA256 1306dfa9c47d10d1a53ddaab2d1ab2aca3c1d99bbd516f9aced25a74c281a5c2
MD5 e5302fe3da4e13cf4cfaaaa13ec3d852
SHA1 7fb07ec4560268398435f9f6041b2e3e2570a425
SHA512 41a77ad7fd87b81237f3063857c3d4df017bdf8923a96416182a5d22b344adb9d162d40ddde8af66ed0c4949d7d9a498dad76821b0dcfde623d3db9976792311
SSDEEP 96:gpWz3lR4tfSHZyB0jGwR/0+B0e310bhtzacf2kRMb4jG/Y2wC:gbf0xccY2wC
TLSH
T13C32A0949C439298C63A3E2D9F73A2F425B7C85B0A411F1BF61EA4356F8FE274973406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BananaCrypt.yara

SHA256 1ee3c5558dbdd9734d1baea0f903a8289d7ad5a9fac6efbd5d0b8918e9d202e0
MD5 53c1af59207de55ee81968f8fa23b87d
SHA1 bca3bad4a73b9e6ebf95168f56d4a42f5575ddd9
SHA512 2e27de1ffb18f5f8ea4fe74e1ab218d0cb3816e10aafc1f81be990d5665949c7cf37c4d17c402aadc7972526f1c3c4a656ebae61287b36e9417bfd7360538a60
SSDEEP 48:cZo0NhJmv//U2eF2kTp9OnFIMiOcoNURRJUJ0rK:ci8H4//U2up9jNRJfUiO
TLSH
T159D16B55AC432218D6257E1D9FB354E82677DA2B29100E0BF75FA0386FAEF274B33016
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BandarChor.yara

SHA256 d4b0b98f383b8c7dc0fcbcfbec7ab95286ee8d630852544a080b709a3129446f
MD5 3b52ff4fe121b7799e25d8af13b15a8a
SHA1 92d8a57ac630f170e9f2bb4276dc41c1012aa85f
SHA512 c23f7abcdb4e64b441dfbfad9a301d82f5a08598795b79fba44d397cf536c80492e44f8578ad1357507c6a232b93f181bb4d5a9b7d42cf61b88a94f904627877
SSDEEP 48:G4I2aWUjt6YEpxP9TE4niz8qQ+Oke+b7+ElkJ4m7mm6smjK2A:GCaWQt6YaJm4nyTvlutCm6pA
TLSH
T1B6028F8ADE4B1724A3B5BE0CDE7340A8A177C82F184289DBF16E51347B67E371577A02
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BitCrypt.yara

SHA256 9ba11092f278e7d29cdd399189398bfe8ed1cc36cb8d1c553bcaab6be4705529
MD5 b14d87c2788b9470d4a04721f9d0a02e
SHA1 5363d74916c6d651d8897890a92cb864a0c6f840
SHA512 0d0e478b32a42369e61b1a57e6377e9dc44fe437740bc82e157a1308fadaeef251193bdd4ee4a0476973f714a2e11a902b372862cd2a114f25f8b11b59124e10
SSDEEP 96:jfu3KwvtGnh5wgdmq8BBDVJ7q1HsM512iLWtebS:L8Kwoh5wgmDnuHsAU
TLSH
T1EB12699A9C87474857B13E0C9F73809C96B7C86B09510D8FF29EA4387FAAD3B5173906
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BlackBasta.yara

SHA256 4349d6e56f5bf8ec601b4822b078d93e164ac039583143c7febb20b3488dcd1f
MD5 c3d85b15ded25f6ed6b159413770c331
SHA1 2961f10611bfd46ca563e3092809cbc4bb31ecc6
SHA512 6614e482a91cd4e6f2178036c8a9c3070fb4830ef74a51c41edc72d65356f0c2f3179569acd5b1b1b7adceae3b2951e9d470535633b89a59ba2c9b0d29bfbc1c
SSDEEP 768:DaLG68Q+8n9LJQwlDf7GmumLZumLsuP4BCuHPO9XP9s:ipfw
TLSH
T12CF2B4A5988745488BA57E2C9F33EAC425B7C86F0D130D5BF26F94782F4AE3B9573402
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BlackCat.yara

SHA256 06e7c925272803d4623a95d227b1c2bfaea2ead94ca2bf4e0fc514f00576d9f0
MD5 9c9ba76661e8014b9f97185ed2be8346
SHA1 ae0586a026a01f0b9879ba94d4331a439c846f56
SHA512 6091d9914153d244fb51c926854b566b6920fca4919da2cee337b7006bb7bf5bc0c8f61034f0c2cce7b4d5c20ba62577c139f3d04ee970a398393297eb42c192
SSDEEP 48:wtaj+ikAAJBjS1ujUEkXKKVKnu+BN6Yg3Oe+rErU:wQjzGS1gU5Knj83Oe+wI
TLSH
T1B5D189899C835248C7363F2C9F73A9A43977C91B1A420E4BF20F94786F9EE275973502
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BlackMoon.yara

SHA256 3d4fb62a9633b2c616c2adb1df50796584f9aad7186081248f79738437bc3fa2
MD5 eac8791b28ea4585d5f79764863e3014
SHA1 fd1b5b8bf9fa2d3d017ab50640b8523c6a46072a
SHA512 f8a32143de6e37e1d766cc6b5b87eecc9f0a9b6a0ce553ab2a5ca4e63bf1807a27f18a5cf7b2e44edbccc5b6422141d4bc6f8d03d39c7c95fd88a103ef6daa0e
TLSH
T12A818EA4DC835658CB763F0CAFB2E69461B2C06709060E5FF65ED4345F9AF269473802
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Blitzkrieg.yara

SHA256 7862d7d124b83538b9fe6a0a1a85621eb5f7b22ae189375f65c52fd83cc7c149
MD5 0b6d5ce964ec93065e83178ab22f691d
SHA1 b53c7e5cd53f7cf082d1c1972aec24efc88c3c00
SHA512 398574d5e9107cbe7b98962712de4f26dc442dd13546a930026e4c6dcb8a5aac7ca02ad7c1397b2c9a83eb31345f62f42bd5a5a07a8a2fb069d0365804630e52
SSDEEP 96:LFGKJ1zovfwTCTeSWyw22L0KRRCCCOCCCvKsHFcHF2:LFGKcoTCTX9gRCCCOCCCvnHFcHF2
TLSH
T13102CF8A5C4B8B4857313F2C5FB2409495F6C9B706134E9BF0AE68782F6ED27503B909
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BlueLocker.yara

SHA256 f101820567c32f4fc28ba8ce845af98a6f86b4df541a45dda662bc200c243014
MD5 cb0262ad08690d4e9c2c596296ed5089
SHA1 bf37099acf734f462ec51826ac8d7fa4005dc1a5
SHA512 8ab4a26f25c87ab2555f413a8b86b77ba8d4515afa3ab734dad46d5eedeadc69d46a6916c7242225256076273f33d18282d79e4edd37d66319cfb85551ce3142
SSDEEP 96:1OS4nEaSCQEmp1oOJubUt5i3EU4eqcgTpww5I/xu1KO:1v83fQ3yG5rWgGS91KO
TLSH
T18F0259D198838658CA763F6CEF73AA942237C8AB19564D1FF20E94382F8FD279573401
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.BrainCrypt.yara

SHA256 4214114202811a10b2ec5b35697c1acdedfe3f5a5ade56946e4b4f1fb0461dda
MD5 ae05e031e26f6202bb446bb590e81670
SHA1 d957d05088e3f4747d28f9c53b2e977ea2621371
SHA512 edc3c6dad59063205962191e590dc2847bdf58bc21fde3910caefb6ebbac650d0870ac11363b0f3051aa9e3ef59939023a2810bf13b4eb57a29173b4cce51b5d
SSDEEP 48:7E4Yh/VfraAjsK9zZEFAjSqvAjVkOAb5eiX/QzfjucAvUqIDnerEGIg5NVvUrqEo:oba2b9zZEF2326UA4vXJ4GN+ikBVz
TLSH
T14F02F5855C2752CCC3327E0D5FB38478D62B865715022F5BFA8E6074AB6E96733B3415
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Buran.yara

SHA256 1c4c78730c5d3d3b2be2caf203d222bc3f4204bec30fa4f333ed2244666f4396
MD5 1ca665e6fe284caa7b6a015af07b3dc1
SHA1 81d87fc1399fc06908d43622798e54a276be8262
SHA512 61705922700f7ec8da36f5c55e1d8d8195a17adffa7648d7182ee4d14dea239bd0aa19eeb9645cd5b64225a4a0a365845ff9499cd88b1947d2e63a7315774f93
SSDEEP 48:M4Q/OxaOV2R7/QHsm6UNWE9a2hFUfX1xruKfzJ2:MixaOwRRSTa2hFUPbtfl2
TLSH
T145B1ADA59D8386048B317F4C8F339558E6B6D96B0A030D5FF24E94782FBAE3B5173806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.ChiChi.yara

SHA256 4e7c782ff823aa5f495f895dd804586db2c72f6b8ad6ec19ff07b2876c7d402f
MD5 b1d29039fc6774bb719803995dcd0b6d
SHA1 11a2714fc2c0bafc5224d88c9358197130d956b4
SHA512 d257aa9118e308b2cc17856861a984b3feb3ce0757b7089e04e1c3007622a3617feb7e5c52bb2a03101e9812ad352236c22d4a832affb55f0fa4a3b460a30e60
TLSH
T183612294D883926D86297F6C8F73B6C46672C86B19054E0FB20ED4793F1FE2789B3012
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Cicada3301.yara

SHA256 8200548f6142639d0ea2a511804c32b9d72e20b1e6fdff6161fc8a7e66338813
MD5 6b92a6441c865d22288653210b9fe83a
SHA1 5df2c1abb7b57b51f2188dc0ca4d67b9bd93feb2
SHA512 8e13ce80ef9f89c9ad97dc44434793c5e81ece99b9ef8e62af37cdabf5bb1079a3fee96cc76aa1070bc9be3cfdf57e7970861559e1249e4399a56cdc1ba36be3
SSDEEP 192:vW4aEXNJ+89gy0N5ki/qyAjvZKiWDXrTvCi/qYAjvZCzt8q1:YQ+gfcki/qyAjvZK7Xqi/qYAjvZmt8q1
TLSH
T12BB28E9558835288C6263F2CAF73A2B4657BCD1706128F5BF28E90783F7ED235A33509
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Cincoo.yara

SHA256 2a89edb0132e36a2cf631b3d24a3c07b93eb58e4bba579cf57a73d442cc14db7
MD5 8d44ef9433f948b388e7f710254f0998
SHA1 61f3160934732beba37f5f4564585cd474fa5e90
SHA512 9ea10e5bbcf2d40b23cc873a553e71f5000792a95e04ea26027de20e6a8ca1fb65397cb3c7b006d3e4af6960aa60a916e915aa03498cc4ef8cd0e8b856f007fe
SSDEEP 48:MjRbqrhmGaaS2l+sBS2RyiKXbJ1rtxCHWcH:MpqrhmpaS29Bvy/rJ1rDCHWcH
TLSH
T1A091DF85E843521C877A7F2CAF7396D83277C42B09020D5BF24FA8786F5AE2B6473402
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Clop.yara

SHA256 2713c03900cdaa98b2f7e44928df35c02110c07cf67b20feb37cd2ca94bcc151
MD5 4366f53bdb1e780e9cb8bd2a799be33d
SHA1 bc243003fba964ecfb78bb1af15f02f795a1e637
SHA512 8b1d19295895582eafd30f6cef858599017654cdf5fad4c1d4c6745fb87c616d16e1bfac87b47294e31250b9d8805d8477616244300e7edb8d8a28490b72cada
SSDEEP 48:I4gqcb/EcYcnmQ1NpiAvlPcy3xZhtNOtbH1t:I9liAtPtNOtH1t
TLSH
T117E1A4A5D48789195B753E08DE73FB85D1B6C89F09024D6BB62ED0346B6FE378273802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Conti.yara

SHA256 0e15843153384f4dac9fc53101bcfa79fdc5d4cce1da3bffd738f2503aa9fb23
MD5 acfabaacec3abce804fdbcdbc43e963a
SHA1 6659f2310e277c1449edd1bd09ab959e3e845b58
SHA512 ae7bcb20f859b3091d0dd3dfa21a466b4b0f10fba03b632160d1e93dc84b119e41eec3e7abb4060bad333c4aebab927295e6e0cee1053092f04f857cccfdcc8e
SSDEEP 48:oppRfprEZbbADE0BC1T8uPHjBPH/TXIrK:UDhEhbADE0GT8uPHjBPH/TXIO
TLSH
T1EA91A9E1D883921A86693F4CEEB3A6946176C85B09424E4FF50ED0753F8FF2B86B3411
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Cryakl.yara

SHA256 93e01316ee45ec8e358b7c804dbe8dc4cbd3bbb44396e920a1c952decfdcaebe
MD5 f86a4bc53a20dd26abd3ba3bac0446d1
SHA1 31c9f2b420379f146681c2aad94d628478579a17
SHA512 812f69c91cc018ec76391777005dff234636eeee088c94a5fd941f19c83094481009a330bbaf9260290dc46f87385770f97b52084b26a62686a19a9274ef5924
TLSH
T1AA81F346DC47575067753E0C8EB39598E2BAC82F19528D9FF02E90786FA7E37007340A
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Crypmic.yara

SHA256 226a4f9762913a09c188fc4a40e17d85f10d7c650b28daff21c2635e74a8d0bc
MD5 9a4f09e01b60a3165a0d321ce63c42cd
SHA1 ee43f54e0f8250c8f087944ceb8f471d583c2306
SHA512 86cfaa7c0b3a179cdcddae7b566d155c67936644d3d2b985050938a7b92a300c2ff350e6e13488b64d59ac7482ee74b80338d461c42c69c7baecaadfc888fa80
TLSH
T16C51BEE1D443926883793F1C9E7394C8E371C82B09430E1BF65E90756F7AE2B917741A
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Crypren.yara

SHA256 ae5083328f43cb46353470070d3e30f1bff1894c0140f68bd3ee721de177bda6
MD5 ddb3392d4ea6fd392deb2d394f4b89a5
SHA1 920634e07f44d3ab7101c20bb655be8fc5f1d4f4
SHA512 a1c4d2336b00cc8210ce29397aa2493f8a0c1f44a051a4350d95a04f68f8bee3da4cfc87f89b98fc0bc006bf83f85c7e9fa458735da08a5f102be2977b829ef1
SSDEEP 96:VggyV2aK1mVbwEJvvJabD9NX1zn+oSmH4SXUHF5HFdHM:VgiNVYkzEHF5HFdHM
TLSH
T1331279A2988355158EB53E0C9F73A9C8A276C89F1D070D1FB22F90751FA7D2B9077816
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.CryptoBit.yara

SHA256 e4d77e26802bbf86ba3148eee7f609f1926d4dd1c1997af9db844382d83c92b0
MD5 a34c5c3ef399e7e406618b0c1a8f0f86
SHA1 61b949640f537ee8ec665f1cd204c08b4ce43f1b
SHA512 8153531748edb654dc43b4943603fd76a24b58727415c363dd4fc30e51220cd3b733d8f6be6f59b5f949d5114471c98cb2dcbb90b6d66cc001d0917e7c7a0b36
SSDEEP 96:KJfya6UunilSxcqgpiDyIMRmC08TCqM4HFfHM:ifya9Nco9HFfHM
TLSH
T14EE108E6DC8356488A793F089E33E598F277C85B19530C6BF24E90742F6EE2B9473805
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.CryptoFortress.yara

SHA256 e207615c24f6e1636e35532e58e601d8a7abcacb8bd2b22cc3a41a2ba830e7b1
MD5 0128f63c29e3d30eab7aff1abee54393
SHA1 79d1d214e9b8cbe5ce13cc010f064c4be2fb17e0
SHA512 fcf50a597a81c1c27059635fcd320d02cc163a230ceb1c93db5624f483ee452c71fea069d08a1bd5a926c4f99b9172d8f0b4b744d65f61f86beae82645b0103a
SSDEEP 96:K+osLgdWtuUc107W3rcoQePLjP2m0zllxmTB+D88nqIibwuwAnIDJ+Z:xrLgdWtUikLf0gIiJRnIDAZ
TLSH
T1A2221B96DC87558996397F18DE33A988E177CD6F04930D2BF22E90342FABE2B5173805
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.CryptoJoker.yara

SHA256 fdbc3db1201c1b27c6b01d70729aeee4eada64bdf250e2d29545c1fe2c491883
MD5 0267596c1484aa5397576ddd3a381ee7
SHA1 ff5773e0d9729e081fdea8a7d2cc94f623c067a3
SHA512 9e353e88b399cfe10303d1b1f630f4699f930114bbf220735f5b0ae3a201497b2910043dd371df2ad5b972b8bfbeff54b6d86e3d27b5d82ed0a515cb2c8cd739
SSDEEP 96:K9nbe1lopHJOFlWphe7E47P99IB4zEZcr7NZUsiyWrVjqP02FjE7HQQkhlknq/28:6nL4VEs1mhqPnUot/28
TLSH
T1F42261488DB721818474AFC4BF72859AE636D4F71A200A5F725C65F8AFBDE0F6383815
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.CryptoLocker.yara

SHA256 94abf0e030807a686386bec99a7b218b3631db31aa7f96cdaf280d01f5727d14
MD5 33a4391d3b5bb15aa3936c725acb8a41
SHA1 1ddfecfa376adc395245dfafcb6b35f414098132
SHA512 29d66819489707dea9971e79417f37e42098d6ddaa9b086616dd5ce54fa06850c2aafa7759be929e321dd9ffe66b49f0b79043b222beaa04069600562e179d22
SSDEEP 96:jeWCCyqysv/61Dy99S/EzOZ9ImmXJzMSvCHCsKJqM4CqSC2gMvyKShvvXeFScvXa:rCsXv/0W994ECZ9NmsZujSheFSFFSs
TLSH
T15832E3819483434DD7393F4C9E729990A2B9CC870A434E57F18EA0797F6FE2B653390A
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.CryptoWall.yara

SHA256 286a94bdf34539b614dc56b6a302a990fa1200dbd6b9b82a5cdbe471a715cd6b
MD5 78400ccc7235aac1a925332fe3881e49
SHA1 9e39ef13a7cb2b9a4629148996d4b6fe7ca0e595
SHA512 0743cc5e417cab85b3cb0cc7052f97d615d6de6b67dd03e42fc0a42296656cb19aef46fdbca95f89f4db55cc83d8284d64e01d1f60560ca5dc991068b110deec
SSDEEP 192:PeveUVa7+1UeUAvJxuh1/pTQ4MXtA37AmwacAvhDjUn4sPr3vAxEjQbSBinivx:WeUd1SAfuh1xMC3smwacAvhfWhIEjgm
TLSH
T1A6D21D80588B4248E7753F1C9F76FB85A175C8571A434EAFF14EE478AB6AD2F9133802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Crysis.yara

SHA256 ee4079601b59f8183f5bb82edc38a04ee835ddf20e9d80f4b6e0a102bae98eda
MD5 830864a28e692dfabb90b3d2940c5930
SHA1 3b29d33373218a68234b7c8e81028cc577b261d2
SHA512 7271a4cee19812e092ca84f4d9edc1677ad12d7f072eaad43810a06d2867611c1a9004147338460a84c14b623a1ff46f62b29c3ee7fa87d59b805657935d4e0c
SSDEEP 96:jacEzt1wghuvqe4FYH33Zt5VCVSxX4qc5P2Oy1296T:jabnNuJVTXol3yE96T
TLSH
T140F15E9094879619D7763F1CAE73FB84A276C45B09034D6BF14EE4346F6BE2BA173802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Cuba.yara

SHA256 03040b11cf96efc59f4ea90885d9c4161148e67a85c16fcb4901d5c4a08f2ab4
MD5 4ccdfe3e630c6de14c3a046db709df06
SHA1 51e942f1aaa2cd604375119c1144ef94db8f43e8
SHA512 dacdfdc379648f63351fd81d24b4a38ff9e37756153f78be25c403159c93b9d169e89b0c256b8980196ff8e974e96bffe00b310dc76bd17cc662368296a0b81c
SSDEEP 96:nccN5zBumqIGlWj2rBtfYGsWR814KSg7J45kXpNWCnJD5wXMZ1H1tH2:n8WSEuX8H1H1tH2
TLSH
T1F4024A90988786588B753F0CAF7299D4F276C46B09030D6BF14FA0746FBBE2B5573816
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.CyberVolk.yara

SHA256 c617dd2e5dc52eb1cf52a4c31e578c13468f1519488b54cc021ee184d08d215a
MD5 ec1fbef5e43fa15bae94e83b692d0455
SHA1 9e3b9d49097e593f20a7a692a81a944a73a7a117
SHA512 64476236268e21d751f8838937753e452c949dc6007d4341bfc7102f23b8dae66691fbdec0edee93d5886e2d5b4512f454fc76c96f6c84ce44f529d9df3e2d6a
SSDEEP 96:gc/2fclhJ8w5VBCrPxY/APJMcjuFd1nVvnAG0qMKYHUOfOs5HgLUGsjsJ+Ork2Gr:gc/fOw5eniB4fM0l0ytuJq0o5R
TLSH
T100A207E5888385598A763F6CEF72A6D42577C8AB0A164D1FF21ED4382F4FE278533406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.DMALocker.yara

SHA256 db75494ea9f8c1165b5918dcfb726250075874bdc64bb7316f2cb87eec995e84
MD5 1e130904b28ecb80ba1565ce12446668
SHA1 f417154fcf3cc77f3bcf05d525b42d623004e09c
SHA512 ec8dd2bcc908959a8592d8bca4b60e5aef8ac997e5e3d4ae736c7babaf76d4135664d966c54a4b61ee12e1c70fda0fcdb76b9b56f5b5f3821e604fd1bc088d57
SSDEEP 96:IuEF/DhIcESCJYxabyU2+IpwPtrEZHKR5NDKMDKpDKmDnxX:It4byQZiQK
TLSH
T1A02281919C93860897763E4C9F73A788E175C95B1A420E1FF15EC0382FABA3B5573A07
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.DMR.yara

SHA256 08a926705161c471bb0205eb6a78393c0a19d240a7159d80315fd113bbf3316f
MD5 4642ca5c6d3f636f7b613c70056f40ce
SHA1 51a7f2e6fa393c1bfb277ba4df5ae34f2aefdba2
SHA512 130f5ebe27cdb255f58baebbd5c821acd9b76419cbb21c5f8a572acd6878ab9b0c0857208c174af6485dad00148a8e2584744d1afd56a196e2e42736dec7c52b
SSDEEP 96:L/0jgskip//bQlrqxe6yxznxArN/pNQwbiTkfO+jBv099SYT9zrWH1tH2:LsjkiJxtjBM9SCBWH1tH2
TLSH
T173721D919887864D9B753E0C6F73A6E4B276C86F09030C6BF16F90782FA7E2B5573406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.DarkSide.yara

SHA256 597154d17afab5d9b684dfbac62ba95c4afe38196dd9d87daf8295cfa11d97da
MD5 bb2b23f21b12345899e842a159d246ac
SHA1 999348cf3d4331eb606ac07e1f703322d121f5c5
SHA512 aa640a08a761651d8658bd64cb582ac62164aa82f7901ba1d76e3b2202e1c7a3d46a8a4c5348c38de38fbc0dff9b7f260997275c29d89157a19f3a8113684833
SSDEEP 48:rK5AuAkrATApaT6gKcSql6TkWm538+D6bHLdPouze7+Qz4LlKkWk2:rK5AuAkAIUq+4treqYSp2
TLSH
T14CB158E6E083845D867A3F2CDE72A2807A76CC6F09924C17B20ED4742F5FE275A73416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.DearCry.yara

SHA256 0cda5e9bf7bc4942dd21e14a3d403ee45e06f763efe5ea6e9dbbfa0fd1f5fe82
MD5 dfdaf4f23ce7c4f3b6bcd69bfc07e41d
SHA1 8b61dbc2aa04e2e29f7b5d1d0a0f956cccbdde78
SHA512 2a5b085f4447708276efa6144269f2161f31fbc0207ed7a3d6d892f0f06afe6781821de1c155f83064b17fe53e81a7287ff7e68c3699298f455facad4345b152
SSDEEP 96:RRpQuqZ71qefjMx0zyAZ+0X/gsb0derFX2:RRpQv2eJX2
TLSH
T167D1B2659C4342998AA63F0CAF72E6E82576C45B0E150E1FF21ED4386F4FF36957340A
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Defray.yara

SHA256 1bffe335313320eb445a5e54b75ed87cc9bbd9c22eb3716b7fb85d4a3772109e
MD5 1ba35857b287075836e117ef43e2c385
SHA1 cfdf8639b33f05f8c24eb3b36bf1c9ae6fea2f96
SHA512 e8bc214a16943efb3e5e5d2fb1e9d1267cf6ddffa9ba7ed30f383e80b45da12d2483bdfebed42ec9877ffcb5615b74424900a26194ff97c7336976624d8a04b6
SSDEEP 96:70G33et63edhmjBdnoBar4VHd7qM48cZkblz41C:70Qof9hllz41C
TLSH
T1B4221CA5988745094A753F4C6F33A6D8E2B6C86F0D024D1BF66E90382FBBD374573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Delphimorix.yara

SHA256 bc22daaafe27894260f1fdf85125d26f9feb5d778a1dfb4d7b2a3ee635e91b0b
MD5 96d113cefe94861b53832aa3568c1c18
SHA1 0e6c984f1adf43e5d82e9986cebf5e9f9db5f05d
SHA512 f814cbcdaf3cb50456ee94411621c3a6e1f3decdf7bbe237d8616eb3f3f86d742670c0aa0edc7613de27a15626589686c577d9576fe0b87212bb78f74447b131
TLSH
T1C571879AAC8B575863363E4C8F334458E277C82B0A524D9FF12DA4386FB6E3B1573815
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.DenizKizi.yara

SHA256 0dd73312adac37222fa64ecb8df9f889f8652c2a0ad8b2201f4c044c4708ddf4
MD5 98c3591ad171567fbb5eb49350a16d87
SHA1 7185407effca5ae15b667be285cf02d787d93d75
SHA512 5e73886832a10929812de57630b14f9d6cf59e6aad71ae6c41a09d664c9e88a0d4237daab251fb6345509d9b8ff1ad35e6b1ffbb9179ecaed8062de99a06482a
SSDEEP 24:I4eqAz1i/DoVSr5bYjvkv0tdrHtTP5bjQD/DUFuBZ0tdrOrbrEUwhDc5obykbj5w:J40bReNRELclG3/MyAZJcndCHHHRyfZ
TLSH
T1DBB10395AC478B446B313E0D8F725489C1BBC86B09530DDFF19EA0786FAAE3B5573809
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.DesuCrypt.yara

SHA256 f68bc79e8509d963ed66b8332fc4957ab1179a7cc50c6e77fdec63a0897a8ee2
MD5 ad585b41223507b5304016ae513526d0
SHA1 b25fbfdcda527879da1fea362c33502088d95272
SHA512 e650ba5ec8fa8f02513ef386362d4c8506143aa634037070a874d717b6ac1b75ebb2a4d8812274b4fbe17ebcc1fc750f1105d968309f5cebae8a2b5116fcf0f2
SSDEEP 96:t3iEQI3375KPupZWphgujTNpHUfo2L/fR3KZGIW:toZrGwqSGIW
TLSH
T124D1B1D198834659C6393F0CAF73A694A2B6C85B0A130E1BF20ED0392F7FE274573406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Dharma.yara

SHA256 9f2786a2c6f7b29c42e5508123c44b8a11f3c2a9a4f8399dc393ccce7faeb26b
MD5 a51ada1b2beb52b15117d468a1ae601b
SHA1 d183a2e841de4314d3e1041a8dd919b3894b78ec
SHA512 bce1f94a8fb0ce01bfcf40781ee8b9e69123980bba6ced37dd3d80e72b5051f033356d6ba2282403fcf38138524932d5a757682aaae0640910d14e1992d742fa
SSDEEP 48:0s45tGNl1Y0panJ6hGrrLnRctJPRgqrqRYwLYIchYkHMNwRuvY75I3pa+84t44:0s3l1xAEQDnq3pgqrmWYksNx38ey4
TLSH
T132F1CC91988B5614E7713E1C5E77FB89A2B6C4570D030EABF14FE4385F6AD2BA133806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.DirtyDecrypt.yara

SHA256 a4eeb20302270f7cd7c8d007363dcf797441954d209099284d1375a16a64ccb3
MD5 d4a742a6c05f9b956303450f9237983d
SHA1 569f26a86c6f220ac5ef2e30207ff37686c55a72
SHA512 307ed06695c7e48e8ad11d54c77874b09c06a1b2906f1a8c833ee2aacd370556a0405d064363e66eaedd10093ecf361941db6aafdba6c50d7e090abf5e1d7d3f
SSDEEP 48:jv4mkW9gy//5wYrOO/9Y5PG1GkSfdL0UA/no/hlcg/cUI2hO9/DyrNqzodzQJpBj:jvCWv75WlG1GVh4ALILZm2H
TLSH
T1F002209094870204DB757F1C9F72FA85E172C8471D43099BF28EE978AB6ED2FA133902
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.District.yara

SHA256 7afa42dde1f3bec6942f46599d12a9595e69eb4a840c4aa3748e12da40597d52
MD5 04d45ea885d2350233538be36d797917
SHA1 84cd5bdcb2933023ccaadc207a49a41198954348
SHA512 027c9c72346300836647f5971ce3293d03e264fda992f1b6f677aad1a3e0f8355ea0199475f7e0cd313e0a255d9a9be56e17af4636b0df309ecc339f8bf95f58
SSDEEP 96:OIHITj6oUqTZAnWZoyRcWWBGzuZy/ND0noHY0jQD0Bec0ID0Lc0/oZ0jTD0jHs0N:O5l8Enx8WoI1H13ta2
TLSH
T1D05245A0A8834289CA753F4C6EB391E6A177C51B09430E17F25EB0391FBFD17667340A
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.DogeCrypt.yara

SHA256 1563872736eb49cbe373b1dd415fcd33286cbc097866bd9496089696000c99a0
MD5 667f4f05dba5c590c9dd87bd8fe67090
SHA1 54a9d70ecbb5b1331f89823bac3a865a8942a335
SHA512 2cfe0fa7e42c957cf6259b069b7efc3fb9764f7e1966fb036f4ca4745f2a4190da018d2bb2828f6f5639499f13c308cc4c5169009876e797d3c8e530a43d98a1
SSDEEP 96:8oadmuR5XDRXz29hQF33PsWyk5iimy+G05oZ8:8okTVXzfvii4G05oZ8
TLSH
T108F16AE598838A5C8A363F4CAF72E7D825B6C86B09010D5BF25F90782F9BF275573406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Dragon.yara

SHA256 f8b6ef2b6eeedbaf50db71bc592bc48dc7838abcbb84bbb9399df2e672776a0b
MD5 77e8a799b489fc6da013bede3bd61b8e
SHA1 8a804624249cc3abdfabb0373d7bdab9af428d88
SHA512 172d84976cda4760e134dc92341b9c0805a6ab3dfe815fc8c607a73cf7435be6521a609be41373f7c99f9a85f49504f35468657e15f5f98e3c96eecd56047944
SSDEEP 96:Sjfrvrg8Tp/DZfwP2JyJbvbRY3uMWY1WY1WtWRVye8Tm:SbLh8Y3ug1VB8Tm
TLSH
T126224D81AC87864D9B723E0CAF77ABE43576C41B09020D6BF55FA4386F86F2B6573406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Dualshot.yara

SHA256 56e02f75e6ffabd2cc825aa9c9f2e28101c9746e6382835be2db528b8090df52
MD5 a9e5faccac4ab70f3cf3a6921134ab6c
SHA1 bb76365308457545e4bc6dd7b8532855c792f929
SHA512 fe572716b64781a719f7b5852344aaad29744aead63af170ec483496d37b0987b393f255d6f790d15a9a033d450b4e2948592ecbfa43c4d62a11032af66232e9
SSDEEP 96:nkP+d2rK6+7Z1rlVjqw3psF8wlfWmNw4W:noAndO+mNwd
TLSH
T136E1B595DCBB15404835AFC8FFF5825A6676C1A700180E2B729EA0784FBFB177397198
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Elpaco.yara

SHA256 6d9218ac3ee5facd66a77b1f65cc08d71a580de0116405749cf7d36ffaae709d
MD5 a6b0e295f76437861e61bcb50d9fb24f
SHA1 2e4a9b0ba77f4d11d5a87fd3328160ba74ea1cf0
SHA512 1980446e926295ca24b8e5389955ff0faeb7b74d46f27956d294439aad84945cee3b9fe46b0cea583218d822c0896a8cf2446bca264a561f6ebdfa96bfe95adc
SSDEEP 192:Vj/Vdn3wys1ngKpNOY4xcrPfH/otmQPGkX:dVd3wykpNOYomfH/okQPGkX
TLSH
T1FBB22AA5988786488B753F3CEF73AAD42577C86B09024D5BF25F94342F8BE2B9533406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Encoded01.yara

SHA256 a3965a49fc8838f54ca8ad9f0e26a6df983523de7042528dd920d4cd9e693659
MD5 b4392be05e46663e6ae69e75574ccb00
SHA1 3d63bb02feadd20a4799940386227527952713c4
SHA512 16147ca706873a7e16b66b9c0376045d02c33fb903afb71a95ae8810f3cb6ef50fabf6276af4af3ea0da7e9826aef3282a7fc4b84d9515c2411b8293ba11c222
SSDEEP 96:ir/hKja3fkK5B/psQT18KlhovME5eqK0KXq61TzYWI:irEUkAvYWI
TLSH
T1DA122A999C870744EB657E3CDF32A68825B7C45B1912099FF24ED8742F8AE3B9473901
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Erica.yara

SHA256 9413e8cef1a81db3fdf423d5cf09be587b9dc80cbfb4fe819681e49273a9cceb
MD5 580fc5925b61119b1145eec4e26e713f
SHA1 025891307d8d60acd7bef76062e0c800f7ec77eb
SHA512 ea0915214c97505a74993a0cbb799df766be23cbdeb286702f5aacb690a69a58005da8bfe595783fd06e7c3ea5b8f9283765e463670e7af0d930e0e6f591e788
SSDEEP 48:zs4FGGyXcVo+IQz8H0X6bglnH9dlaL7b/QfvapALtbH2:AO93q0aAarofSCLtH2
TLSH
T104914A94AC834315E7753E4C5E72E688E6B6D4670A030EAFF04ED4746FAAE2F5173806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.FCT.yara

SHA256 6b8f81031e99ee1459453cf67f6ab4711208c2edaf4d387f2ac87d5a2a29508d
MD5 8c49c0a46ab4e01030da73b3f5d872a7
SHA1 1867ec856760ae282013b3138c110a844fb42b2f
SHA512 197059bebc557415c7077efc84c2c9bae761d55d111de6a10745716115b628759390feaaa2bb9a6a9145b07a9c3bbe464f73d6687e1fdb94adf55859ba2b6a82
SSDEEP 48:l49WZ/pK4mjO+E/j84U8j3N+T/dO9F9zHIneNnFh8UVgrH1tbH2:lN/pfmjO+E/jUM3N+T/dOdiQF5qH1tH2
TLSH
T1CCB180A4884782185B753F0CAE7399D8E272C46F0D031D5BF25FA0782F7AE2B5177816
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.FLKR.yara

SHA256 0519d0928f6b011fb421418c263a9139e7feee26ddedaabb98393ad45c817813
MD5 96de626e2741d69259441c176d663c89
SHA1 ef980bfd8e291c1dca4ffe8568af1752a0a5db60
SHA512 eebaa5ddbd7fe2f57119ecd1e7c9efcb97892153367043a0c828e35661583404279272ecdd9eaa11f989ea011564e1f4f6e7c5d3ce2b848fd875af73102be6f1
SSDEEP 48:B4rC6nO7uJ8Fz3nKpTeT/O7cQyNMLRx84C:BonOquFz3nKJeTGwQyNMLn84C
TLSH
T13BA1AE559C8792A8C6763F4C6E7352A8F236C8AB0A521E1FF15D90742F7FE139973009
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.FarAttack.yara

SHA256 04c064ed3a2330fff86e927834e3b2002eac36b3fb980bb59baf0238c020d77c
MD5 453acbbd28aba395a1ad323f43e30504
SHA1 806bab5c7dcb5a3b1fbb073fbc394b48d283ddd5
SHA512 e507d5b319a79d5bf458a121aaff79a72251489c2aabfc296b03d451ff1dfd0a5773e4415c69ef11a32bd04a2578a2662c31a59dba05fbcc311bd00d899792d6
SSDEEP 48:6bA28JVgtbYaPfQBE/963Pqci9v+RwHJHbfQt7+Tma6rK:6bSjgdPfP0ngv+RwHt4t7+TmrO
TLSH
T1CAC154D5D88352198B393F2C9F72AA847577C99B09430D4BF20E94782F4FE2B4633406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.FenixLocker.yara

SHA256 e2718149b04ed8645961da6f35688207c653f24e80bd5328f3eed55ad2986888
MD5 69721e64e99ed59772a03c6f3a19def1
SHA1 e3db4b40ee6fad25972d87cd5903fe8524742ae8
SHA512 0dedfae05c2a5c2371d07f3bbef2ab5dc5c77a6421418382f72d9168a07ee1f7c0ccf65b8b045bf9988407b70a9d48aa19d827a61738f21a86b71bfe548e566e
SSDEEP 96:mo97dG2TdrjEWgar1MvA3lnCIggvrg/nhj4uFjxKtrYAnlSMggDmbg9+FLvIYIL:mm7dGspGltmTIIL
TLSH
T10232B595888746199B753E0CAF73EAC8A176C85F1D034D6BF16F90782FABE2B5073406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Ferrlock.yara

SHA256 da43b49be6c75f4ec89d9a30541e53998ae53967f0ec8783747fa1a2ac13081c
MD5 227809b0c18d0387b6699cf28019aaf5
SHA1 0a99e6ad2509b0363582cde4d081db62193b8104
SHA512 d64d55936d4f199b83a9677d93b58229322eeb4325abecb068134a89dc4b31e7959257a4ecdf98b3d16ea3a7d8182f309fb5c69427f7ade5f194cbb95c240254
SSDEEP 96:yHiEQI3375jPzo3gzPtDLGYb/W8Me7Rl1RXptG5Ns6v8tzM4jwwGHMH1+1vH2:yY6rLGzHlMH1+1vH2
TLSH
T119021A95984382098A793F4C9F73AAC8E2B6C85B0D134D5FF15EE0792F7AE2B5573402
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Flamingo.yara

SHA256 8a33c3add541334a68f86fd200e2fbde2fe730c7a5c8dc40afc422aa05b57e79
MD5 97005194f991c4a9bcfbfe65a52f8fbc
SHA1 d58bb4f3ac46eaa127378ed9fe194c27afde8fda
SHA512 26565b6095b34d4f8ead83c67578ac60156002cdb9bef4c55e5ae4704cb02ffba53589e333a7258d79ff885960f702da38a755d075cbc3d96e748821e186b3eb
TLSH
T15F51E595E8935665CA5A3D0C9EB3E3D866B2CC6F09060D5FF42EE0780F1BF2644B3416
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.FuxSocy.yara

SHA256 fc3869e85e07262ebe5767f720943cfab33a0e81cd77afd79c64ea045d42a1e6
MD5 a2d5baa2690bb33daf9b31e784d11d54
SHA1 06af9c04b8469ff2341d6121ef50a3b90c0e909a
SHA512 b214eea12a1bce1a12a75d50684c9587754f2644a2439c8c8d2b3240cd6b1ab37c307d09e6ebd65cb3ff431caa11f8ad53dd96f26344a9cbbd5ca7b02243729e
SSDEEP 96:aEEfuqTwwBN8jThOvJmYOLrDWgDw/n/ROgDOfRPhpQcS/+:aE+BogQY+W+
TLSH
T1FFF16F9198835299C3697F0CAFB3A2B42577C85B0A405F57F10DD0382F6FF266A73416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.GPGQwerty.yara

SHA256 0b84c8ef295af94a7d4a945affeffbc08a64b9aa2f7095a20033bb42e07bcb0e
MD5 dd82e5ecbaa8f79ddbc87449f980d7e4
SHA1 256165c7f5ac0e3123f745b3621b8c1fb68b940b
SHA512 7ea71b60ed29b27ebd3a4f053026aaa89938b2b0644678ff88f6a133d64abc5909bf2478d865666d0c13ab50dcfed00659bad8e349459d2914bb54b13dfa30af
SSDEEP 24:Qw1qhwmZViWozdeM6urpGj7s416uG4CD41VfcxDt8K8W8a8G8C8u8e82Q2S/jLiF:XqF6T48rpN4NLH7XTv/n5/gP0W
TLSH
T149B12751AC036215D2253E0DAFB359B82637DA2B29120E4FF74FD1742FAEB6B4A73405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.GandCrab.yara

SHA256 20233be9e20e61c2f15b89071c97c2afd76d62401380691869cb3fb8a5ef7473
MD5 ce49babd46486e5ef6b315500da6a3ed
SHA1 6fa70e16366dac8dd3592a39e6772ea180ad5222
SHA512 87f8b35b34be7166dd37e4267ea256f165958bc44bd47bceccf58136c4600d5b4afb5fc09b27bd4ec6be3d58e738508e39e1fd4a494758eab4fe2e9613d0a4f2
SSDEEP 384:e51j6v6U6b6+h5+HeB1v6mAeKG7RMN31qXNBATQzAi1QuMCFOEx18RA:+1j6v6I21v6mMgmN3UNyViF
TLSH
T18D73E9E1C883464D8A783F4CDF73A694A276CC5B09874D5BB24E90352F6FE2B9673406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.GarrantyDecrypt.yara

SHA256 533d2f0e655b085564bab703f799195473f259679e77c9affc6a7e417521667a
MD5 0ebd96022b1082eae8ab0822522f6180
SHA1 90dff5fd90fcca04bce2b992ff9caaa88d2dc202
SHA512 d6a736e9db375dedea60ba5ab04184c0ff2de3c99ee4b2353ec7ba1b8f0c35d70aa8d70eceb25dda4b5eb1f2d18afed87077c3bc51e5676e0d001b2caec3db36
SSDEEP 48:E24ATzoHaADG+vrHVSnhIIKnXHSpLP4FmR03CItxGXTt9fB5B19uOgoD+UJqn:JJlurHohhs3SNP4KnItgjtN9uhoen
TLSH
T135B158E2D883820D86393F489E72A684F276CCAB09534D5BB21DD4392F6BE2B5573416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Gibon.yara

SHA256 4ee215353d4e51e7b8b3fec7bb19f4a98450812b88da666a55f67cd1043998c7
MD5 8755f42898d1f8431a7dcbaa630235a4
SHA1 1843295383c49ac99bf7a5cda81ff7d85db385fc
SHA512 1c54fc962257b5a0d24daddca63b1dcf591bcfc123e7e383c245fb7ca67e209edd6199ee3e644d388d7ddbe9ff79014f89257ed674e29b3d7b8c08b010b62010
SSDEEP 96:vlTLVT7QkZcMu7WsJvChA8PXM45gOhu77A6O:vlT297WsJfoc4TcO
TLSH
T1E202FB999C87960886763E0C5F7399D8A2B6C96F0D024C1FF66E90782FA7E375173806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.GlobeImposter.yara

SHA256 6cc3f98d9a8d1b408ca25b24c6d2855864190228be48a47913929402914cb306
MD5 9ac3dee112d9c1960aec4622888d551e
SHA1 6d6d04e245dd3730de550f1991949f74197b9af4
SHA512 5e1daef631975152244f7fc8558ef07218d1d3e1eb60c81e8afb1ce8032d39e9003b245c806bee947c3e9664040e986fdc7803175c6166a6984a76f80d375ec3
SSDEEP 96:oHLNQX3q/+fZ70zXnYjir4Vurs0SFGVFlz3v42usgnqgzXp4yrx30edF3Gpk3B/s:or0M97v4ugnqK4QB/v4f
TLSH
T1B132FB909887A5A9C6B53F0C9F73A3E4E175CC6B19424E2BB51DD0362F6FE239973402
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Gomer.yara

SHA256 4a375e67f35d5fccf8aed9aa88e27b00ebb8eb38b1a6db7158b53d79a5eecf95
MD5 039f7fe6f9db2c609c9438117d5f5ebb
SHA1 c5234e52703f18c8bf29a1201ee5450a5b27c082
SHA512 32db0e5b3546f29b132521e65ce9882f9828d212450e2396adb718448546a37ed432440ac25cb433f81c63538b87221762ea14dc43074ed465cbfd48c569e395
SSDEEP 96:pMvFQZAaoZqcr3yEUD9HZAt/4mNoUD8EiZC0u9YUFHDiVeYY:pvv6qtpZAtG8BPYY
TLSH
T12BD1A2E198839258867A3F0CEF72A6D43676C46B09020D5BF24FA5396F4BF2B5573402
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Good.yara

SHA256 9188b5965f5753c2e7374375b41e21cc9b0961074d05be1756cd1008397563f5
MD5 79ebf57680d2d2d621fdff65d3ede8d4
SHA1 0a494cd28df7438eb6a91b9b9d8e23e2e6d2a8fe
SHA512 cfad6da41e7405ff288ffe1a8346a5f75129faec82b6e92f70f8a8ac385b1748509e83498f6d2c22f6c193087a0a542ac8b877dedce0ad1379f2e5f6139a09bd
SSDEEP 24:24eqATHitoU31y13F3d3+fb/9Pwvy3LEz8R88rFJc8Cv8ve4F3Z0ZUz6dVF+JF+1:f4W58F19Sl5x88ov8L7iqsfCn1d5xk
TLSH
T1C8A1D7919C8391198A373F0CAF72A698F276C81B1A0A4D2FF65E80743F76E3B5073416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Gpcode.yara

SHA256 cf75ef6c934996d3860dc96c18c7c83daacd0597b7f51d155c7ad2652508fde1
MD5 851ca7bc75d473f9a07fbfc244091d65
SHA1 7be2b16c8128ea8f0a1ca82664a1246f715916b4
SHA512 f17c07eb52e08c96dceac22fdf29deb84d1afc10aba9a70a140ba11b2c6a60972012b08cf6b74e2a50918452ed455fed415237892c86032fd4d64e122ab40610
TLSH
T1DE51F5E6AC576564493A2F08CE72A508E237C95B10630D1FF66E91781FBBD2B90B3905
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.GusCrypter.yara

SHA256 c465060118a1b1149ac04a383d8a638631ad603ff30ab15fec3949ced15a9553
MD5 46ebecd549da39a019a827ebc8d3c073
SHA1 a68a76cf6a68962a66b823c2e2c0bae6d98a5813
SHA512 6e294e8e868684c191ab917633f1ba7d2b8df5d99dce6cee3d92fcceaed40c9b524bf4458ad194bed6dfb544cfe9a9e3a6c1850887969961d68be4a04ffcf078
SSDEEP 96:ROCPu0ffMxsH9suJ9+UNw/Lq3LSPtlYhnJCs:RO2c6Svb/PtUJCs
TLSH
T14602F9998C87964C86367F0CBF729AD83576C42B0A020C5FF65FA0786F86F2A5473916
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.HDDCryptor.yara

SHA256 bc26c17ce58ef4bb1f55e39edec899928a22597fdcc10a9bbd6d911b54218831
MD5 0543d768ed22cd28f94d5eb43837c8b8
SHA1 5c4e891b633ea2c6214dca03046d3bb30db57c52
SHA512 a9c8779479757b8932ae62ab7e3220e59a4cecbf38ebc0bcd1f7554912132ba719e54176c285343597d036579eb3cdf0988751a12c93b5a85e30d9b09d720de9
SSDEEP 96:nyfPN0bg0j0d03q0KWPOA+M/hX+/tbUUS2yJUbCVdsFKBIYT3NmoOpNjZNVU:nyI5BKYemAEooOTjZNVU
TLSH
T1C61289D4AC439649CA353F4CAF3361A8E2B6C89706421E5FF64E90352FBED235A73810
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.HDMR.yara

SHA256 03095f48516adac713e788672e0bb8b7213312642264d761748154f453d6d7aa
MD5 f6f9e8e6346e56e93d6a97d5a93a4fe6
SHA1 228cdea478b9f63e6398fa9cc6b667d2e8a7ea7d
SHA512 66876dd79717ada2346bb817421fb067ac9b2481d2b8003219a8ae090dfb8a894ace7b88e7dc05231250acf356374a3add5d96e8bae762de355be9e9a7e442fd
SSDEEP 96:x4vuvg0n0hdHFt3+1SlvFmo035Vr8zn5NjeEw/YvuaFXil8xCNCDcu0iGDzLYOCB:x4vDnLLnVvvxUN64Rl/H1vH1p2
TLSH
T1743224E098839658C6763F0C9F73A6B4A177C85B1A425F2BF60ED0352F7E9238973815
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.HakunaMatata.yara

SHA256 378e0f201ec1b76f6cd14847b8465d4b6c35f6558f05afbfdbb66f14b3a2e57e
MD5 8ec00f3f599e305b3ead9042f29f3ee9
SHA1 e902af5771b3c874009720415707e6bbef3bfdb9
SHA512 d9f68a67fa963a24c315bd798c6d9890ed7cae3ef89239d7fad730c33726850606a4ea22e483a73e3a1ed1f610dfd79865f98ddb67856b03ab15986b4b31f977
SSDEEP 384:V2F23tTzyiX2NZnoa88yXSaA6/f/vgF9SP3pwiBqdMb1JCu:V2F23tTzyiX2NZoa88yXSaZ/cu3pTP
TLSH
T19FD2C994A8432204D3647E0C9F7355B5263B8A1B1A021F8BFB5F60356FAEFAB5B73405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Henry.yara

SHA256 8f96b73df6c4c573055ab96fa9dd348ef5397a18fb28691950ec9f18df4cdca1
MD5 775fe9651fffddcf1f06eb0b7c1d136a
SHA1 a411b7ab03ec6af1944812337c4ca366e67125fd
SHA512 2255451e3ec82d1dc75dafec342e0870075e9394af5aa46d84a29e8931740a4515e1146ac5b5826705bef2bc31f92414daaf8b7470800e3408270c1b50695b65
TLSH
T10381AE98D8BB20908875BFB4FFB5924B3A27C5B308040E2BB24E58745F7E71B66C3458
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.HentaiOniichan.yara

SHA256 cbbc40eb26745eafa0acccb32019e3f3e1d4715b0a0c664532bc0472dea1bbf6
MD5 e639880128c93ab0b8084709f3e50f6d
SHA1 4c22f82de17cba646d75513e9ae4b9f64782e9c1
SHA512 9d7ddb13038845a2ee411bb70c5ebf1726d41f0be6678b13b85b15843aed28de6c076b56b2e98a499fec06a90d6ef0b067f23ca2e8dcb3b36b48d8350cddbbd9
SSDEEP 96:5eMs/v9c4CI8+xcMRU5x5bo6rUsqoKqaYWI:5ez9pzq51QYWI
TLSH
T199126D95D883925887A53F0CAF73AAD83A76C85F0D120D5BF21E90382F9BF2B5573506
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Hermes.yara

SHA256 5f98e94afbc53c349ded4bad2fe226dabdc261c48e0035b4cbc1724f45ff04cb
MD5 f9f1a8fab1fb7930ce8494a08a555b2e
SHA1 12e9c6cd32ddf11653ba451670c9eb6fce69b603
SHA512 7581f8f88654253b6e11d25346d8e08d7238de3af2d6b5e3d76694660fd1ddc22df83f4a67e965790776b8e927892e4a709359028e30a1570f9de0c38452f0f1
SSDEEP 96:OSJ6BAfQfAg+2WJVmIC5CITCgLgCT4dLu6xZdVVczzgY3smoa3bc00XZ6wBcS0M+:O81fz+0+K/0s2V0LcUzVaGVJhg
TLSH
T1B592F5E2D88745098A793F1C9E73B784A1B6C85F19534D2BF65DD0382FBBE268573802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Horsedeal.yara

SHA256 91a78a78e039acb2705e67b224560988658bd57d5865e57641b09991a6f71f52
MD5 70a1c8cf07b914ea948bb01b63149fce
SHA1 bdaf8ea5edd5b1e69479e1897483e2f6d4b59977
SHA512 844ddfef35f12d2da6b6b12b5849a9af0a6d4502a5c5e0d992277caeba8e08f14e51c7d4cce4a6d9e39220e360e873a6f0097d5607a879aae692a4465a068886
SSDEEP 96:kfAjGGP0tzw7FhNOc+VPDeMG1RGP9icioF+O:kfwgP/F+O
TLSH
T16FD157E1D88386198A793F4CDF72B2906576C86F09458E2BB20EC0352F5FE2795B3816
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.HowAreYou.yara

SHA256 6ee0ad81ffd153b138d0122e035d47f7d7d0848c0e153f6558d39edc59002949
MD5 cd13756fe7f4a51ed39fdda5ba4df302
SHA1 4fcf915fc194456bb0f6dc4eb7b4867524cb8978
SHA512 6c77342b77c4d6f5e85a91762e5e2f146bb996c90a0990e22b6ce741ce1d5c2efb83b7e2586476c7441f01b47a108580b5e0b288196cbdc4a5fe3cd80b5f1027
SSDEEP 96:oYSmVOPqJoL21C9aEvvuXUMP3MSL/rojmXQOYAPXqXPdwI:oQn3xUzwI
TLSH
T1C162E3849C535390C3113E2E5FB388B519278B2B19403F8BFB9E6475AF5EAA757B3006
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.HydraCrypt.yara

SHA256 e00df9f7b502ccb69fdb1a323ba5635f408f15bf48985c13a78ffddc12d192bd
MD5 e09df479bb43ea12e254615d5e825001
SHA1 cb032e5b1a82b9aa3b41b88af4d6f5f71bf5f6de
SHA512 3ed89e69cc5003746f4bd2ed2c02233f41517161220f8c5ff6a6c11787b80b6c8c67a85781744307675123dfed1757e51cf923a3b6f1fc90578602cfe7689be5
SSDEEP 96:otb7R1r/xXQI6mYzYwKuVVoWfqhzEc9vVxmpV8nfkBab2U2x:oKy9i0Wx
TLSH
T19E32E8E15C83844849363F48DF32B788E1BAC86B495A5D1FF35DE0752F7AE669873802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.IFN643.yara

SHA256 134ff48b706196c277d05dc51be68374f40e84ea970804821d95d0ef3be677d5
MD5 5857db9435ec5bd06043c15147bcd90a
SHA1 5074f3d0924a3d776842c58ee2286a8ec2b6c53b
SHA512 f156c626492496e73a822a5be8a0ce0f73e9a85f023eed09b9e06dd87222c64855843d107f66eecea2fe3b9aaf947327ef97cb9fe6ceb4c6ee504605848e266e
SSDEEP 48:+4QYRJe7dBOjfTSaJDdvRNhcDrrrJ9XROJVRByeUhzjeaTa:+8RqdBOjRVKvZm1STa
TLSH
T1CBD119559C8782188B753F0C6F739AE8B276C45B09030D6BF25FA0786F6BE2B6073416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.InfoDot.yara

SHA256 8c6cde557d5bdac46923d3b051cb03d8016bd2a514f373493e70020f090baf99
MD5 ec1db472b6e6abddb2edd991ed4790d0
SHA1 c1ba8e1e9f855e53719f41db27083fad4b0c873e
SHA512 9af2456348a01ad54f526917a65dec72a522b7a1b76767e06627095e6bc3713f94d6316d87c5cefbd6d17592a717fe5f2ff558134504b898e530b63f0cee6abb
SSDEEP 48:UNPtqe0ANq+NqSNqVo/26Azzuhene1MUsNqZslqpaNqAKsNqyMzzMM8E9iEtBQD9:UN8e02zzF26Aewe1Mn75B9Qzzj8E9hpY
TLSH
T12BF19266D88392498B6A3F4CAE7396D87176CC6F09014D1FF62EA1382F87F638577406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.JSWorm.yara

SHA256 3bd3eafb16e87d702ce818e065f619c2d288f29db26cda6dc0bb92d1bfc478a2
MD5 fe38f1230d4b99466404fe3add3e4265
SHA1 f86fb4fe0aa8f83e5883032a4d7542d42848b633
SHA512 4d1ffbfe4196f781ce4a0dac20234acd6a57dd49a1f55a9bb532318521c74e2952bc156caf2b9460799b015921efac04b6b6ffa4da0e2ee80e72e95007349ac0
SSDEEP 48:Q4ozCayfyOprfPcWaT74lvSHF6LuHADmHpxTqn:QuDkHZl6LYADmHp0n
TLSH
T147D11FA5D88786198B723E0CAF33A6D9A276C86F09074C6BF25F90342F6BD274173416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Jamper.yara

SHA256 ed4b012e177ea0d9a2f4ea4fda4918640f589899c179b8e8b185ddcc6cb55805
MD5 e099e776b9f96fa29c0db82245e8d6a1
SHA1 1a515523548a685abc91a0182c0f6be102817310
SHA512 f9a52e4b24b77689a540216aaffa03f49af6b4052da42d993165f78cdeb0d01e0cd438d9443705bcd6f0171b0379b82659ad2ab85328f2390f152bc6c947a6da
SSDEEP 96:V86l0Wfs5LLbkandf5ytWdqYqIEAwkTQRFXgAqDp1dZxwfI3vH2:V8CmwHaB33vH2
TLSH
T1ABE129969C87420497753E1C5F339688E2B6C96B09034EAFF15DE4786FBAE3B1173806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Jemd.yara

SHA256 948087434d916963d2abd94887f6a778fcd0ce3304a3f54920702a8b047e56a4
MD5 9ea064d8874603a32fa5e0406331b3c4
SHA1 8f80063567b7141c38a08a6044190f9a33e5866f
SHA512 e3ac4e521664c5d12610aeb591e9613853c959967184b706226b50785fd1ec48220965c91b0040705a14467c394c16187458c10d47fccd1842fc2a80ee487ca8
SSDEEP 48:qF4dyYVDdiLZH89xY5cEin5c0K6gAk7bbVjLJpK8EmbYvMCSvq3z3zbH2:qFkJVD+89x+E5RgAGli8EmUMC6q37vH2
TLSH
T10AD1E49A9C8B471467753E5C4F338488E6B7C82B09124D9FF15D94386FA6E3B1173816
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Jormungand.yara

SHA256 5bbf7c03956115ea57b564a5930c294caf95b4c042cb5243dfd63904f47f00e8
MD5 e6d590ab706214763be6f34fdb8880ec
SHA1 e5f36a53c3739c8c81d90e49783f9fbbabbef9da
SHA512 1ca824a35220f94f3420a3b11fa0ed22e9cb8712e19186475fbde43e3639d7ac752db1e3874b5eacff3bed4c6954b211bd2297cea3e5a259db591b561240c0b2
SSDEEP 48:mJPCjLy+zckKoIOvurKygCiRjnobBsM1QbjQPYztTqoj2jB2JrrtxKBxur/cxp4V:m2LbnjxbhcuIB2JWoZWqmcH
TLSH
T1A802F2845C536380C3253D2E5FB398B51A378B5B29002F8BFB8E64759F4EA6747B3006
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.JuicyLemon.yara

SHA256 2d8d392e801824485620efe8efff8314f67946747e6b46b793841eaa262126b3
MD5 888be710f3e800094cf70f968c0e009e
SHA1 eb8824623b584baa7ad8519ded960be03f24d116
SHA512 134c92b61c447b0ef9ccefe2868d1b3aaa2a21283d50978eac0b87e233eb9e77c90afe0da6d5345e79f2951127dc502db2f1701e1b5a72cfdb29ea0142b44e93
SSDEEP 48:6jtRCL9od9Gzs9GBeSMzaof0wE4o7o/zMOrmVG5NxmTSq/ZZp:eG9od9Es9GE3fH67/OrgGp4ZZp
TLSH
T11802B09AEC874B445B543E0C8F72A28915B7C86B08564D8FF26EA0357F9BF376173806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Kangaroo.yara

SHA256 d722cefb3ba6b58518c5633259329a52fb4deb988faf813e41e8ded705adce7b
MD5 dcc3705bb5dbf6aa9adeea78cc3f3a46
SHA1 7ef1c8d36329e381ce513b4d897cfa7621354619
SHA512 3399f903674d50974cc5994a1bbfb7c9d9ec4926491c4fffde39e5108d9c3eb4262a7180539290f21d88a0f59a938fe3a93c9bd2044728dbfd9afe14659a4f7d
SSDEEP 96:4P4h/y+DaO1zjDGCLg8eA/AYgsIXgt0t1ltH1G:4P4h/3nfgtH1G
TLSH
T153B1709198879219C6793F0C9E73A3E4E276C86B09025F5BB60ED0352F7FE234573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.KawaiiLocker.yara

SHA256 d18067566e17a1d34943360a25e30f7d29f1a2d3c6846c97288adaea906b13ff
MD5 391c1ae48d1550f3d3bb8fe78bacb4e5
SHA1 4e36f187c382293f9b40739f5c28a27d370490bf
SHA512 2226f834c8ad4cfb6403176a48316c81a5618c499e5e66a4e549766f61eb552b7e0740d713c915fdfffdcae5dfa9814f222448129735081622a69e720beeda17
SSDEEP 96:QcpBsSqsSOYrCLXZfPdiH+o+W+W+W+M+c+b+E+G+G+g+Q+Hu62EGdMS:QcpWMFfdMS
TLSH
T1C2225D999C8B5B5456A43E0C9F7245C81ABBC87F08524D4FF22F6834BB8AF376073946
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.KillDisk.yara

SHA256 494128464b00e37f31b35746a6f211a78ef7d579b280147d8425d907907f2d31
MD5 e5b5bcdcfc4d5f7658e8a2abc0cd452d
SHA1 caed512fad8e66d8ff6a2441d727f3e4512938d7
SHA512 9694cd6bf0deb1a6f081c37fe1d0dee02a9f6a9da01200289c8ddc341001d91566ac9882ee605fc8a960b8a270b3a6dca5ab578b988f4e27926e0183c14a3e61
SSDEEP 48:P4shVFuI2fRHq2WgAKU+v3KbGpNe98DkHlBY3c7:PL3V2fR/WTKRv3KbG/e90kHlX7
TLSH
T18BB1809498438359C6793F0C9F73A2A8E276D8AB0A421F5BF10DE0786F7FA235673505
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Knot.yara

SHA256 c73790f969c5ce2b7e5aa1e2d55ab6119b47ed87630bf6bdf61d2096a411f692
MD5 b5cf70291b1ace450ed41e8588db0bf4
SHA1 5d6776b6cfa292bbc1981559fa1c768a09eba934
SHA512 fb9f764fd13cc386664a71d7b3859c80d583bc25a0885d03b6a30bf0c23fe2230a649ad25da1c1f274d26b04112ef0bc0697d2ec109c35498b7f1285d701c27b
SSDEEP 48:rRaQrt0aUxAIzhtTPzfgGP3Qg+cCf0rEC:roQr6rjLgo3NwC
TLSH
T105F1E9A6D88785199B663E2CDF32EB856577C89F09054C6BF21EC5346F4BE338233802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Kovter.yara

SHA256 0e003876fa4165e50ff53f15cadd2d31dfed4f5add8cd28371e4b59252dc2207
MD5 420ad6628b4289868da78acc31943085
SHA1 9cac49e79ee0b333221f5411ba0d3833bc3ce057
SHA512 b7be07faec76d75628a0c06c41cfa3ccd1094a10f6dd6d48d2f97f2cd4fb593137a3fb69c3061cccd07cf37be9cab44c64307fee2778bd477dbb915593d3b386
SSDEEP 96:SI5J2g2hhuUPGQPRkkUmqZorffdIuQGjJLc+7YjAodwtWTME:B5CeYYGDE
TLSH
T1FA329AE58C8746049B793F0CDF32A648A277C46B09570D6FF25ED0382B6BE2B9573802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Koxic.yara

SHA256 443cb9255f8d680b870fb7277f3d441d305f5d4d8fee61c215e810725f3a782f
MD5 4ca09b07fca925a9cbca677b819b244c
SHA1 f81fdc3ab74d1557d4dc67fd88245faa74613398
SHA512 2ee6f67821ea147cf455380165e49c6d524c87c58435bf8ce527fc33a0228759f163b81d895f883f3540dd40d383962ed6c296e563bf3a7e10602fec45b1b275
SSDEEP 48:trjOgBf9Si95P63IpKSKWJdPKMvYwQWrcP0:RFfzLtzPrvsWP
TLSH
T155A13884A887521A97353E2C9F76EF846477C45B1D020D9BF14EE874AF4BE3B9273806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Kraken.yara

SHA256 3a5241f91ce1f6e3708ee156d427440051525bd14c1657084b3c8fd433e0bb0c
MD5 6f9b42fcdc8c1bd846668660647ee4a6
SHA1 e51fc50646bae236755eaff94bd11aff7b874b7e
SHA512 92c40f2240d7de2025777ae62f07f2c41448b4119937841662dedfc838c624b37190803396705a3df7eef494a41cbf2a4d7fefc6ed3b148cddd82c1daa9531b8
SSDEEP 96:RA2zVtoVALB5EvEpG66330AKxhrC1Xb/gjO/gdYgZL00K+VJAJQm7h7Cgg602qHX:RAiVtoV2WEM0AYUHqHFdHH
TLSH
T135225F949C83964987327F0C6F73A998B2B6C46B1A030D5FF14FA0786FB6D2B5573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Ladon.yara

SHA256 f10c0bd99d68100a074a199ebeca71db257e725300f4b2215bdb0b5ae71080cd
MD5 5f9c82c223b2dbf9d6b78c24bbbd6a08
SHA1 25be8dcdf516eab150868dd8b03061857255ee2a
SHA512 af8f6b5818a60ee0ac10c4afdf5236b65b5f1c2b77ec8e3a49f587f0d41eba71d782a0deed310065504d6e1f7a4ce6fcc1948c19efe0a69235cd28f228f6fa47
SSDEEP 48:O4IxqWNqiBOZ4xx1SoSJSpPiBOBVWrUn1q94D+EttbH1k:O1LXBOZq6b0RisBVWon1q94D+EttH1k
TLSH
T1FAD125A1DC4395098A7A3F0CAF73AA88F176C85B19464D1FF61E80382FBBE278573405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.LeChiffre.yara

SHA256 2df023e85394e8286271b24f66524b359b7988114718fe78408c2298889a1f5a
MD5 8effdebd45d332a68daba12091c553fe
SHA1 73d4ad87fbf65348e3fe0670a93211a770bdf5df
SHA512 5647455639a2c1194a63f8c0ac87b17a067b713ddabec9066c1a01bdeec4ad4f79d6d7a0a468a81abf00ec8d870a5ef7ec2f41eb133bfbfeeb2e6b60ef84da51
SSDEEP 96:cvaKFEaGy3Np9b9Xi32iGiSO+mixXJt2jhs2aSqaC12AUaC44zyfZqv:cvr4y3jja6m012X5efZqv
TLSH
T1D20214899C474745A7713E1C8F335488A2BBC86B19130EAFF05DA434BBB6E7B2173806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.LockBit.yara

SHA256 fa3bb2a9cb674aacf2755152fee239bce0086094c7614756ac97b7f8586b4195
MD5 a659a373f60321e10ffdceefe1601ff2
SHA1 7c17b3576c628cdf9c12fdbd0d8372cc193ba505
SHA512 b9d5c2e46fb142fd488b414465d5b60d3831b7852ab4bf99db9cd83c46752a0f29706f36cc153cf42e9827f4c3c70970d486b224c10b18b998d9e99aae891fed
SSDEEP 192:jRhc72hSlIWMs9cUM2MB32CqYIGYXqHXBCtSVLlMR:q2hSlIW9c12MBGCwGYaHXBCtSVLlMR
TLSH
T1AB8287A5D8834649C7793F2CAF73AAD02677C89B19424D4BF21E94382F8FD2B9533406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Lolkek.yara

SHA256 bf83df1d7fe0f61bcfc838cadef55725f376c23dfa12d345b24d54271f1cb3fd
MD5 5946710bbba6722c7e8748c7a006d70e
SHA1 4a2189bd3740334e65417cd2f6055e7324409cbf
SHA512 292b23c9b922bd11bfa2e610d4a8527b8f7991041f12c7638a3050c412865c87e40f7cd24b0ccdef0ca3d12817971a8fcc1e41790db5d0c6127afa0f844ec6f0
SSDEEP 48:td96EILZiFRLDg7fnzCOl+0QlZTQUmIHMvy6s1I6b7MwSsMPXgr0Y:taOF67fnzt+1JQUmIsU1F7OJoYY
TLSH
T197D14CA5D8839599C62A3F4C9F73A6A426B6CD6B19410E0BF21F90392F4FF235A73405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.LooCipher.yara

SHA256 09485178e4082a59bedc673fb61fc4fc1f5006667addc2847d45085f83208ff2
MD5 7c0068028563876756e85544047aedbd
SHA1 e4105f6d5576a88e0137f42c76a643ad6f034ad4
SHA512 6f5556716640a1cc9fd28bdd1ea69f38fffc8146f3003f82aef3e6a0f04df98087dbfd8b4cd16ead9b8da77c53775a16506855a0ad143f8841ee3f5c2b2a62e1
SSDEEP 24:M4eqA/ZiKIo3UfRewWHDOHvpNa/ccDacW/y6P3/XG1rxIM6d2KRTjDKMm1utLBWL:14UpAtGcueuMmFjt8WfC
TLSH
T1EBB1BC556C87911886B63D0C5F33EAC8E2B6C82F1E020D6FF56E90786FA6A374173817
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Lorenz.yara

SHA256 54d885d10473853b5469b626c23bb66bea2337e275b0981f98425cf15b68b1c9
MD5 d2ba01748a23aba10574f4e2c2cbb6dc
SHA1 752275b6d14497a8b8112ce357aece4188381071
SHA512 e66668f5cc949a669b6789ca8028079921ab719a29a74311f9c314ed8530419584f7783bf7e962c2f3982aa7318dfc046a48ad52e8d81568d310dedf67f6a3c5
SSDEEP 96:toipWBNa8UTV1RurgWzt0Od4BveD2coUUwqu+dSF3s0hv5XnRG1TZ0xtLotWG2UZ:t6oJonsxa/MViILww//T
TLSH
T1FC724AE5988385498A653F2CEF72EAC42577C8AF19424C5BF21ED4382F9FD278973406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.MRAC.yara

SHA256 cc2847045b8333b23c989d5052b2fece06c6a4fd925410083dc6a233c1a2e57d
MD5 004da943616e3cfe3cd9a27d01e3c077
SHA1 69f7d7b24270b00fa4c119704e2a0646ccbb458e
SHA512 983c2fcdd25daadcc5281ea78fe0ac0a514efbd97548ee5ae52d4e2f8185b4fb2f83988eb396fa9c3c7f61ac7a459d0d9fb6ee5c1c942790ab5f0874c88e1328
TLSH
T19561A3E5E88366198A697F28DFB2E9847036C89B19520C1FB60ED4782F4FE2A8573505
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.MZP.yara

SHA256 46839ba6304028eaab8642fca379309fef8a0f74d2ebcb25ab30e7563df5ac76
MD5 d328033493ed21a2c96e9e1a8d459145
SHA1 488d9fb8ba598eaca1c82b067abcf41c1a94faec
SHA512 6039b34f82ab556f18349ea40fa6406d50f491420db746a8c9fae61f1cf964993d08885823a361dff64123fc40550fb94bb6bc2933fd3f5a9a4f3cc36ff24ca1
SSDEEP 96:9XfYMhhZQAbHgNb6c8pi7Tj3sSUSaTlrZvgklPE/K1H1axH2:9t3YNRUSsD9S/K1H1axH2
TLSH
T13A128E9ADC4743564A703E0C9F3391D8E6F6C86B15434D6FF22EA0782FBAA275173905
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Mafia.yara

SHA256 e1c64b989757176f76b0aab8b0e250ca6a1fdabbf21022bd3f84ce9100f4f753
MD5 5fd1cd9e806220fc35c84e22d4fddeae
SHA1 e4a75d983ce512efa924f625fb10d324c7b87bdd
SHA512 8aa28e7fb2ab1646fbf5eb153439c099b5c988a08cd8beda514ce9a1aa95003a2c5276efff64ebe1252044e7139128385af120bccd980c1995991e104e188f1d
SSDEEP 96:0izfmODW3F/h5Eco3Wt2jGs0UUqIr2Un8h0MU0dIcRU4EBN5jtH1j2:0djKGUtnHR4tH1j2
TLSH
T15C121DA19C438558CA763E0C9F32A2E8D176C86F0A465E6FF21E91352F7ED239573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Magniber.yara

SHA256 2b277cf0aa88b792c830467dcf4080eb22eb12dc5a9b13e266e428a7b5ae5e57
MD5 37b1c00d1bec04411b97e687ef6e5ba8
SHA1 a3cb55e1a13d55beb67ab8b61dee99547f8d7edd
SHA512 25d1b0d1b33d54b128efc246b3655b06739f4d860dc8621addbb7e9b79a4a7b023b9d6ef77e886ab0cc7313c64988f50e32c9944e2076954ec3a8a9bf6fc17f4
SSDEEP 24:Y4eqA9Vi3roly4XWBwjnYvOqcG5vOqgvGqq/qqq/qqFGDlDogwB9TitroftgM0wW:Z4K4vRLzGeMePdJIWJzDcNaZrAr
TLSH
T1E5F1D690948B8615EB753E1C9E73FA85A276C85B09034DABF14ED4746F6BD2B9233802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Major.yara

SHA256 fc0819ffcbceb9e4deb9f068ffc6059e8f4c63d006454157de8bf7ed4d1e1aca
MD5 4e2a2e516fe5132c733e58e1f95a05d8
SHA1 cfba6b91a0933c19742f21f48a437c131a391ae2
SHA512 5826f9e3feca4e086ebe7877483fad2afed70518597791e7c7fd57f7810a3b74b23021ba40bd3029a65b47f00e938d7b2fbbbd35df70f4eea2a76a9eb3df70eb
SSDEEP 96:+Ukc2LQVw8R6aKbOoNQzMU4iR6+PDP/mqQwt9IfDotQwmmCeOCHgb1fUYUDQmvhv:+HiAzerwZkPMJTMyK
TLSH
T1C292B691988786498B753F0CAF72EAC82576C85F09064D6FF25ED0782F4BF2B9573502
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Makop.yara

SHA256 27dc72176ab51eebf7b59d2e14143a2801645ca80b503c87d0a31de94e7afbdd
MD5 fccb5728ab700e1feb12824f9994d04c
SHA1 8a82da90ece3df90b5a8d7859a8ecc6f423a236d
SHA512 6607703a91bfd9d7fbcb0b80937094aa14e7d68ca001cd022fe6930720bfc5293c0ec5f5a359811f2b571d6fe2162e2309cfbe429955aa600a25c3420ac97d16
SSDEEP 96:+QfdzyzDrHStmrsrzsd63w3H3EY5/HSJVcPYu0iSLYY:b2rfg4aYY
TLSH
T189D18A9098839359C7767F0CAEB3A6A42172C45B09020F9BF50ED0786F9FF2799B3406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Maktub.yara

SHA256 a61b29ec2fddd182eb1e85d53dc1fcfb940bb6b6a8af62b1e89450233df78f7f
MD5 d314df7c437c1bfe7de82c65c866bf2b
SHA1 bed5422e59fd2b8b525c766c5b0d4feff02aefae
SHA512 d1b17d914628b23b904df9ca272e1987d971a2aa162dbbf0c9ddf1aa2d31fa96af616d17be7fbe5c6bd5f9e55a611f6d04347d08fd28e89a22fbfcd11404a51d
SSDEEP 96:+Z3YYFvGLeDWFMZzA/t/1VHgNz6soupWnESSbgwG4jl3l//Dsngn0DREBsUTQ46j:O33F1WF7hYFLp9g
TLSH
T13A12CBD598834A1D86787F0C9F72A9C8A276C86B0C530D5FF25EE0356FAAE274173807
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Marlboro.yara

SHA256 00b08230007eccc4f73486a9f814749060f0a72d7d3acf312a8c2c1980cbcc98
MD5 27f46e76d435df43d20531eead5f7a37
SHA1 944dc39c1e7dff1bd6fa4d8314a9ea18d25935ce
SHA512 0e5c7b443a8cdcb9c221e6061e2b9c413b2461334a214d28f91cff1b475f0bd562eaa927a68407449081be04bcf6a4c9726150b0155f3eb6dffee42cc5d66f5d
SSDEEP 96:pg0f+/gi0J42tHPoYFlAh9Bt/lh6ZwCQMAwcwZ+L1:pg0DJ5Pa/fZ1
TLSH
T1EDF12C959C8352498BA63E0C9F73EAC425B6C86F1E020D5BF12E90B92F57F679473407
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.MarsJoke.yara

SHA256 3f19b8393717da113f9551f9e287941637b0f131a05ddaff07688d072fd9897d
MD5 e725019b2cb6b60aad1770841fb4837b
SHA1 5ec274177fee7d9e7aa300ef048918272edb8984
SHA512 407864a940644b790dd15f49f8ce2be0ba4a5efaba056776ee8b9468eeac2899f1a48a2a9dda16e7333bf583f0407c1ffde2a940b8f555cfa8eae02fb94ec4fd
SSDEEP 96:tIRbf6snT2GhsyO1Aq8wOp3lvNJcr5wvVFzR1q/40RyWMZs:+skA6+NwvAMZs
TLSH
T11942FBD59C839559C6793F0C9F73A6A8A1B7C86B09464E2BF22ED0392F7ED234573402
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Matsnu.yara

SHA256 2f5cfe73a7606b1f5581a09b403733ccd558dfcd1bfe18393ff0378031c2bdbd
MD5 725558cefb2535ddb196285fcb36444b
SHA1 5b4de92a500ae42e3bf4e0560d3e43bbb0c0c65c
SHA512 f3e8f82b40eb0badbd7d1989808142dc93b9f560dbb429973357814ce76dabb490f768aba4a8aa4b0841d9e570797ff83c43da17018387c4975a434cd21f2ed5
SSDEEP 48:+4Igkgwg6aM9/xVRwlxgw+qpacA2WHidKjpa67pFTha/J:+skgwg6aMfVRwlvbUcA2WHUKKJ
TLSH
T1BB02B696944355088AB83F1C9E73A5C4A3B6CD6B0C934C9BB65E81742FBFE2B6473406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.MedusaLocker.yara

SHA256 c328aacf16fb80d62693044f15c138cbeb0bba48a69036d7b7bf838f340d0f24
MD5 e6ccfd461febcae2701ad41586445e7c
SHA1 53bd002e70afa77c9d7e9311ee62e4c903ce6724
SHA512 990627954a0594ef48e1323049bf63c487481b90fc7d716856cbfd2a4d4bea02523ca2d04569ab7988360da82e5413f43f40e1a85f68c0f9732f135f4c75c9af
SSDEEP 96:3u3t7e+gKiggjgBMR/0SgKJgoVQA7gQgK9SxQXnBVX8Cariqf7XE/r8I77gJltg9:3u3g7R1R62rzlmnSvH1L
TLSH
T173328F659C87420596B53E1C9F73AEC991B6C86B0E034D6FF15DA0382FAAD3B9173807
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Meow.yara

SHA256 ef1850d956224dc607114d374e41a8b406119f1f361bab9c5e48e112362a137c
MD5 4671f4c9e9c8d9a8d1e1286f3e5f24ec
SHA1 6a051313b565a5287f95ecf4abce6917d34dcf58
SHA512 6434925d482839b4eeff3b101c7c8ec4ca5f899f27347ce31de3ffa5d885eb285e6eb6f6096371e36951babbfc6d16bd528d628618112fc7812354504b714c54
SSDEEP 48:mk5niZ3ZKRkyGlUcY2iook1IKmeY3rEcH:mkJ+JYkycUKior10twcH
TLSH
T124A16FA99C83865D9B263E2CAF7396C825B7C46709034D4FF22F84756F9AE3B9533401
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Monalisa.yara

SHA256 c54b54c20f927639f4cfd127f1588831d78fb6e0d2040e91c8b1a027b9937aed
MD5 62d07a902aa2cce1ba9c117397989118
SHA1 0089146d0e852ed3023f3719d0a6856041b1d6e0
SHA512 6350dc3f2af696288b34db4a47c62598aa1c7040ed698a41106f9c6bc62adee419135b05ea51705654c078a94e56ad510121898d457f5c8d51721f5ad549e75f
SSDEEP 48:z46YejOwI2QTWm/8PFcQxru7OzM/AMP7OxEN2Y:zKKjUWiU7u7ZOxEN2Y
TLSH
T151913358AC4382598A767E3C9F7399D52973C46709020D4FF24EA8386F8BE2B5473406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Montserrat.yara

SHA256 bcaf337182b001b9270a277fd1b3c629e3a2f195cdf81b1d154834cde014ea04
MD5 6f445fdcd4ad791028e47ee152adc58d
SHA1 6d5bcd199e13f8aa543f9858d14dd241b99b8513
SHA512 0b131574b6c3eb8e57c1a45e5f1d5e4636551130558303869e1bef979cedffb93be6aad997a96c683918e9d7faf0ab23b066f6f31f34b23fb026df86d7b54e7e
SSDEEP 96:1ney6zAAaRW1i3R/RIP8/bNyz5TERpxFxgbiJwWgX0+9e+ABu+mucdtpMH1tH17W:1ukwkY8/bC6TqrqH1tH17H2
TLSH
T149F15091988792188B7A3F0C9E73A694E275C85B0A134D5BF24EE0392F7BE374573805
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Motocos.yara

SHA256 8a411f3b4722cd4b5ad4b380521255c4f62516ec9cff65950056b8431120158e
MD5 f17f5f66f06cde271a2978a8ea8e9f3d
SHA1 52f29065a9d2876be950785ca8c3c632b01b82e4
SHA512 01875428a0572b53129df63a2a73208e3748399460c3879b42926ee0751eeef3ca12d3302bd7b22ca235c224b4585946c94c53aa211ab84ad29b6c3cb7cdc118
SSDEEP 48:vjPcN02Spzf4805x7LYTWq8jLT73zWZN+Y:v7y0BfL05hYTajLT7DON+Y
TLSH
T14781DF986C475358A7357E2C8F7292485ABBD4570A120E8FF14EA834AF4AE3F1673D06
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.MountLocker.yara

SHA256 e48800a016392c3066261c006fb586943f7af68a7adf6320924d57872ff46520
MD5 49ac5b978c5b830b66f2df483e8eada3
SHA1 b33bfbe02bee891ca3f0437deed00e622541a813
SHA512 64b2358fbf82cf06373e99a0ffab66cc92e8bbb58080f0cfad40b7f44043287cf3e4b53e01fe1544b2bc8b5e377ea54473a4652a765c517cd6f2c571e63053f2
SSDEEP 48:azJD77TKIhdMtXrVgFvrgxehf4PB7vb4wgDQjkbcqjsfHXzrp80rK:azJvHtdMtK6a4PBDb4wgDYkTiO
TLSH
T120B1BDD6D8835659C7397F289F73A1A06673C8AB0A400F0BF20ED4382F5FE266673411
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.NB65.yara

SHA256 a171935e76f8443caf2f52977f49b884f3ffce71c92c40bf29cad95d8f8959b2
MD5 d684f197ab3ea5d775771a59877cb48d
SHA1 3ed41e9bf4fdbf3ed2e2ef53dda897c6f34c0491
SHA512 78806c9afffb6c14a6363ea352cb2efe66930bda85c6275f5031bc70fd0ad6742d50b6f79cfa8e69a40f6a207e9e51910899aea8b72e47c5010b45d2692dd69f
TLSH
T17061C098D84391988B2A3E2C9FB39BC526B3C85B09030E4FF56E94781F5BD2E8573406
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.NanoLocker.yara

SHA256 1b7c56119d3cc02c825a378ff1aa562572367a70f7fc1a3d8f5bdb23817db943
MD5 190cf90c7d6f1f1e1ab3c27257fce1ba
SHA1 f60997dd4c8d6e1bf6398e0e4f9af98601435737
SHA512 88811e8566952d8c30d4852fd607a68316f214a2018bbb6a5494a4e20f420c87cc26c5e000ccdbf492c3d34a74687b0663dbafe86101ba1e73c4948c2b8fe186
SSDEEP 48:m48viHdbUlW+1IbTF/HbFgdN2wSb1UXbs/2UBb4rUQcbowyW9sotgu9:mWvqa3gu9
TLSH
T19EA1ECF5AC871A184D793E84DF73A049EA77C89B11890C1FB34E50786FBAE27D063919
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Nefilim.yara

SHA256 9317528d42439f8fd050bd9cd292b66266134327f6be8981c3cad00cd219020c
MD5 f35f1eb96661044121f2ef40122f655f
SHA1 239966836a0430478bf72bf06ad9be373dc3c00f
SHA512 c71b31652c0aae9f45da8108d818b862a0ff0f4e4e34a38e5778802b3e170bad55d29f7ed58b7acb8bd7f429cbc31db3665551daf77ae29a66b41523f02bc0db
SSDEEP 96:QZLftPuC1+XCrg085hubU6x8lPPadxEJDUmghYiptVYImpvBfcgctH2:QZLFHlbCP13B0ZtH2
TLSH
T1F2123AD19C439659C6392F489FB3A2B4E172CC6B0A825F6BB60D90392F7ED235573405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Nemty.yara

SHA256 16863032044a37521e7b8b536e0f39240d8ddd5c910bb5c70f70e6f93776f05e
MD5 1370d94b6d9a7bac4e78462f69902cb6
SHA1 3660649aff9da125bbadd039ff42eb2b77c62bc3
SHA512 1c63c4dabe61609312f065cb46360f4b2c6aaebc74167339c6d26660299e78905191e4cfc85e60c02805d9aa564b18d9ee002a1d5c1ce68f4cc05b0b57fa6f0b
SSDEEP 96:nCAXkt6hkdyBILU7PiQFooBjCXDta5Qu/n/d/u0uiuZ/f/1usuMu/p/3/uquEuCI:nCu57zUsFIN1A1HH1vH1l2
TLSH
T1525218518C435614C6753F4C9F33A2A8A1B7C86B1A064E6FF61EE0792F7ED239573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Networm.yara

SHA256 08edd762cb72ef48c016a3fdfe611329cbd1d7cd6def5b82dc9003809376fb80
MD5 0f51f969913092cfe470d3b0753269cf
SHA1 4a0f1bd15be416b643877167ef040d5e372a4cb0
SHA512 4d79c34ef1f4b973165b3eebed214174a8cc46f808a6bcefd09a738726cc00e003d92e14352536f3a6384922dca106f17f9da159dd53da109c56d689b062174b
SSDEEP 96:nYEcv8G/Iv0TPsIvZ9cmHLevc6gPTrrVRtvrtTr3VRDwI:nYB9wI
TLSH
T1F9D16A94AC8342098B793F2C9F72EA983577C46B0A024C5FF21E94782F5BE2B5573502
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.NotPetya.yara

SHA256 d1e415f2310e4da4642731230304290b22ed12a617e09fce49580fbff4972772
MD5 ab52f8f48f2f52501a47135f3bd24fe4
SHA1 730d42453251f9f42fb8ba6ff6f879bc5560ad8f
SHA512 94d688566d46ad3d208a9bd08e439292cd9f713e52abf56902d14037ad010498ae5038333fa3e4414470d7ac9895e7b83afb53608605c6e760db81bc156facef
SSDEEP 48:lD4ugdGTCu1vYvMknc0uzyqUwYNqgras+Ig4rArO:lD5gnu1wZc0uzyPw+DrkIg4r1
TLSH
T1CE919C91D8839659C6793F4CAE73A294F275C86B08434E2BF61DD0382FAFE278973405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Oni.yara

SHA256 c1c6549804a98dd3168b5d68d5397d71ec4c105967e162f2ef23da228c68a618
MD5 97119ad19ecb7a5b835146f9c831c166
SHA1 8dd42c02910d7c6b949c003da50dae070fad9ea2
SHA512 f8b661de3a71661d23166a6ae55f5c47356fa51c796f2fd9147c0a482bca45fa66ed81018868036196acd0235f6fcbee1a08513e6bd38c93e5ddace47867b76d
SSDEEP 48:vHlcmBE+BeQnY3SLIAf7yQR6g3hYjB+UoW:vlBE+BeQMWIy7yQR1WjB+UoW
TLSH
T12DA1D091D8839249CA793F0CAEB3A6E43676C89B09420D5BF10FE0781F5BF279573406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.OphionLocker.yara

SHA256 7957e2ad72aacf6c1e50082691e627f0461781dc77225952dbd2b1bb80ec4243
MD5 73a828b83ea29467facf9300da6fcd2d
SHA1 38ba31636c0a87db5ca2cc5ace95933f2917e83d
SHA512 aec0f4d70e44b779c2fedff7e347c722efe54839ce66af1df3b1349f56eaeb75c669e76433294c8d17967907126f7f536d3fe7f8ce38c09640d8a5d92dd5a8af
SSDEEP 96:bmjVPrFEE72Xo6gRAZ8TsP3pjrg7/r1Bu06klexvb8eIyCT:bKTAzo5T
TLSH
T11D129D955C4352584AA53E0D9F73EAE8A1B3C86F0D030D5FF5AEE4386F2A93A4073907
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Ouroboros.yara

SHA256 d3b253c48564bc7a2b8fc58382952362f404a9ba1394c036f4fba1a21554ba72
MD5 218a155ae1c0cfaf209f5ff5ddf420dc
SHA1 eb6ae169256bfca301820b011c3c777bb9d947db
SHA512 c5c69f527808bc8b1da029726196d7f26e55ad37f77ac80397deb7ec8589849190f1cf23f2719c9849fd21da4e24b0c33027c90e90207674ef38c060320245f0
SSDEEP 96:W+eBg42RkMcUSqc+q9ZwY3lNwF42klAH5j2:W3jMZYlAH5j2
TLSH
T1BD424F959887861CDB763E0C6F73A6E8B276C85B09130D6BF15FA0342F7AE2B5473406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Outsider.yara

SHA256 04c00fca8806f3896a13ac1b33970f9c6350f19f85c53db6e546d61b92d0d0f4
MD5 290a14c453738a22e11373f54d9202d5
SHA1 fb8dcb60b7fb2348e1e7504fe5f5bfde74954ca1
SHA512 3857189028cba474043eae56c180c31d978954e63142a9f9371f62da731b90da42ef101f4ecd2525c53fe86eb04ac40fc94fb93273369325c0f9d9a7992c615f
SSDEEP 48:2tdY7T0sKXhMvnSmyhXocLAhp/Nv03w8PAXaJObl9opK:ymT0H2nW/khp/hGw8PAXaml9os
TLSH
T1EBB18BE1E883965E86793F08DE72A6906172CC9B09454D1BB20ED0793F5FF2696B3812
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.PXJ.yara

SHA256 4198d9d3fd1905f217e9231ab72f092806e2bfb74b349f84649b5fdbfea9f6bf
MD5 34e52657d8138026e5531c9f6c9c2678
SHA1 63f3207d7d4781ddd65cfa8ddc4e17ebb5c00621
SHA512 fe66da875eff858cec76bf824d0efef102b805ad72ac57672fba1d9d0b371c8c518371ed14669f2399c57ac0d8a9275329dad41787426d6654f3a21f76d84152
SSDEEP 96:oCpQ5ndCTMf96dBa5tayUM9Ri/Uo/qD297o11H1tH2:ozdqY9IaLUM9ZoLo11H1tH2
TLSH
T12C3221A59847820947753F0C9F73A6D5E2B6C96F09024D6BF21E90382FBBE375573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Paradise.yara

SHA256 72563c030de3b5f81647809968d9bac465795180eb0475aa1ed45bdc596ccd6e
MD5 8f52fe6d011baa2619078640923d39f3
SHA1 0d4ef5cbadd496fcc940850b327227762814a551
SHA512 abee650c305da9e79683dea39d2359c224daa6caa7fef3b91d7800166b9c62152983d5736c7c45af5ea77043039514fe51a35189c8f6ab48e6ee118797e0c6f9
SSDEEP 96:DzF2+1hHDrogoqWrd7Rr5aMeEE330B8bPY:DzFLzgX+7Y
TLSH
T19EB1AED2D843821D8A793F48AE73A694F276CC5B09564D1BB20DD0782F7FE279973405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Pay2Key.yara

SHA256 2491683f883f6a454edfc9ba7c9a868d35e8f5c8ff9bab1992412145c30b4c09
MD5 7f2295dfb4f2cdf0c6dd93dba6804966
SHA1 5b41184cfc23323865761cabc9273142d04ce303
SHA512 53ea96859f79b7c189958c5f5bdbaaba03d8d2d6e3493ca6b1bfc020700b4540e888f5faed062b08f6b03d2a5f8cf39e5c466b71133b314f5326f822525a9d29
SSDEEP 48:UM6Nzmn/Tmr6g8ZA33t33SIbsOnS0XokLRiwUF5Rv0vWgD2hWrU:UMBnL28ZU33SFKX3LRiwUFjk8WI
TLSH
T1CFC1DFE5D883464C877A3F2CAF73E68426B7C85B09124D5BF20E95742F5BE2B5873406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Petya.yara

SHA256 cb1c3b8f170e50719b46d14c8d11825d84c44a813fe4094dd7f71dcf5f8d8aad
MD5 e542ee228edee8c6cf64dcf5dcf8c4e5
SHA1 7bd99c8490bb23b3ac5221037ef8d0654d18ed70
SHA512 84bc54cda4b00d7783701b1a50091157e5fff66afde91f949284e187e2b3400add183e04cdc189883f103b8780d0f48a18ef3128878c11af10fa7f971c976ba7
TLSH
T16D5124E1D803A229867A3F4CAE729598F3B2C45719430D0BF54DD1752F7BE2B557380A
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Plague17.yara

SHA256 2ec3900d7030512de566502250e897792433e40aa81be5050be49fde8a44e9ff
MD5 d9a38fdb0a5428b379d208b4ad528588
SHA1 6785c38582211800085851b532f9897c6dc04470
SHA512 0b101bfbb5d8153203d52d033791b933d46d47c06c7722150b4b94babb9709db2fd703e227859f3d10ad1eab1486164321f4421d9cb8636d404601b2af84aa00
SSDEEP 96:XQ8WRFcC4vkXwb34R4fwFNgPeDvBa9DBtSXldWz4fMD0PBBnyJGSU:Xm+b34qwFDk2tSU
TLSH
T13692BF56A8432204D3603E1C9F7795B82677CA2F19005E8BF6AEA0746FAFE731773506
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.PrincessLocker.yara

SHA256 f3aba3b9b61464f701f0f8882b24e777677fcd4ddcbe1bb8178a8206b00b78fe
MD5 6081c4a132ca88fd8be5afcdf173ec9f
SHA1 b89801536ea4028c0f3d90240a4e0c026d0d0811
SHA512 e9f5547996fe1de53b585ffac12cc2838efecb62c1081b885e9e06ce5be51da9264a11f8e4d07dd6e63cbbf8d783b6211902aff2b4c80a7bcfaecfc0fa0aa6bd
SSDEEP 96:ZuicqXM9rgggedrJZVort6DK/gr7Dr6rFrfrCr1MZs:Z9w9wx6PDepjWZMZs
TLSH
T138D1AA95984755589AB53E0C9F33AAC8A2B6CC6F1D534D1BF12F90382FA7E2B5073807
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Prometey.yara

SHA256 71671461cd72c3625940bdef4c1a9b7997438ab2935498434931b5d90af2348c
MD5 a1c0bb26cbf82ffebf1bfb1dce2bd788
SHA1 93bbb9fa38e2c9c11771e411ef7bbce7e03b1c0f
SHA512 8e01f90c819414bd2c9ce13a9af3a8dc9871c2fad9e927fa6997868f944431c2181cd006734a5988d5344e863c1e9d8b4009ed7dad762fffe2e18df56173056a
SSDEEP 96:Q8CowGuN10uLVYTIwv7lFrQf5uUUAdYwcPfGNp9DnrJP7GkgrqfqGWI:Q8quH/8awc8cGyGWI
TLSH
T1A332C9959C8351188A693E2C9F73EEC825B7C86F0D12495FF22E94786F9AE3B4473407
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.RagnarLocker.yara

SHA256 65c3b50a2d3ff480a59486e335a5bf2dda3b608667dc78e22c80b537ef0c53dd
MD5 29a9325c509ea745b88de5fa586c6cd5
SHA1 2934fb915a076d84a56e9e8ac4a8d9306f100910
SHA512 d8330329891e52be0ca292d438fbe330b72fe4d0c14b4d120cd34a35907eb30c4773159b0b15443a70c4fc6e4a6d34416eb043cb02e9f866414c4021a7bbc5c3
SSDEEP 48:J4ac+XgOhJnSoFziCwPfn6BWF7UrXn2vFxSrH1tbH2:J2+XgC7FziDXn6BWF7UrXn2vFWH1tH2
TLSH
T130E1C7A2D48799198AB93F4CDE33A6C4E275CC6F19574D2B761EC0342FABE278173412
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Ragnarok.yara

SHA256 0adf94d0affa46121cf6326cbd7d25d50f3a4672b4ed4d1dd36a4f0dbc202d29
MD5 57d988ef623065bab514915672890ad1
SHA1 b8844a3e3f838a7a65ee0841b7d04f16be9a90f2
SHA512 1f999953c49d2b3b47a3e8dd96f0d9c9d43b0b013c427ba38385d571a98223775219c7dec6feb6cec0f2f47cb908d769bbbdaa9b514ac68aa84561dbea7f81f6
SSDEEP 48:H4eLRGTBA33H9m66syBFNoFHcJsSjo1jmknsDK/moRYoEtpn3blfH4plKo1oWrti:HL6BA33dVyBboFy/uDW2r1H1tH2
TLSH
T138E144E5988346489A393F5C9F73F658E2B6C89B0A134D5BF21ED0382F7AD239573805
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Ransoc.yara

SHA256 36a9a6b3a8ac90da90d8ab439074f6d59c499f1545f613eb1f330067d3b7f8bb
MD5 938edfb1f00a59cebe72c5aef3243eb4
SHA1 3048cd607c2def8b44e22111d636516a626b8809
SHA512 6bea73e546bb81ee4a4cd0d53e0345dae1d71904edf9700053e5bf5748a38ff46f54c4f9d133c418ceac374f303f3f9bcae94581ee12acaae757c6216c2cb957
SSDEEP 96:A18ssAHtkyFAby/0j0uDA/JiXQ0fJ1dou2zFpKjDNCYXEgzpMIVbHwTdMJ:A1cgijPFC4F9KdMJ
TLSH
T10B0240A49C879258C6763E4C9F33A7B8A176C4570A421F2FF65EE0381F7DA279573802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.RansomPlus.yara

SHA256 e00526ea759169f4eaab8628b22807e63ed94342a667c63444644857085190f8
MD5 91b17aec7401d2fd6bd34df32d4cf0cb
SHA1 c7c20fbd7bf2ad90aaa9e112c5a2e8747d91d17c
SHA512 72dbd1586330ef56a8e5d0840e658e198407679b57a87448f582e98b63d4e1d7b0c035071fffd9a224d3942de20fa76201f2fc7d8a2f50d234e4cf1ad53dfcb2
SSDEEP 48:hI4242zAmVmgdT5mm+WdjP5fIRWod8QRNR/ZKyeCyeqeeQ8qsWv:hIIjmV1EWJUWojRNVIdA
TLSH
T1B0D12995DC8782188A763E0D6FB396D8B275C85B09030D6BF15FA4386F67E7B1073416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Ransomexx.yara

SHA256 03e6b155692182ea3bf3d109f047ba62f64e7244ab0865df75a98885d37f22ad
MD5 9bf5c7d4e93d67af2bf3fb4b17c8c14f
SHA1 30f9ee757f50b94184578ec7d839b34e803f5cc9
SHA512 6dcf91f3ef640c3d3b745a545c62ce8012ac244c9227286fa613ae1eb0280503875aa2a4f052a667b56c78fb40d95f4eba840a0321fe236d003dbcb5a35517b4
SSDEEP 96:mFlG0Yg4pEh6ZLRMA5u3tYrXF5scEr7gkxcAYf7FLmXy0ZXGRNefNfpfI3YO:mDeg4n57FL8XGRC1oYO
TLSH
T1852271D0E887865A86653F0CAEB2E6D02576C89B09024E5BF64ED4347F8FF375A73406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Redeemer.yara

SHA256 127067061985572b22cbdbd3375330f7fc7827e675edee2598c99931db8808ec
MD5 ff6beb0ce37fb53279f7726d8391a3cc
SHA1 17b98937c7b09f7e9a3d32e3586f6dece892d8ae
SHA512 a874beb8881b52c326988c5e43b60be13e4fd4a318c81210c873506b2d94e5af366ba9816d0f53cfb72c5492ac7b155fe7d7cdafbc72c13821ff59f15c9c2f24
SSDEEP 48:Cp0+V/opmEo3kpSESIdgSxeTeiVS9ncluXmrErj:CSywpf/ngSxeTqcluXmwX
TLSH
T1E1D1D5959C8355588AA53E0D9F739AD825B7C86F0E020D5FF66E90782F8BE3A8573403
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.RegretLocker.yara

SHA256 4d38accef37bb86949788a9c731f02ea7bc47d7f67edff172f3ce8fd0436fd70
MD5 c676d985d31c375bc505eeed97da5a38
SHA1 1cd1197d230935747671fd9600a363ff14087d0f
SHA512 d5544cb09c8820770f75e04655caf47a2876696b8b2632ebdbaff159b1ef2fb8e0873874265a30755de1ad8d1919460f01637c6a136aa2a5fa7072e9feeb94e2
SSDEEP 96:sviSdW/njR1HdwyGBA6Syhpgqli+LieVkluMRMeihgDW84NcBg4Fstgn7IxgkTh0:svnjrJ/ipgL7owI
TLSH
T1E36216959C8382488B653E2D9F33AAD825B7C85B0D020D5FF21EE8786F5AE3B4573407
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.RetMyData.yara

SHA256 f463e7163fe045df47dd7060208e560c5c8c9eb9b893b08008de4803ff0525bd
MD5 b8f62b14e25ce4a7ce93e225f568707d
SHA1 882188feca844ac3123b14deb13fe2aab041bae6
SHA512 73fff28b1bb03205653255078eae7d4ee8226b39e11a4269565ec52d0f5bb0245ef0ecd1028bfefac2883de890e2700cab9bde54045305cade4c3dd7696443f5
SSDEEP 24:SB4eqADU8Di3roQPFJ5NWgEdLk2DmgnOfT+/w2RHUQ8kq/YrKgQu8/vEaOR0EPbs:54I8G3bnZD9gOTqVxbpq
TLSH
T1DD913745AC031124C2756E0D1F7365B8E7B78A2B29021E1BF65FA0705F7FA631B7381A
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Reveton.yara

SHA256 bbd255a67b646b492575f7a45b4493c77ad6aa1f78bd20190d4266227906344d
MD5 eb6ba63a4164a55f983f27f4831e34db
SHA1 969910fe00d801ae4ce9c304b17c464bc4967a8d
SHA512 61ea8b5cd72a2a3be178b87c4260264a8fedb36eb5ab93e0a7da04377d04f7d899a8c37a926f35ef688787977da316bc5fbb06b160d1e77cb2a9366b437814e7
SSDEEP 96:db6RbEE9WwnapSozx3sBvu1q5chB62oaAN/:dbIEboC/c
TLSH
T111E17996AD83464193B23E4C8F33A188E5B7D86F09430E5BF26D90346FB7E2B5173906
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Revil.yara

SHA256 f5a4ecb0fa66d7f321c00ca9e787d754ad5486a620bab6efba9c40bb3c72fe7a
MD5 c1c7171fb35d642ee7df3c90e5ff2c51
SHA1 d2e01cc84b226e2b9e1693aaa09b90773eef73fe
SHA512 1b66b6c278357f66e35724a33c841cc8dc1009747a9d4f132ab0b1a559a32b9074fd3542e2274b47c3b26397b234769f2def6ca8f17244155268dee5f2171164
SSDEEP 48:G4QcozpZynX8LhiCCU5i/9wxlZ+6/2RFKQRLShikrbcofC:GgozHyX8LhiBirZ9/2REOShnncofC
TLSH
T175D160D1D843821986793F4CAE33A684F2B5C95B09534D1BF29DD0742FBBE279A73806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Rokku.yara

SHA256 7ad29e20d368cf3afc8fe4cbb7ce56aaf7f18f8a1e4ea80afdfbe197525e087b
MD5 af9ca366b292c57ecf322cea2db2f551
SHA1 45074b82520ec2ad2b1035d15955a4e74e9aa97c
SHA512 d1203bcb514adb72c10e46d62906b08e7cb95a75ec7fff55a1d53198362db06b52e37434077d8e3ded22cb60d0edf53a1362e2231c48530f6a4fabdb4b610bee
SSDEEP 96:SNHqDFYidti2ZJlp+QXekWXy/WBnhxZgfXGPGd9Xmr/0LEKxcVN/FeP+4HFXHE:S4/tVXlPWNnffr004HFXHE
TLSH
T1C5224E48588B9645C2743E1C5F73A6E8E3B6C4A709030F6BF15EE4756F7AE1B6073806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Ryuk.yara

SHA256 6949236acef545aae81a30f538b3f64f97bdb1a3c803c79c5710846a1303293c
MD5 19d06f3f2e3e6464fee7799a85351c3f
SHA1 6ec8fd8b2a9a03cb1ebe9dab00d139d703850435
SHA512 9c65864603ecef857a9b39a191fa841fa9af852d64ff0543a769bf16724b0f8bb2a77a451fc1822a5e39c819a28a00b94a8c638eeb9c39123631435da8c985ae
SSDEEP 96:/DuXqazJMVtD+x8PJQPRODU7mey6zAAaRW1i3R/RHH1tH1k:/Doc2kwkHH1tH1k
TLSH
T1E062CBA5988746059B753F1C9E33FB84E276C85B09034D6BF25E94746F6FE2B9233802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Sage.yara

SHA256 02c12c3656671ee29a5d1a87214d9df0562cb369754632177d43c4df764a981c
MD5 a264fb09bc5b5ae4d85d43dd26c989be
SHA1 f8c5fc60be51eafcc0e35e0d526c6da4672cd918
SHA512 48c6e38c55ccee556e208409b8b6e589718cc09f16d125442d94b9de5a7515a1f1ea0c61d12036949d2bdcbb6333dadd0ef3898c08c24db0f9a9c68bca9f11bf
SSDEEP 24:f4eqAggiaomYFAliFALWJAAC+2DJHCYtuVqs8KZ8+db+JlP2+t/b/JFmplTUAhA+:A4QMbSOLiYsbidt1aZ5V21dyxjX94xk
TLSH
T1D99174E098838619CA3A3F4CAE73B794E276C49706025E5BF64FD0752F3E9229973815
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Sanwai.yara

SHA256 98dfe144afaa457de526761b38a5ef4ce33fb783cd3fdd14241af27dde27db83
MD5 d3d3409e80758e1810a9a32641b96c75
SHA1 507a61765ebd94054d74ef7cbdf1330bea8e0f5d
SHA512 c82ed658919948f842048710b44388ac21b2de3cb5ee03d0ec3d8434e67797b8e799a5621a5f99d5332071b5114a20d1b242e887cf602dd81884b8dee6cfd8f3
TLSH
T13571F395D883965987393F2CAF739AE03533845B0A020D4BF64FA8782F5FE2B5573816
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Sarbloh.yara

SHA256 8ce0fb29a149aaf5abd5447277d5b2a354e3bd9224b914a3f34c213ca3151312
MD5 f638ae9c42d06a1df6c59c5cea0da8d8
SHA1 96e8805e5184daa4ba1ca09a52dba0e2eee5fdf3
SHA512 e52248b156ad37265414b8cf4807f7ef558868f572b52eca3fd35271a7632e1b87f6380cc73cf979ac70990854deb59f34893f7fc644de3d4c0f53d17a76a718
SSDEEP 48:ASkVxi4cGg6VDfsrgg1s4pKHK46u57UvkFwfya3fPWwg1Z0rK:ASk7iLGgCDsrgg1hpkrv57UvciD4yO
TLSH
T1C4B117E5D4C35A098B297F28DE73E9807577C99B19020D5BB60ED4782F4FE2B9673802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Satan.yara

SHA256 b48d9af33898399366e562cde9d43143adc590be81da1d9789bb0eb9b707eb16
MD5 bf06126eeb36825be010c29b28ce3d5a
SHA1 418469180cb82475716ffe807d36743a766dac2a
SHA512 592d6ceff5c9b92f0d6b118901614a56df7262d1b5f16a98dceacbb475c6f113f77abbe2b456821eb5b1799e027c0fb58afd3707e0402e1da8f380ba0d4f47e3
SSDEEP 96:TYtCHZYzlzdsFrWdyAKHWFvjbeTLX/ebD/R8TvjbeT/HZB1UhSLo+QVef4q9tArh:TYtzd5PRXVgsFiN
TLSH
T15432EB91D88395498AB53F4C9F73BAC4A176C89F19174D6FB21ED0382FABE278573402
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Satana.yara

SHA256 2e69fb1ba04cb4f4e4ae6ee014c171ecdf05c6d621d28637bc48415693d1c91d
MD5 74606b7d0b108b1cbbb4960f9a541ebd
SHA1 fb7d5ae3fa6c8ae9ed1197255fb9db1841ccb761
SHA512 7a7a227d1e5e0c0751381c19f67e9c0cea41f3b732a9dab20ff91cba6a02ffabd0635be44a7851ddc9055dcefee216f81d4a22a94835c408a0394bff0f6d34f3
SSDEEP 96:qqUZ8oj1tobJDCTym3p/xhg1IkPijQsZVMFQBVt0l0ccVHFfHM:qqE89mrHFfHM
TLSH
T1B4023DA0D84386598B763F0C9F73A6D4A272C86B09064D5FF65E90742F7FE278273806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Saturn.yara

SHA256 211e8100fcbe7d669133b94c159da665f96b52de4dc5dd3a7d23a46592f42e1c
MD5 f67eb991724ae419e195ae7a3c0eed2e
SHA1 b6d051f6965310aa6884f7a58e3c3614e9d3ea26
SHA512 13d0d9ad323a9308998f6c1d9f0f5ee264a68d2706a13c5edb2cae1315704865fd2615a537a289ef822bfad6dae43d193b015302cf60c8dd2981536d2a809fce
SSDEEP 96:ej3fofWp3V/tVbQJkZqMIK+4/q46gfQRaQO:e75r7qRaQO
TLSH
T17CE1F7A6988345588AB93E0CDF33EAC46576C86F0D064C5FF22E90782F9BF264573913
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Sepsis.yara

SHA256 4b56e29217da810d91c966fdd35280650f1925673c00e5276e669e9b2103f682
MD5 f9004949ddc5558170d552deae65d00d
SHA1 1072f4944ba0de149bd56d06b63efc0fb751090f
SHA512 8a5001f478a584b41c9111efdaf70857dae286e6f1ab4c2b301221aed229cea1f11c7cba030e081a987cbee90878ea861c5f2c1b1e8c2aad14b153cb294f3379
SSDEEP 96:7ZmYjHjY3X3YjHjY3X0bEey5YjHjY3X3YjHjY3X3YQ07SiBB+gUnZX1+cvQd2/9b:741Zbiq
TLSH
T160F142A1D8839959CA753F08AF73A1E4B236C86B18534D2FB64DD0392FAFD139537802
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Serpent.yara

SHA256 bf41c1f0c71344018e7550d21fa23989b864cddd208a05022c6b103a9b64f84c
MD5 a2825bae327c759956f1fb0c45ee03fc
SHA1 63b994279146befcadc5a9ceb1db52ed0ba7d3bc
SHA512 aeb3482ccc1c126b23c3c5b8e55cb6b114e34a1930a75b9b60cfc6ded325c1db284c324bbe6596247979566499dfb601b0e69b8c98aab8c89404652889dd49e7
SSDEEP 96:/jHSm1VsRjq5roPKFo+WsdE8DkDgRKfdkVNyXzLB41zdrzWiyvP7ij0reMNy:/8wrqSWSzYIKOdpOeMNy
TLSH
T154122D699C4747049B703F1C8F33988892B6D96B08134D9FF66E94746FBAE2BA133406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.SevenSevenSeven.yara

SHA256 a3bb87b6f594a5ae2f80e9f755c1b98059862a253f719724fc15d6640efdb72e
MD5 b18c9b015e928709c4af31e05e8695e3
SHA1 5ba9e66023319a88be56f197f1f5cbe77a8300fb
SHA512 e51efd4f4307f6b2716890170a8575a0ebd53b0e4d44538583695ee01f745e55fc3a75aea401c0356c2b426acd3dcf5680fb4fec18b4a6569a33fd864bd2bb22
SSDEEP 96:POCSD9ClZU6j0Nfo1BSEz1kOrGuDl8CljlQr10SFVGjRx1+Y8snRQEBq:PMbkQEBq
TLSH
T1D9125DA098878559CA353F0C9F33A7A4E276C85B09465E2FB21ED0752F7FE239673406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.ShadowCryptor.yara

SHA256 721496e363ae017f2f07e132191d148e390742600965dda915476b6dd419551a
MD5 c60ec4f59a812d10aa4a78680111a96c
SHA1 98456d424af161c841b4241a1b02b9127a178470
SHA512 bafdfa16c6a5399102dfbb13325066b28e9c98a877cf2ca839ec4406cb4597a0f6e37fcc9fa52668857fe8c31564302193800e19f9ab740984b7c0e9895e2b71
SSDEEP 48:+nz1nD7neaMe2tRa7WeHKYai0u9gOisX1asxAiEjMWPd0Fis0JxIVHE5+Y:+EaMe2psKYflisXq0Wl0h07IV++Y
TLSH
T16FB1E491E8839254C7393F0C9E73A2D426B6C85B0A020E5BF65ED0782F9FF2759B3412
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Sherminator.yara

SHA256 61c57677e7b698c34985ff5cff9db4500ee9e9695611c077c66dd24e15325c43
MD5 26b0e83355380ac538ce91d230755412
SHA1 74efe48f15096ef934e8915c6c6380a0c3e640d5
SHA512 fb065e291ee5bf1b5f5e611d673434a4f066f799dc679637519ca879c67dfb9b024722afb53ca09931c64cf42f79175ef483037ff2890754d23dbbddc6734bc4
SSDEEP 192:WQWN5ytGgVxhbXzLZtygjMyODPYZPMBH1nH1vH2:MN5ytJPhbXfZtyiMyODPOPMBH1nH1vH2
TLSH
T15E32C58468036205E7357E0D5FB355BAA2378A2755430E9BF78E90760FBEEAF0633409
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Sifrelendi.yara

SHA256 60b09180835b9e8a14de9bf2a7a8d1eb4743e6e195fb008c08a3c2aba3da6e00
MD5 60bb42b01ba0c48fab402558b46a4f22
SHA1 86f69a04868bb069ba79d0568ac229b766e532e6
SHA512 e1bfa1509e9db1436fa362cc7887c3fdb89bd799411e53e786e4fd31abf30636dd242d8a0d496bd7d01e51ef930cef3e7ed5b1326f3e2bbb0ab9df49cf8e99c4
TLSH
T105814349AC07575563313E1C4F735448D2BBD86B0A130E9FF06DA438AFB6A3B2673816
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Sifreli.yara

SHA256 f29cf0004c3ed1a5173f26b3846fa6f0a3a12355af9710e667760806c5b0eece
MD5 1cdd7a9be12e16095f87cd18aeceab25
SHA1 d0749c103665cbfc8c1e51198eb20f051c34dbbf
SHA512 7578ce11c429c5e46f68a629b1d094b78ebd7e80e6b0ff1e9f41e738302b1a276188edfde3b556067bba688469abbab50ab86243d928a44a05e70099f9c7cfb5
SSDEEP 96:vcb56YkTQ07Iapl3+4PUg7PEvmd0jkbAXOOKNzPcR00Am:vgkkkWosmXNzPGAm
TLSH
T156E1D3A0E88392498B763F4CAFB3EAD42176C49709024D5BF65ED0356F8BF279973406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Sigrun.yara

SHA256 002cda55a63f578eb7b8f31944b76f096c3982430eb9a8a2485e5f29fb39b161
MD5 8b9da9e1fe55d3c09560599d9a3c7750
SHA1 7d2d719e95932451d38ce71a79f5ed4b4130036b
SHA512 e9f54b493fd3fb5057d39562cacdf37793782d60a3c6edd0cde51c649eaa3b1ec81f2f6de1078278a9da182eb44a28a9c25306dddab6d0d6ee22a8328ade6f5c
SSDEEP 96:GBw0vREuLiYPTT8ltgMeg0NwSGe9k33Hp8:GZEp8
TLSH
T166E15AE198834259CA393F0CDF73A6A4E276C85B16424E5FB60E90352F7FE2795B3801
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Skystars.yara

SHA256 c5eb5a4beee43b4c430d6155d0efb3fe52686f0d18394687a4d935bf86274882
MD5 b650dfa4e63186060871327ae916cafc
SHA1 ebce959af521e4493622115ca935c561bce9a079
SHA512 0b30f9039d23bfe39740e4fe4d375815160c25773b2fee382a5a41b50b10a7ab4b1c62e9a4d5be369b073f4806171ea2f6739720275cd469827aeb70cb7c5275
SSDEEP 96:jtDZ/AFojFVZ86zdUFOg9rOWZ8ZaRqZKynW:jtDZ4FojF786zdUFOg9rOg6yMKynW
TLSH
T10FC1C4E99C8396188A373E1CEF72E64834B7C46B060A0D5FF65E84345F8AF279173852
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Spora.yara

SHA256 4ce457290ffbb46b40cc405f0a65d59e31d099bd8ca3feb7be66628a74486a1d
MD5 5e6aeb68c969ebd2646a673862664dfe
SHA1 df2dd027aa8f04b0bae64ec168458cbda924c189
SHA512 d7a77b7c99b06fc5ddbcb7eb780241081efeff0093a900d013d4d4fbcf3be5a93c7054110a00a3ac2f464bfb75139637a0d9d07f858d21705f94e465fe1d766a
SSDEEP 96:ZmJDS33ul630pj9Jbx3LegtxSO9IdYhzw4wgXgUoyazBm8dE9KnbbHT6EQ:ZmJOnELeygHmEQ
TLSH
T1EB12B2D2D483921E867D7F489E72B684A275C89F19934C2BB14DD0383F6FE2B4A73416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.TBLocker.yara

SHA256 cabb212fadb74c60acde34aa475f8085b90731160772177ff2d6e302aa707692
MD5 100738ec4291f9e29900a0c0558dfaba
SHA1 42e115ae5cdf409fd1a084b9e0cddfda9a040558
SHA512 3c45fde71f720bfc121c544b8f0a80de374594d9a3288067423736b811648a503d01bdcee7c00c98c82be92f6281a45bd9d167ca10ce2bba086409db1e482763
SSDEEP 48:a48zMoLV64YBQ1hjFjEITSIYXydTe3kF/z:aXMoLV64YBQ1hjFjEITSIYCZtF/z
TLSH
T126C1C5949CB71650C831BFC8FFB6928E9375C1A325150F9F724D51788F3E60AA393858
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.TargetCompany.yara

SHA256 bfe8f7349dde83ef7285309a618405d57c61883525e03764c8aae9eafd233a01
MD5 c1d8ee6cbb030b17fc6e59d501049ae9
SHA1 1176ed3348a5f2d29358c8eab2f39d7dce3b592c
SHA512 95f8260b2f2847f43734ad26c211bf0e71e5e2e8d0dd8b53d1efa732ac64568bfaece838bca7e0472a847128f070bef4eeb3ac7fb544bf7d75c78ea5aa4d2762
SSDEEP 96:fCPJIYBa+8zO8/AsMDVHinIJdmGy1B9nrrd2wI:fCWF0DDy3F92wI
TLSH
T1A21234DAD883854D96793F68DF73A68465B7CC6F09414C1BF22ED5382F9BE264A73002
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.TechandStrat.yara

SHA256 20cc72be751bfdbf3c6508bce0f46887b8a92db1ee85399457c3183be9209840
MD5 79ae64f93c43b6dfcba9eb96cdccfc27
SHA1 013fc5dff2baef56eb19dd4c59a5c94f47e592f0
SHA512 3738a292e619f08fe6c84ac0b6995bcf3a4ba39ba645865e0c53f3cc161fec49c958f2f0f8dd29fa367a234b7e21e81089c0c53e8b06ae91c88108f19f9ac63b
SSDEEP 96:94jFM4s4xQIq8mD8X3oSrnWHCX1LQEPxSHMLLvQHVSWHNaa+O:9CSlYmS7WHU1kE5SHoEHVSWHNr+O
TLSH
T187C179D598839999C6293F28DF73E2A42573CCAB19414E1BF20ED4792F5FD274A73801
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.TeleCrypt.yara

SHA256 284a3a1e35590e04b09639516b931851774f39ab9234f082e0c7f0cab330f08e
MD5 d5ec787d062c5c86e06a336d75dff941
SHA1 5a601212327e9a053e9b6836cc3c59e0e3e1def7
SHA512 e2038c08a1c98b805d7d511ef6fe2a534edc6493b7f344901d123af1ca51a3a6eebb1282e2d4aa7821f805c724d2f0b48e4bfa9c7a0d7b2771b884f060572a12
SSDEEP 96:245rd7UsfFYBPRluxa/Khar4kRVILzaJ/XdwGK1EwBgfcm8vfC3n0Xb5:2Qyeq4iix9
TLSH
T16DF151999C8747549B713E1C9F32918892B7D4AB09030DAFF15EA4746FBAD3B5073806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Termite.yara

SHA256 54ae05c9a891066dbf1648ee65c7281039665d596e3c250de329d41dfe91e30b
MD5 4285f92939da76fa426c5691ec282e01
SHA1 83177ed519e136c181b42f041ce8961c2982406d
SHA512 19afc3ec295c0407cf16ae216ac38f50b071cfed6c4a2d019f926897c2be4e02f7954a8fbd109a9d826761defcdc438fed000856886a49b1426f44108e845bd0
SSDEEP 192:pYetFVFl/dBSM0FwHG7JjE+FoKzwj5FWaFdxFhajri9s:eajPEbGVRls
TLSH
T14B2282A99C8396088A373F1CEF72EA4874B7C46B06564D5FF61E84345F8AF279173842
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Teslacrypt.yara

SHA256 fdc368cbec950e734d72533e200665cde4df408bcff876c9efc2f1133f75615f
MD5 963373e4616df3e5b82b1cdfec4d72e0
SHA1 502a54f3ca89a882ac81b404ba81d1b98aa84d5e
SHA512 89792afed1249401945741fae688b1e2c54c9e1cedf60d3db3cbfddc89a693c5d6aa4b7f3e5eb60bcad6a118b863eafd863deaa47f5bf1bea9ad85943dd69746
SSDEEP 384:dEauFGSyw9FHQukuDlqnOIJIGmd5pxC2ZDyiNw:duFPFH8OIJYtxC2ZDu
TLSH
T1694372905D838559CA763F4C9F73B3E8A176C85B49821E2FF25EE0352F6ED228573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Teslarvng.yara

SHA256 99d4c64e0b3dd906dd026e0b82ae67b01bdec321261892a90289dcba4f4207d9
MD5 3d42e1e2d0dcd8e0df52be611c9a516d
SHA1 abf64f72f9d9ed80d6db91d65de5e5fb0e29d0e5
SHA512 451780c24f5049dc66864a19416467ed9f7eac6861f55ca9e610135787d3883545a281d9c8f61c4d6e0119c53308ead4452e960b4ad045252268d9e01c734706
SSDEEP 96:TEbiEDbeiVmuV2ZjqtWY8yqK7gRebSeGu6Xj9TuYvxf+pd4dBi2/Hjl6cLwcIr+O:TEmEXR+wfSb3kLqsr+O
TLSH
T14B12EBA5988342498BA53F0C9F73EAC426B6C96B1D430C4BF25F90782F4BF2B9573506
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Thanatos.yara

SHA256 640ae2ee013243e1571739b7e945b0094fde1d8f273a991208367290e5d1bd70
MD5 7395bb8c33895f8737f179160bda04b7
SHA1 ccd2b0afe6b2d1a3c202926604968e44f5b3618d
SHA512 397cb5ed71a24335605eca092898164be9360f587238b826b266465f3fb6a9b20d4e555fe1f5aeabc3f9da95dbe3787b12fe8bddc8a806126cf02f6b659106fd
SSDEEP 48:hx6h0O25mK13oQPvlz1jRPYKpjzbn2SIrK:hAh0OSmrQPvlz1jRgUWSIO
TLSH
T1A3B16891D8839619876A3E1C9E73ABC465B2C86F0D024D6BB21ED0382F4BF379973412
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.TorrentLocker.yara

SHA256 48fe93b70c5328195c806eb94aaa44f7ad20ddc88259db2c987421afd08dcd45
MD5 7e8ea436879086f2f2284ef9834735e2
SHA1 7c0a8881514476b525d1752736360f78282b9f08
SHA512 2e9fdeab4ba240a4275abbacef42b6efb82178c2a1ede5573acdf50bd09a7670d94bcda355cdbb17d88e1a5ffd1a3bc2bcb8f04f247c0a32b4550cf978bb7457
SSDEEP 96:BWTp2Cnwlc6sJnsNaFvX2iZJ+5ah03lT/9pv8otRO0tn:BWTp2wwexRw51T7vxD
TLSH
T1B0F1E080A44741599B753F0CAEB3BAC09275CC9B19434D5BF64DE0387F6FD2A5633806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.VHDLocker.yara

SHA256 2c4abc9ed9244eba33cc8f8188f5a1e8cee6cedcfb836768db602d9c9eb46ff3
MD5 1339d07098a689aa78a3f9d1d7a146c5
SHA1 e40cc8a47d8817f98291ae6465053855c941fb24
SHA512 50bfd178f4f04bd5b4c4f14ae3bd87b96cde49077bade79dde14b43822b485f2f9feed3ff75e7842e8bd645e279fdbb83c375f402bb28bd5063bc2427aa1ad55
SSDEEP 96:QLBvVbdHa8HF25ZDWtc1EpTMfp5asAb/xLFN7L11H1vH2:QL5aNZiOEdYpyRL11H1vH2
TLSH
T164221FA59847821946763E0C9F73A6D4E1B5C96F0E020D6FF61E91382FBBE364573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.VanHelsing.yara

SHA256 0b7f1475cf9a45e6ec8395d762084ba611015fafa01baa97e116d3bb7481526b
MD5 10c5aaa2e6bf34601540beec299d880b
SHA1 5c03ddbe10a111eecf091edd8b34cbf571b071e3
SHA512 dc98647584bfca26bbaa8655ada27a41c47f87a01176d93b9291900aa5cd5e689419bc1d73d675c80b3ec7573de2395ddff595b4216a9d8755e5f122ef5c6eee
SSDEEP 192:gY3JwAwO64W5Xo/AYYSh6RZVzMpC6hqfjdBxV7HT/9V+:r5wAwD4W5Xo/RHAR8pCRLTxV7HT/9V+
TLSH
T19AF2C9A698834648DB653E2CEF73E6D425B7C8AF09064D5BF22E94382F4FD279533406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.VegaLocker.yara

SHA256 718d011eb47471e355d3576494b1f3e88b3ed70f3a62ee2dfc317c4a3b02900d
MD5 89c088c612355858bd4efe2dd623cfdb
SHA1 984fcc713737fd45b7c991226400947fb774fa15
SHA512 108c9f49e37e9c05fff52ecff2dafc6749eca121447ef2261a99962d31a3902ed2f0321a996bf1a9ecacefdc1dec3b2792b5611b1c5e3c318faf2a5a1f6c6d39
SSDEEP 96:vQDtWdqYqIEubR980J+/wviBYW+HvrfffmvH2:vQAR96MivH2
TLSH
T1C2E1185A9C434244A7757E0C4F339598E2B7D86B09034D9FF12DA0386FBAE3B1273806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Velso.yara

SHA256 91a4c5367b4239ce081fe9a270e742e16da8a630c3de5b52dce0e0d83139d88b
MD5 b1038106f7c6c26a05e6458878c549e5
SHA1 f8d48ed17c56e0aa525355b7a63a3731bb6a44d0
SHA512 4c68e8ea09686398e0cff60ff87f2205f0a0ccd3ce1236befe4ff3d9863a47c8fe3b3316773e9c28c1ee9cf89d3268cea7ca7e4a5366cf12b518361623627ec2
SSDEEP 96:lORVPiQl/5em16Y/URiucWLiQoLo+nWhtBl9qKaPf1oQTm1o4xNNogDqKvG/dHzb:lOF50RsdaH11H1tH1tH2
TLSH
T1F672995298076200D3B17E1C4F7359E9A237DA2F19130E9BF69E90346BBFE6B5633406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.WannaCry.yara

SHA256 620a3a157121c9db704dd9716cbfd98d7a7a2e9a7fdaa90433e7507976765ec0
MD5 826704de96202ce8d62f6a0722c75a10
SHA1 3ec0f92b4e0002ec77eafc9c5e018db0150de308
SHA512 e11bed3c84bc2340c1c2888d78cad591e8ce00aad6153a6862adf8ab7e8d61f9532d2a62f7095602bbab5b81f6be59c09993d68f251918afc1ecb3a8351a4164
SSDEEP 96:jPMpEDS3wqsy2VnPEYTTt4W0MsfsyKNWOl90CmY:jMCHZ/v
TLSH
T146024BA19883850989753F1CAF73A6D4E576C86B09424E2FB25ED0342FBED238933806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.WaspLocker.yara

SHA256 76247dc093ac8fe644f2899ab4931e6691b0d005d7c14ea57f21d595c54a7ec4
MD5 203c3bc73bc59b305c32b4455217d90c
SHA1 2199910bbad0cf1c2a322aea43640d2dbf1c5ae6
SHA512 23bfc18a869ec82e3ca4ae01ef3619feaaa8a5eaf2fa20b448f375d8548152d9daf53f85d07dfa34904f95564ee847950928877d8e76a6a6f3760f47976f9993
SSDEEP 48:WFDP8Azdc5zzVdw7MZXSouSKSo+YgSo4f1:WioS3dw7GzEpy4f1
TLSH
T1A681B0A6EC8345594A593F2CEF7396C82473C86F09050D0FF25E94792F5BE368673402
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Wastedlocker.yara

SHA256 7faacf86c6813788f5954bef4b9ceb90e338d20bceae309569e7b3c19678b82f
MD5 6d8f50d35b7925033480592db830e567
SHA1 20cc354c02ef82629ed9a2a2c8bbaf156cd87c69
SHA512 92bed7dafb64514d0bf94d81e322527fcf5a6c13802af4e8b0eb6fc7ceaf6d6cc9e5f3ad7229d21c8ebd577f73eb98b90f1cfabec727d1e27d1b628d65927896
SSDEEP 48:jJuHHACSdGC/QcQzx1ysjbtW77khaR7d5VKO7ciGlFz2L1h0HZl4ib/e00rK:jegC+V/QcQd1fftKkhMbK9+1h0HnTGO
TLSH
T15DB110E6D8834219C7397F0CAEB299843636C95B09530D8BF60E94782F4FF2B9673502
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.WinWord64.yara

SHA256 e4c61195eee7fb703fa0dd2f9e1d80c9daa59b7e700f0ad36d52599f7f79607a
MD5 cd591bba28932a6eff53dacbabbe3644
SHA1 182a7a400e29c133a0440336e3063dda871cdb45
SHA512 2f64fd3e966fe73aa709bca50ed27a963d41e6ddff5c2c02806814f9436beaa8fee77e887cec7df81f8562717bb9341e7ec3713634342c15967e039071fbd957
SSDEEP 96:f/0TGpke+m6xXG/wuL/yu1/LhGNnHDku8as8lB0VZV3ydUu/IxAILV8I:fcCpkbwjrLamVG28I
TLSH
T10D722695988786089B753F0CAF73AAD435B6C86B0D020C5BF22FA0746F8BF2B5573502
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.WsIR.yara

SHA256 519b2a786610b9e7be29466a01c0e7ec9842a58c6d1cd0d0fc503bcfa39be172
MD5 6cca6817aa59849162b139344e1ba0e4
SHA1 29036a4deaeebd836555b39b4f58d6279958f5ea
SHA512 539c6d7c8de7f3b5dfa60a9e858910c8b9c0f71a12db062f8f30db5b5e28fb4f5c209516af407b9f3b60f66e03a1f22d6edcd5c25af84c02298e135caa37017d
TLSH
T14281AA989C835168CA663E3C9F73A6E86577C82B19015F5FF90EE4346F4EE238573402
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Xorist.yara

SHA256 019461964c2b3842ac8d20e5c368f643f3e351be2c311cf4bd112fe817b89b00
MD5 094f9eb2cf5243dfdf48f7bd7d139049
SHA1 8d665ffd6d628e5bb602b50c03ae5ed6ee73db70
SHA512 628ed699bb264e194dee60c595b1f7f53a6f50eedbf738aa4c95cfccb4a36469527739966bdf5721d7b5d626a14e25650821d1d7a60732a1d2a44b540bac01f3
SSDEEP 48:R4wzqoIergv+mUthD/pbUbbJKJbYbbjPxCvZHAVIerE0+32H4fDX8W1b+ZK9I5bX:RwMg0hN2uHAzPRqL9VIUzY+prM
TLSH
T16022A6A59C835A498D353F48DF73E688E677C85B155A0C1FF75E80383BAAE369433809
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Zeoticus.yara

SHA256 9eec2b7ac462907feccbc23b3b1a7fae9f68533dfef5ed8f3d1ffcae5698d4e9
MD5 0a9ded300e43815fa9b68db83e8009cc
SHA1 a51db23e033f8d6d09244aed3d3d4c2bbd68d684
SHA512 9d49e956823899a7dc8a7168cd58e39e7a9ada7b07f2971d656528e3ada556166efacc1e599300933e0b401ba4cef48f1c870bfe946db48d4872d65057b18196
SSDEEP 48:6og+/6fYk7XQIwj5kvPSUUOl8oG7NZGRX5j2+vQFn/WrcP0:/g+8PXQInvPSUdG7NZGRX5j2fFn/WP
TLSH
T1B7B19CA498435628CA753F08EFB3A5E02577C86F09451E0FB64EA0786F9FF239573502
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Zeppelin.yara

SHA256 c6d31075ab498df3c806350c0d628abbeef5f7401e307727500a10c3ea399e53
MD5 a9c3451ebec2985879ef5c5ccee6b2d1
SHA1 a698ad05c8240a60c80152bb8dcf8cdc6cc49d97
SHA512 00191c5b08fb6ff34f583bd828b863a852f2735f8bfed9f11907709ee60bdf8a94d9091481aa9733db8d3dc15de72844503e0d977735eeb77484ebedb4e5b631
SSDEEP 96:dhLRq/RV0ZYvJBnMpyjaxHAwfiDGaz28fRQy1AYUkMH1A:dht42ZkTvwIJWkMH1A
TLSH
T1C0D12359AC4B4344A7717E5C8F335088D6BAD86B0A530E9FF09DA4346BBAD3B2573806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.ZeroCrypt.yara

SHA256 24f734b8bca149c4fe340a07a642ef1cad99f68fb2a5a499e0fefe2b85b79002
MD5 c397f769393fd267ff772e77b20acf35
SHA1 99de6f153abb1e58f305c58ca937292311362574
SHA512 72fd6ca90e6a33bab521585c37f6b54e4866b430d0cb23bb10af0cb6f32a01e1f85ab128431c61600d22852f58abcfd033e6022e288f6fd67fe252617cbdaa93
SSDEEP 48:6X4AmbtacDzYHG7Y+qSjMkHbVFNmZITYITElHZGSQBdyMIJ:86bYA7uSjMcxmZIUIAlHZJCs
TLSH
T17AE168906C43A1D8C6762E0C5E7361F8B2B6D89716821F6BF12F90782FBE5275C77405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Zhen.yara

SHA256 3c059d23bee490fdec3403a16e2596ada86f46fd9efaa07083fab47fcd5a0ded
MD5 af019c548f977b2357487461f1f368d3
SHA1 ea96ab09ff752bf045f9faf44a2a2e6d67ca17ae
SHA512 db016f8b146bbdc148fee988f83dbc27b6d9626c8adbd9b96907294d1c71214d883b21a13b819eb67433200645f7607d8f6267e041cdb8f9732b0fbe96f1f946
SSDEEP 192:g9WllMD1NK7V5sq2deiF2F5CT5fOA5uxPYO:wWllMD1NK7V5EdeiUF5CT5D5uZYO
TLSH
T12B42A1959487460AD7A93E2C8E33BAC156B6CC6F0D434D9BF14EE5306B4BE2B5233407
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin32.Ransomware.Zoldon.yara

SHA256 bf8c7ef47660644c544b12b3942178ffe6a4262b6f6ae27df70a40fb560fd2c7
MD5 3f501eea2b7757a9b8c5f2931c657451
SHA1 dd7747067a7e8c954bca24643998f36b16a4a569
SHA512 940a67bbdddd94a6aa19aa97f201759d0a8167e4e698a5b1df0289cc8d282ad1f21f81e766aa7bd8230b0ad68c742af67cb40c5917570e9c89b95be1c7d72336
SSDEEP 96:yQfHVACAYALwf7IRpCfOdze4s0CQ0pu0pkGnH1or2:yW/bEKC8hrnH1I2
TLSH
T179E12799AC47474467713E1C8F339888D6B7D86B0A130D9FF15DA4386FAAE3B1173806
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Ako.yara

SHA256 5346f251d3e7b05fbcea4a3b347b0916bc899b44c0974bc2a266ddae4b343346
MD5 542a98e35c22606ffc1042302368b7cb
SHA1 61eb9b25345a92310f2cca19d4b3660bd9fafa05
SHA512 a7b637ed87c95d1b94b9bd14b174de63888904c82e24de7973de97bcf16df5999eec5f616d8282e5fc499d465c673f3bdad57d9ba86808d31fb77d0c43703af8
SSDEEP 96:WHXhSRXk7zJ9BNxwMSzdGSMsjqelcFNSX4s1W2:WxSRXk7mxzUsJci4s1W2
TLSH
T12742AEC65C8759DCC3312E081F3284FD92AAEC1799826F1BF86D50732FBEA266573416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Albabat.yara

SHA256 1364e8ac86a2562d57616fd8ac294454485ae3b05550af01e6e89f56d98fe36c
MD5 da7cbecd3cede72afdbb8fbc12ab163f
SHA1 a1eb12e236db66542d11db8d218324bd27da6a43
SHA512 8ee9b7347287f6a21f6cb0fb1147d4dccfc93d825d6d4ad425fb9c521f19f678d04d67ced152221cf1ce305ec251b681805e8a407fc345a45f4bcd431edc9fd7
SSDEEP 96:ROvaCAYQOOMjjWUUbfKIeQDHC0F0MVaW0L9wc9D:ROvamQGjLUpJF0oan9wED
TLSH
T17B128C89984312DDC232BF385F7244AC56769C6B18501E0BF96E64B42FAFE2A3733416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.AntiWar.yara

SHA256 38f7a409702e95b9247f188a1f8404d1e48a65ef505ec9a56ca652d778afc03a
MD5 77e79e3b7f73a018c682f8c67a23cd27
SHA1 7946209db5fd0a169668f54661e6165552e2650f
SHA512 1b9f2777db2fe94f561a19ff01a47cac680f263bf78e39ef64dbf86a570e9c32dd69d2b44c2700a15f85f419bdbe608f115dbbe968272f0e174fdbd440a3a12f
SSDEEP 96:Apt0LyXq8k7HmNrL1sLRyMGY4hKbdpXFUmqVjcfwO:Av/68NVL2L1G6RlF/YSwO
TLSH
T1E8124499884311DDC3217F39AF7288E82A77C85B1D504D0BF96E54B82F6EE2A7173417
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.AwesomeScott.yara

SHA256 7887d208891b088ba2a7c050d985e038a48994df88b53541782478af53d4493a
MD5 b50f95fed4a1160303d06d4fef0bd177
SHA1 480a564bef8e386e621063a0d655f38757864929
SHA512 7f6abfacdf8a06bfe9a84ed66db0f275ff1fa4ea7f9b47bfbafdc3a14b02e4d892a5b20c969903b9b706998ec100b8db9586454d345dad0ddeca5812a0566c40
SSDEEP 96:ka3yypLIj9CcZEGIA2nXnXHXtNv9111ZfrTrGAc:kEyyRItZEAITlc
TLSH
T189E1A1C5D80311DEC72A7F08AFB244EC2676885B6D815E0BB91DA0B42B9FF277273416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.BlackBasta.yara

SHA256 da39458b480e93b600442f602b851fbde54c5e415ac92012db96126d38c10f82
MD5 91881447fa8d59af1927f0386cd12a91
SHA1 8faef4531501e621bac3d9a08906ec9abab321fb
SHA512 e616b119a09c00423ce50faa74b4a5b785c8f6f08057c37c36a4e2d034f63ccd6c5ca0fda060af4d7b391774f063f42958024030db37907bf5bee37c4f7845d5
SSDEEP 192:69qeyy8wgmrfwzL/z6p96ljM1kjk9oPmqymRER:Ivyy8SIzv6p96ljnk9oPmqymRER
TLSH
T162927989984B41ECC3327F385F7288F86977881719115E0BF95E24B16F5EE2BB273416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Cactus.yara

SHA256 a454ddcfe5b6ffe22fd09957bb071f4064994d2b9ae324376c25880bb001c7d5
MD5 00b0f31d23f81abfcead17e624bc9a5c
SHA1 036d23376da877ffc04b96559900763b6ae2a1e4
SHA512 a2fd6aba551024ddbd01a35c2b9210d169dcde453d44f8b7aa4210e19a7015c81c0e607f103bf4b6a5d8db243380e17d9530ede35d571f87bcd8dca0bba7ea5e
SSDEEP 96:R0bzs9bMR5S81X5oox2+ueSIgMB1FiYW61AzgveYmd6L46B/Swbe:Rd8jueSIgWHiYW61AzgveYmdWIwbe
TLSH
T1D752B08AE84742DC93227E38AF7744DC957BC82B4E41490BF56DA5312B5EE2B3773406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Curator.yara

SHA256 c624e31d54474d4d184887f27efa8216eb364266ea6c5b48277f71709b086b5c
MD5 938c353d1b9f53e9969378c11bde26a3
SHA1 87daa5b0c00cab212b51c727d5cd00e873ffad7e
SHA512 4531ff49eed85399b43488aa4fc1b5417ee6819973b457421b9c883904bcdb0e885ebc508ed6d17435bcd1e384dae92487ec8e5cb632dc2b309fffeed0000e32
SSDEEP 48:cTYQs/QpIB25G5LX9b4Lh45y1K5//Sl5ZP7prEC:cKyG20Kh4kU5SllwC
TLSH
T1D2C18B88D81712DDC32A7F286F7248E859768C5B1A401E0BF85E64742F9FE277673416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.DST.yara

SHA256 6dbc46f4b00d7a5b1a2839987815b1a974baeee6a4abb1d6b81be01b585dda07
MD5 45f89b274cec375227f129f550e3b503
SHA1 18d445322e823c5db3a60a511a86c009c8e48d18
SHA512 0a0bfbca85c9b50da5fa25788998a2d9cc6a85051999ee51b1721bf95371dfe765a49bb1ebe210a7c465258b325137e4b759ccceac38c8e3271dae4d63676c76
SSDEEP 96:99UDIzvGMa7fmtY0Xud9boxVtQmsA/cSCbgtFyRYO:99eEcplfboxVXsA/cSCgtQRYO
TLSH
T1DA325985A80351DDD3273F326FB254B894279C270A812F0BF82E65766F9D92737B3016
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.HermeticRansom.yara

SHA256 ba197e289d155a3af00997e8fcafab4799445fd4a31a30dd8c7a48749e299777
MD5 6080ea93574794cf1aeefa4b27143bfa
SHA1 d739cf647ff81bde49498ad88d0c475fc06731fa
SHA512 366a849b6e07be021dc06a4c433d935131ad266486bcf1e785d8d3e567348a7de45bcf182015a6cba0aa1635a0f073ab30d2f071555e7cf7e7a3c1d74dd02449
SSDEEP 48:7r5Fj0KvLZlZgN9HNSVZogYMUKdl0DIHeFUCozslgDCSEllGgO3BI/rUi+Z2o1DT:7rLkVEZhf5wcH
TLSH
T117E1E084982761ECC3277E265FB384B8D52B982719402F0BF86E65765F5ED673BB3001
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.HotCoffee.yara

SHA256 48a5ce326e73beef055ac7c44542bf112956ba7f7bfe99990af3b202a7acceda
MD5 e9de540cfd5ef656af5c9ae9ad06da0a
SHA1 6bdcd0123a89d22fe18f8512357b165dee5ccca7
SHA512 5ff2e77141121939fa55aaa56b8dff3b951793136cdecd469cdd4fc959d9a9b66947a3aa1b75b5ba00bb16dac1fc30a204348368bbfd8bc6ff2431915f14af8b
SSDEEP 48:ljlzBSttuuIpjNHDttlOUJ7pOQ3SCKVUilnZLWCYttLuIFIFjkIBhUmiQS+rEcH:ljl1LpHlmYXcUiLiNIFjhhJS+wcH
TLSH
T1DFE1BC99D84741DDC6267F2C5FB384E825768C2B19010E0BF8AE24B52F5FE2B7673416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Nokoyawa.yara

SHA256 86c7103eec0d910bc3a3f4f1d53c3024bf7df2c767c7248db5077df5a6726bae
MD5 edad263772ba77d879cd084a9842ff22
SHA1 ec1aa67f405fdbf65050ed3b8dc5499866a91492
SHA512 840bed11b26002ebb2ce31f5fe577d1a47ea4bd2115a7bb579092dd9fffe6d7488f35e77ef918de8a932989d33a2375df1159d895371061b31d14e2664d54e87
SSDEEP 48:h06piheFccxWxzZ5Qih0PcFPPoW+YsV+sNkVtxPFFjseHDG0vY:hDccx2zJeW+YNvY
TLSH
T1D9D1DFC89C4312DDC3262E299F7344BC6937A8175A806F0BF91E54742F9EE6B36B3406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Pandora.yara

SHA256 f2696bb72a5d4b038dc979f317b9926de3b1b9a520e5648abd92a35551ad28bc
MD5 d5fb346275e90f9a5465174e1e813b7e
SHA1 57efd4bfe28b307803ec9f921e6be7f87a354b08
SHA512 b7bf1c924f75a833b61dcce0d9f4874672f5111c4d3b7f04ccbf230eef7fcd9543d15657c79eeec1128d3046be26316bb994ae57d487afa91e053f7c893340d5
SSDEEP 48:Fg6CZGq+Dur+W+rml+Y+jMpaKRWUsTUJjfD/V57Q06NQIpmyOn4T/N5MYCIO0Fn9:FgmMIKElT6S40nZ5Q62cH
TLSH
T17FC12F8C284703DDC3566E695FB584A009B78C7308501E03F9EE38766F6ED2B36B3109
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.RedRoman.yara

SHA256 7b00dba6a3d7c3251ae70483ee56bfe920497b0d79372d5d55e1aade366ba9dd
MD5 ab5ff7eba5e1a69c21bf32aae2c9e876
SHA1 1b6fa0e7c2416a5efb0e557e51f1c42806ee9057
SHA512 d25949b363eddd746f3d70032f07b724e71ae91677c365818def0b710fb1f3ae7b5ff691c0dc85b5a4743179d57790d88b43223773c8a7ee9d5360c376ff604d
SSDEEP 48:2dGI/n7UxIl8Ui0DTKyCd+ylyvy7yvQvyGgBe+yvQvyvQvyvQWqNDl1GLU0XEEj9:29vFCd+waYaMpce+aMaMaPPU0HwtO
TLSH
T1D7A16799980312DEC3263F388F7284A86977DC2B18400E0BF42E59746F9FE277673416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Rook.yara

SHA256 f76f796cb6c834fe9bafb9578c4d20038a232542ed3ad16f43daf12282f95b86
MD5 cf4132ac479e4f6e0525affa24706b2a
SHA1 ad87b942f7f1429957d12a3a6c5af5940bca7869
SHA512 a4ad0d87944ea8efc846ad67da7b55fab4c0f2a6244a6d56d92db7b8b68551fae27dcf586dad76b52d856da5e7e3f2fb5d59c4adaef78ad22fd430324b1cb702
SSDEEP 96:jNv6vE/cj6Z7nDLwRK3a8ytdu02wIJy+O:jc/m7DLwRkqtxIy+O
TLSH
T10CF19A85981341CDC3267F295FB384B826778C4B1A412E0BF89E64B52F6FE2B7673416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.SeedLocker.yara

SHA256 6bd9aa986d3aaff00371537e32e2b389b5a01b182cd8fd80686cc17af2a4d7b5
MD5 d0464ece96eae720f42e62b485c59eeb
SHA1 b39032498abbba6532febb38a7a4b2a7ccd2f2c8
SHA512 01e5a45217f517d1b495351fb8df14d9e685f666ae362eb9542dd8cfbfd435f672fe9fbb51f46cf8fbae35f999c7e19cd1c6986d8c178db403d0dbeb7e1d2352
SSDEEP 48:24mFraSH9E5EHs+Yo5yEupwK24Y5L5RERZyUBb5Rsi5J3NOnn:2iqEWYokEupwKRYtKPFgnn
TLSH
T1B1D11385881741DD82363F085F7288E8A2769C5B1A421E1BF86E20792F6FE377273817
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Seth.yara

SHA256 b4d618892ba1f5043c1124081138cc1acdbefd4c77416696200a918b0ddbfef7
MD5 109300b8691483d4281f9cd3c9681b68
SHA1 52e929c7ecb314dc695d43229f77354b1f260f5e
SHA512 76ddeda08fd3ee136c49ac9e4fd04d34e3cc28c507ec74fda687a383262d207440da8625d7e4828de0017da612fbb8d8b289ac0ee0e2993553aa7f3bcc12f774
SSDEEP 48:y5Q8W7tjdRogkyk3Ism6kidwVM/w+Yyf2fc78fcbdqFxAwhZlQHyo2XE6k9ay9rd:ya0yjPBqw2SDXn+W6w8BwI
TLSH
T163F1C08AE84741DCA3267E38AF7640DC95BBC82B5E40490BF56E64711F9EE2B3773406
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Solaso.yara

SHA256 c6f8be2b924a7a124f023bc20e6aa80c806ea57b8473a82f6322baad1c39bf30
MD5 e40ce0c9efbe0f4d6a33afbb6e609143
SHA1 98cb3ca9d65685496f0599b45544aaaf1646ce55
SHA512 a0c648eca62b9e84395bc7df3ffa7b61d0744a4d85c4b709b160eca30b78057204d44559e39f45d04fc0e450a7cc98a50403b68a0130648d03f91e4d8272a0fb
SSDEEP 96:dKGSGGRQQWCzU3cb38H9pJMhEpbxrr4PXWBLcu7QR8Cm7XUcI8O:dKGHGRLWCzUxH9D4PWB/FbtO
TLSH
T105426B94884741DCC332BF385F7288E86677C85B1A120E0BF66E64B56F5EE2B7273416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Vovalex.yara

SHA256 02b18f27fd3a2ecec8ff605a1813ca4b63f4342745a1eb838b96c5ca414b3866
MD5 b6d3f6589676afd5fb4d581a5078435f
SHA1 fb83502cf3f423515030b9fdbaec847540ee993b
SHA512 575f5848d193024348415ed3b4a48004fdaa3e08f08dc987ef6576b575aa2bc056c8a8298ef6f263cc7a7226f9f2820ba3a102c25d27ce8773b84545ef8a0e78
SSDEEP 48:Na6jSyXXsIDrMdy8nvdHNMcfqNWAJwa3Rwa3Pqa3Jwa3rL4a3noNfyNoUcwlcRsB:Na6euRuGNfTHrVM8LrFsqb7CY
TLSH
T1F5A1F686E80391DC42377E689F7288A89572C92B1E011E0BF9AE55786F5EF763373413
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Warlock.yara

SHA256 580112df7013902596c34cc001370270965325609952c8324cebe834316290ac
MD5 f8863617859b220018795f3381ae5cf0
SHA1 14266d869994388b80013e9450ec1c199cd6d01d
SHA512 5aa9e284aa2b263775c1f3fb0293c5ba4b5019691325f89bdd5b187c87e4f502a3da2631cec93b078ac0269105721bb72cdb69abb9a8723de3b6bbb2d70a3147
SSDEEP 48:z2SO5gS0/pjnFrmFBG2HN6CavNBuDgN9yfWsVEqvRBRxoPxUbCxQqWBU/p/XKQ+J:zQCRxeBcsgy9RWLE8v+Jzt0M
TLSH
T1D132F4C9984316DEC3262E299F7384B819779C5B19806F0BF81E04762F9FE277673405
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.WhiteBlackCrypt.yara

SHA256 c1cecd6df5a23e019c2b06b1f7373cec1f75b9fe3514447b15a8e9f4eb23fe5a
MD5 51d86defd197e413de45145cc6a47101
SHA1 9b0bc94d24f0b5d3eaf00241025c1a100d1c383e
SHA512 8abe72bcdc214fff1e2c43260bf194e376943f640cc5e24e4f3f3cae17b3322b63de8ab3960ee835daca6c6a8d490be7c6077a9dcc56352659182fc1e5ee4c79
SSDEEP 48:KPLJgZLeayv+PUZMQAh/nApVHBb9mW0t997NcmsypMzMl7UmA2aaY2p57E/o9AZT:KtgheaC+cSKyZRVsQ3Y1ym9z57+Y
TLSH
T136B1BFC9A81351DDC12BBE289FB344A895779C6B2A400F0BB91E24755FEFE263B73015
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararansomwareWin64.Ransomware.Wintenzz.yara

SHA256 39b0f623d6584e59585b3975841eff5e7bc93f4ddb891871d155670dc2c15dc0
MD5 5f9d3a189fdc79f97e32740ed271d499
SHA1 112389726b38bf17c2c3d3c4523ab586118bd367
SHA512 b0bbe70b98eb4725ae22db0365e2dfe1d2fb8aef3583e32a7297b32a170f3164a230ba12ea019cfbc554d0a105be8792bf58ac78c8d97667732ee4abda34fb27
SSDEEP 48:nbRPjzc2uhm/RBygj4IJomQNrKQKNqzDMzzRf7tJNgr2cH:bms/Hp/HZx7gqcH
TLSH
T11B913899DC1B11DC9326BF389F7288886576D42709024D0FF46D64B86F9FE2BB533106
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yararootkitLinux.Rootkit.Pumakit.yara

SHA256 6ea76909e7b8a126b17be584050f7a892123cc892148bb59ab4638dde1185bab
MD5 d6ff24815e87dcd0b520f3ba235087fe
SHA1 88f3d5f0e76f01a128357e163a21d9a63722861a
SHA512 e3e5c5b70e9c10b02cdb3be6fcd1cbc56dd718e0b72b88cf6c0060efc75dc8ae16eab0faec90d91ba3214051a0f36c56028df238c854371c88f91f548753de2c
SSDEEP 96:EPPjyiNyqgk3eorrzSnO2jTNOTEVOoyMIOAlH+sp6:EPPjyWIGeKuNAMsp6
TLSH
T1A8325E89984312DDC273BF38AFB284986677C92B19110D0BF95D24742FAFE2B7633519
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yaratrojanLinux.Trojan.AcidRain.yara

SHA256 33416451fa8920e3a17f9844843dfb5173732c040a139f875558a0e8ab27024c
MD5 d4599ee76bd04d9d390c824e7cb479b2
SHA1 f896083e1dc5ea2f63acc9351d3b23ca5d164026
SHA512 1e7ba4eaf68209c1f55bd4d76a1ef60556dbd1902bb02a4a42fff39b63073f3f954837a48cb5230e2e4c143733ba2a0e9fbab8d7b12a846e7ab9a30e346995f4
TLSH
T156619F889C43121093696F3D1FB355A82673872B09421E4BFB4DB4B45F6EE2B9B7311A
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yaratrojanLinux.Trojan.BiBiWiper.yara

SHA256 2aea081a3ae0ce196a891d88cb7a328e8fcfd854a835641657049748e2b824af
MD5 5a10ef82bdcffb97b3c29fc26f3c5a53
SHA1 f5f9c9ef5f7efd6ab3c7ba584e276f7e5e9c108c
SHA512 c79f1b39ea04e71aa9e518bb634af9c53fd384162a01763d597305aa0c1e973254a16f7a867853e4a514559663ce5794265ff7ce4dbbdc7d16501f2c965e0c12
SSDEEP 48:6R1R0Yjy/c5mJu/2pyXSRFZQe5R6RPvR5oJ8erRahf3x7rRgQcjyPTAOzPrDyhqp:6R1RBqj5YhPx6QquhPiMJRa9s5uS
TLSH
T1D4A1C98A884752DD93177D3A6F72848CD2BA882B0E410A0BF96D55751F6FD3B3B73412
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yaratrojanWin32.Trojan.BiBiWiper.yara

SHA256 ed9403c246023339f6cd60e640e737fc9ca13403211c122488b60d3bd3911c7a
MD5 1753178d9ed87fee3abb48684cc94502
SHA1 844a52d53a27e1d5cd23bed6aaa3c542ac6230f9
SHA512 037337b87699b11883ec2398b2ec35f6e3f0643c6b7dc5043e6fc0dae6089fe0751cd416c5e12044136f447fb3a0c9da315f8661c613d42d5d95a14cbe0014d7
SSDEEP 48:9R1Rqz7Xw637zqRC4GnH1xm2ePt5kUkR33XgxkWXQJmwM2+MNB27IJ1jEyPwex8F:9R1Rq/fLnHg63wfXT2dpIHT
TLSH
T18DE13284485B80DCC3367E6D6F7640B8567784230A026F07F8AE7479AF5EE1B36B3116
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yaratrojanWin32.Trojan.CaddyWiper.yara

SHA256 f8ec3c8b660e566962b8e3c342b5642d6cb9e47655bdca8bd0aef242c48e7b62
MD5 2a035a9b3bf9fcceb2bfc570fc8d0ffb
SHA1 64477505be8031340713cbc16019a7801a172417
SHA512 303f0b676fb817fcefbbc62839067e8fdd05997df2cbec447349bb7304554fc32fabea3d13798e90491bc9923b85f1463b3bdd81201a429b63418852f1f2d2b8
SSDEEP 24:gjyw1qOdrgoxtxHnINcdUrmQdSUeswb0sI90p2Q35KqKsLFn/hC8gb4cRjQ819Fc:Kf8PSaC+ql5j3n/H0FFu9+yzRqUrk4
TLSH
T1DFB16956D88786548BA23E3CAE73FBD42573C98F0D014C9BF22E95386F47E268037902
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yaratrojanWin32.Trojan.Dridex.yara

SHA256 cf5557eea1de1792c0d53cbfa489ceb858facf0a7d2875ebc05afdaa4fe1d352
MD5 c6631dfc6881f07cddd38de6ba1cfdfa
SHA1 80eaad3a1b6774b46029de5dd26fd445f206a39f
SHA512 7497ad2996ddb394fbdbdd93c99728cd44c925358908b94c24a7b0c65d98515d19298558162604ef916925622783fa757513699cef1b6e750cf70bad776df7a4
TLSH
T145612055DC47910802396F1CAE735288F37AD86306431E0FF69D90B42FB3E2A6AB3919
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yaratrojanWin32.Trojan.Emotet.yara

SHA256 990a5f92fcd4ff544c3fe1dc281f52238120216e49138ccf98da849217102347
MD5 8c366ce25339ed351cc5d79859bb5fc1
SHA1 3169c587f319685f1ca0250be0671cc836aabb7b
SHA512 398e6ce3e1db20eb03a9343f4b08ac685cb88479a70408897c54be6567dd8415ea82c718fb30582afb7a162286f66a46c1bb565ce4e1265d006368fe830a5bcb
SSDEEP 96:sIluGJm4EMLAGZjBn+KKDT3Gw9CPp+BvCPp+AJir407lITr7Cw/ti6fZYypUBdYE:sIw6dL1jB+KKvt9ypoypiYhYypIYC/
TLSH
T1E5221389A8839788C7313E1CAF7656A426B6C8670A024E5BF15FA071AF8EE375573901
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/reversinglabs/yaratrojanWin32.Trojan.HermeticWiper.yara

SHA256 555520faa6696fff03d705d4c4d758f5467810199eae4d84575efa1999c5e855
MD5 50375e9ed14c07f0f275e9e85c84d1f7
SHA1 6c67b112989d1def408fa2f26d164944727975e4
SHA512 1bcdd9434284f41c160fee3cabe7478ef00e620282a62a46f27815b94ecf480f0bf21a58d726c3c66988e0bbafd70fa4af50dcabb59e45287cb73f3f0bfb04a5
TLSH
T11751A8D1D483465E8A397F0CDE73A6806632C89F08428D5BB64E95783F1FF2B96B3512
MD5 SHA1 SHA512 TLSH

rules/community/reversinglabs/yaratrojanWin32.Trojan.IsaacWiper.yara

SHA256 9c8ccd047840bfd24a00a1455645656a76590f8f56a774c3d0416cfeaebc376e
MD5 8d83fda77114538826098c66eb26099b
SHA1 0f9489d62613349c6aedc9860ac1cc5e28e07a24
SHA512 952d361ce90a188add7e8cb1bea5fc0e4f905b88446efd444f3d7a9e7fae574731c9eea1bc4ebb143b19508feca762f4fbff4a0614a35a4c1f01f2c9a802eda5
SSDEEP 96:a3HeexdZNBBXJHjT9x1gwb1Pl2avao4rQ:auezpTL0avaop
TLSH
T1ABB18FA098839699C6763F0CEF72E5E42572C8AB09010E1BF21EE4752F5EF2B9573416
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__expl_adselfservice_cve_2021_40539.yar

SHA256 cf4ab20a424ac0845278750496d2bae15ea4ad885a06fbb4c741f75545183f9e
MD5 e13b33a183cb1418261ae5d51ec6a044
SHA1 ffbb246cebabc636e1e75e9bee0204dbe15eff47
SHA512 999030ae4a583d2b6e452aa8dbde4eb609b91c4a936a7a21fd539f32652221fba8efb5ff1ef53e12f9ca6dc75ea67415f109a200e0c2ebd11700bd136dd3f7cd
TLSH
T190F0622329A026E14887134D25031D08700F390F52415421BD5E42AC0FD0E3183F7F97
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_citrix_netscaler_adc_exploitation_cve_2023_3519.yar

SHA256 ddb4954a131b24b9dc2b0744c902364bf1ae2e5209ad293d43b299cb69ee22a4
MD5 97002832c762bb6ffab0ed8de6c29660
SHA1 81cee15526517acb984dc499e61f03b55535a30a
SHA512 dbc0cfdea1db941614400079ff45ac19d447a8f9b8bab602c4be4f8ae34a4b7ff634585a94f2919323ac19a95c2c3752382882803e02cb3541683aa79ce5b776
TLSH
T18C11408200A21697034A02F888710303F2A1780F47170F61B82F51B81F19E76C3F55CD
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_cleo_dec24.yar

SHA256 fbfa5ad7d9aa0afe439ec4ff3883acc4cb92b62cb67c40d674320c9aa1d4642d
MD5 36c6f0b2061da514c400c0bc2749b5cf
SHA1 6a48b1275cd442524903dc85f7801407f4140172
SHA512 f4e5b5ee50e0a936175023160cf7aaa182ae46276f96adb955cf5d5e09d0959ecb589c5d600e46b196471b1422b56b8fb3164a2a6fb62fcf45454a12775ffb70
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_commvault_cve_2025_57791.yar

SHA256 3f86d42e9e57e5a1e49ceb5293c743ad39e1d658afc5278a5a6a9a1067ed74a3
MD5 27d0fcfd399ed844135ccae0195c0216
SHA1 4f053623776f0aa7a4a420e47d0d7b9bc09ec5f6
SHA512 1d70aaf600d50407bcfad7d0e4833b376a621f443c42035ee86c8ca8c57c47ee78825277ace72c8f97064446eca27fedb6e17b9f07006380f850966b1db1ce8d
TLSH
T1281135035A5169F3C65EB1CC58524347F407350BF27D20A2FA4E66900FB1572D6FB569
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_connectwise_screenconnect_vuln_feb24.yar

SHA256 7f47d11357dde0d73379d48a191f48ef18dba163d3e7fff5772dd326416eeb67
MD5 7fe9261377a2e5ef1ca0714454a2e62b
SHA1 429a50a3693a75bdf21d7fd3c9717826b39abd15
SHA512 671505412b2ac49e683e0a1554a5efe3880a9fdce5465a09ff5f3dbeff4b17019b065ceac411dcf0e7583369f11d51ef885c3fd7455fcf376be9700b010d9d56
SSDEEP 48:jO0XN67uu0lAUs67rFpvZX0s6Wpxvs6WH5qh067rF6Ka:jaUr3PD61
TLSH
T11F8161235A502A85760B5457A57381412632380BA7B4E8BA350DD5BCAF20FF9C3F76DA
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__expl_cups_sep24.yar

SHA256 361cf8858e4cc234385883b6ba0426043a28a2de66aea29230d7148b2a6d2b13
MD5 f314ae8eead2de858e66ebf1cf41310c
SHA1 a1399a614dcdf20d0bbf0e529bb6b9c98b24ec7e
SHA512 5fc277e33d26a85212858668e66046ed3df0496ccc0bda436d482ebbc4296d1e450343c31f1bd9b1188084c6d1fcd83522eddfbaf2ac77e3ed1b5f710e07cad5
TLSH
T121119461B9DC5926448710D47D49570D758321E70C9D393A323EEDD88F18EAC83B5BB5
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_cve_2021_1647.yar

SHA256 f8ba1ec595c49b854279353a3df0a5f58c74c22e32429e77ba7c54e028972d8e
MD5 dd88e7a6176d55873eac10b5de3de718
SHA1 99a3fdf4b4d1349c2857ee3e67efa24f26430412
SHA512 edcb3040e9297eb0d06126a12d79eaeeb745ee56c976b55dad3ee2b72f35473feb9577030a88b4a1fb7bae23fb84cebd17c1c66d0a4206580ad9a048a6d86521
TLSH
T102510368D49C1247823D5FD97BF464CAA3F2D04760B18AE632CD79A3A788CBBE770404
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_cve_2021_26084_confluence_log.yar

SHA256 44a182482b114bfb401d9a7e2eb73dc097930c35fc878605a180923b2cc0eb64
MD5 7571e854412af7b086e4e0c9cfec0db7
SHA1 304dde734a78cc008311d751f013443cff7ed19f
SHA512 9635d61241af6431a9691341ef6d417825a677aabd81b91aead5f86a410ee546c396ac4527be2b95abc000adaa7cf46ea3c45b9e91b2b807ae79b1efd00c1a9f
TLSH
T11B2165002611AD960A6F20B630F35296636C3493631D4261722F41ED0FE19A2D9FBCB1
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_cve_2021_40444.yar

SHA256 8a3b06f153581ebcd0a9653c83b520e2b1fd0b8b33a809dddcf1aab61f35ad64
MD5 dd453f85bc2d8410c21424751a417870
SHA1 421e3aeaed5161e5708231e06eb1d95c406681b6
SHA512 eb14c9a38185dc360e8ea0052a9cf6ab89f0e5ab3c0199956c354f9b4872d88773c7832322a42bba90f73c974112b356cb394db93dd2b4f95376d6302657f087
TLSH
T1D74144577E2020D68D0FA0D4B553C60F7519E62F22DA8992390F11C81F61D7AD2E7BE6
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_cve_2022_41040_proxynoshell.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_ivanti_epmm_mobileiron_cve_2023_35078.yar

SHA256 6a3cf5192354f71615ac51034b3e97c20eda99643fcaf5bbe6d41ad59bd12167
MD5 2228e977ebea8966e27929f43e39cb67
SHA1 7c338ed2840d2bf55f9f5e4eed04f66c80840eb3
SHA512 ff9f010b5bdd7591d052fdb8cfc6e7b842f8f973ab37a91ea5e16449c17e9278d9f95f265b0508f083348376aeb16d7f02b7b86cde634e8c9f875287049360de
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_keepass_cve_2023_24055.yar

SHA256 f82047fdd73d66214ee839d75006bdb34aa1b3ab89578cc2fe13d9627a544293
MD5 f0ca4d4c69fd20da9b8b14ce05e6bc0b
SHA1 f1747a714013c4b5084a9088949e7bfe43846da8
SHA512 ed74b8e6b8d3398bd7ec99508f15894637655219996cd44785848e6e5220d4988ec3ae7115d649412c31cb8101d248bd4852a5803db793d523196602e2d34453
TLSH
T1B3F002032D1417E64C4F10A17A9352966225684B63DA8130706D53BC1F02833CBF65A8
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_libcue_cve_2023_43641.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_libssh_cve_2023_2283_jun23.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_lnx_dirtyfrag.yar

SHA256 75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070
MD5 e1c06d85ae7b8b032bef47e42e4c08f9
SHA1 71853c6197a6a7f222db0f1978c7cb232b87c5ee
SHA512 016ba8c4cfde65af99cb5fa8b8a37e2eb73f481b3ae34991666df2e04feb6c038666ebd1ec2b6f623967756033c702dde5f423f7d47ab6ed1827ff53783731f7
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_log4j_cve_2021_44228.yar

SHA256 0fa369ab3fd8b21e8aecfb97f4ed1b99da71b895ce0ee40752ace83d83932100
MD5 932b3e9e7ecdf42c983994aa73da9620
SHA1 67e2f540202e01b3638b4edd15cc8cb2c263ed8c
SHA512 45e7fc6740105bf3744a81590477ebd725194cd67844471e2acb2dd9e918be8be902fd374f4c5de23c24449f5ebc25513531e9b3deaec494bc7fe6a182f6bf08
SSDEEP 96:uO9l6VcPYJVF470KFPzFWKO9lHN2P9lrhQF+9l9LN8mw9P5fs9ljeouT:J9UVcq67rtzQKO9t09Q89PLNs9P1s95M
TLSH
T1EBC15463756864C30AEEB5AC94D28045762A552B83540C12F64F62F81F32DB5C7FFB27
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__expl_macos_switcharoo_dec22.yar

SHA256 70a4ffe0ff5dcc1a11cd90e5a57a526418144189d412015c94ab5a946a31435a
MD5 2c42b8c3bb6913c27bb5c1ee8fd03e42
SHA1 6c7eea2278ff459a2c27a1d99d202858cc36ad0c
SHA512 5932179ca193542ad44637cbe9a3202d8fdce4fbee53f3d2a2d388cb9854aa3dace1a788c35f3830652d77320e560a3ade980b0a6ec7a3e2ff168a364edebeef
TLSH
T1DEF023230D10618B1F4DA8ADC9674042F5612567612C4064344F82AC1F437E0C7FF7A3
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_manageengine_jan23.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_outlook_cve_2023_23397.yar

SHA256 88efb4fffdd1f1ae1470031fba2735d2c71f159965523ded7df5ae10ef00eae5
MD5 fd753af2cf24821284ae1a44026572b7
SHA1 3d4b00ad60acc5a74bfc2344a5ff4c8e6557d02d
SHA512 a5a6345b8d07f202176b4fe4b8652a6cc88c9a4ffd12c5dbfd4257f06330d5b1b9e990439782a1a7e97008225fe599d3533a74d6990bb56923289661611ff43e
TLSH
T1855194A13E4029D6D589931D62D2F049722AB62B7BDA58E2BCCC07DCCF26C05D5F2393
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_outlook_cve_2024_21413.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_proxynotshell_owassrf_dec22.yar

SHA256 5efbdc40bce16f7f28aa2bc4802b62c449fb54ca00da53d55a96531dc1e38c82
MD5 31966643ddddc849601afec29a24e50e
SHA1 13400ccd07f3b9b46af22970d30929cb0b59616a
SHA512 17522059cf7f8b82ea468f07942adf9429d0672c1a648f6ff7578411fe2f6eadd3103e31539a3376f5d65f81048dad78efb014d47029963cba2179b749b4133c
TLSH
T1024121636E94A428CE5F40DD67A4448FB418204B528089A1BF5C17EC5F01B7BC3FEA23
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_proxyshell.yar

SHA256 e151684d0462ed960a53787b684e9ce395c4f580b730c81ba38486793912bb9d
MD5 7cf4ec80b7db4846d787f1050b8c6e04
SHA1 8939d41ae86c9656b3b12eaa867488024bd20e52
SHA512 d6175daf956c8dc39eb734a1b6d32472eaeb9416fe2099cbfb50e062bccbebae7eccd1e938498a2ab7b4b6e929a844de3579694d4b3dcc584b9f4b86c969b56d
SSDEEP 96:8pIn12X25In/b/zsTQImI5TI67Lql9jHdv5fi:7n14n/b8Ry9ji
TLSH
T12EB12507FFD27CAB595ED2A829D27044EA04A89BE0C54CC1BF0D06C49F91AF9D6B17C2
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__expl_sap_netweaver_apr25.yar

SHA256 9237f0d551bbe95734e20bb9007aca0750d76b1fa464c77bb146b2db195c814c
MD5 702b780a4efc13b41c4dd94979f13ea1
SHA1 ba99ab748b61791629727e286445a1bf66071d39
SHA512 213eb3f5874c3c1c55babe707762b4fe6372b98477a8ab6515ba1d828f68014ba539d29955a6a6de86317f76993b1dfa3afa946ddb21b03d5a2fa41a7095b8a8
TLSH
T124E0AB220E3839D7494F505282C9D04B931B605B83A251E2B70EC1488FA6ABAD8E780F
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_sharepoint_cve_2023_29357.yar

SHA256 6a3cf5192354f71615ac51034b3e97c20eda99643fcaf5bbe6d41ad59bd12167
MD5 2228e977ebea8966e27929f43e39cb67
SHA1 7c338ed2840d2bf55f9f5e4eed04f66c80840eb3
SHA512 ff9f010b5bdd7591d052fdb8cfc6e7b842f8f973ab37a91ea5e16449c17e9278d9f95f265b0508f083348376aeb16d7f02b7b86cde634e8c9f875287049360de
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_sharepoint_jul25.yar

SHA256 6a3cf5192354f71615ac51034b3e97c20eda99643fcaf5bbe6d41ad59bd12167
MD5 2228e977ebea8966e27929f43e39cb67
SHA1 7c338ed2840d2bf55f9f5e4eed04f66c80840eb3
SHA512 ff9f010b5bdd7591d052fdb8cfc6e7b842f8f973ab37a91ea5e16449c17e9278d9f95f265b0508f083348376aeb16d7f02b7b86cde634e8c9f875287049360de
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_spring4shell.yar

SHA256 d0a5941c0cd262cbac69892f715f88de5a84456775b2213249035a744ab9280b
MD5 1df4e96fe8be44879078bec213b237dd
SHA1 b5ba6f7aa152b7e07a5e4c2c62446e3949f66499
SHA512 0b0db739a4b8b2609728fe5bed7e58556600943010e7fab712c637b92bdf02f647ef28ad0e1479c5ab3eef5d23061eaf8a8e1f9a13acafe3a36dfa773376e98c
TLSH
T152A0228FE020003A338F20F2300B883CBA200CCC32020A8C3002E0CCB020233C3C0838
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__expl_sysaid_cve_2023_47246.yar

SHA256 6a3cf5192354f71615ac51034b3e97c20eda99643fcaf5bbe6d41ad59bd12167
MD5 2228e977ebea8966e27929f43e39cb67
SHA1 7c338ed2840d2bf55f9f5e4eed04f66c80840eb3
SHA512 ff9f010b5bdd7591d052fdb8cfc6e7b842f8f973ab37a91ea5e16449c17e9278d9f95f265b0508f083348376aeb16d7f02b7b86cde634e8c9f875287049360de
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_teamcity_2023_42793.yar

SHA256 75a11da44c802486bc6f65640aa48a730f0f684c5c07a42ba3cd1735eb3fb070
MD5 e1c06d85ae7b8b032bef47e42e4c08f9
SHA1 71853c6197a6a7f222db0f1978c7cb232b87c5ee
SHA512 016ba8c4cfde65af99cb5fa8b8a37e2eb73f481b3ae34991666df2e04feb6c038666ebd1ec2b6f623967756033c702dde5f423f7d47ab6ed1827ff53783731f7
MD5 SHA1 SHA512

rules/community/signature-base/yara__expl_wsus_cve_2025_59287.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_100days_of_yara_2023.yar

SHA256 e37282d6bdaf7e422f0dd76e85817951758774a824405b9257efbf2f0a367078
MD5 8a9321b73c245d0e42ddea4c546feb8f
SHA1 0b271d4b6a6c0a082468608d330c6c8c15851171
SHA512 4a3311036fe298547859cf51a194fb6780f91a6f84890500476ae419334cc38db4f8166470610fe0f2583127d3dd896850bbeb3b4d3ba5e1839ceea53e578f6b
SSDEEP 96:jjE36KaKRDumzS1dSgCrBFx72WwCtY9U+QXFimN2t6H3xKQqSvRwqVYrdlbO+:3GD4XoFx7pC9/QXFw6BqSZYrHbr
TLSH
T1C8C1FB0E1F002D3D58CE023EDE53B186B5392027E388819A7EDDD92C27D2675EEF2486
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_Excel4Macro_Sharpshooter.yar

SHA256 e732c8ec70ec8f9a1d3f2afbae661a04761ae318d5ca0c52fd3bb74f51d1622d
MD5 0bfde362a93f9eba8ff6dbeaa48f8144
SHA1 15f2c094e3eb5d664631bee840ebeb423c27450c
SHA512 8ea17ca5d892004899a96df538f74efcf1c29ee55d09038007af9dd54ebab05740e4e14457eebb889885285bb223e23005a029c69dce2ac96054b1d6e0e391bc
TLSH
T14841DFA663E9718AF95B528C4BE634A21F113C0371F28DE631CE2BD5EF868114AA15C2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_ace_with_exe.yar

SHA256 079c297de80bd3906eafc3d705a2725ec323e5a437868d423e0fd33882d93982
MD5 16c7a950179da1c6e938d3e4eda179e6
SHA1 5a5167f602fe1a66467e58cf17db50750092bd88
SHA512 497fe82e189a36ef49fa8952bf22be58c299148c8f708d2c3d7073620db6273b67af8e6cb4452ad15d3856b7a5bdf7e503fc0a3ab4453446e5dd1686840077c9
TLSH
T1A3F08B11B9086386409FD562CC856402FB69364BF70ADC647ACE82F50FE9325C3F2540
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_anomalies_keyword_combos.yar

SHA256 a21e505c7fe81c775380f2aa94fe21fe04e4a442e80ebfe0798947d7877256fd
MD5 c199df287f5bca71b010fb46810d6e98
SHA1 9c89b341b65ef6e80065841905855122c4db07e8
SHA512 7bd0cc901dc2de2e5e371bfdead90854ed544d7fe68974c495aceffdeea3ed861693e894c0367850bdd144bfdef98c9a17357e280e5448d0d00e5f161cd23377
TLSH
T18E21E20BFA0009DA994B82DDBB7ADC97701462876381A518BC0D14DC2F46BB2C1FB672
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_anydesk_compromised_cert_feb23.yar

SHA256 d5cb93febe25f7eb0561fe143c09ccc2208f110105b496f8d2d4014b34e3e364
MD5 b96398b06fcfaec72e9d3aeec52970f2
SHA1 3e9ecbff7594cf99c42dc4cd3450c40ee592be63
SHA512 895829119fadbc89e79db3a7f3112e25faff3dc72a66917462e554ea3e650ce88684672c6bef3094f3bc17e72bf7abf12c97530fdbf5a8e5f93e503f7ee1fb4a
TLSH
T1F431530FE4006975A01E03202DA2144BB613FD6763905868304D40AD3F67EBEC2FB1E3
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_armitage.yar

SHA256 cbd67fcd107db1e6f614d5cb8d3df85bfb6c1d32793c8efa7127d095fe10a5eb
MD5 b0759a89d1d0a0c8fe5afb72cc854e6d
SHA1 27aefa27a92ec21b15faf3e46d174bb69721df8b
SHA512 7c7cf7935c38dcc4b492df30370dbe0bc287454e1e2b50e83cc7f60e52d918107679d782b1596cb93b98e78ddfd8c87f2946b637f347ccc225b31609221a240c
TLSH
T155414533AD903AF6C51EC0DAEA178103E209544F935DA0A9B51F44DC1F479E9C2FEA61
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_autocad_lsp_malware.yar

SHA256 9a1fbe7b36412a2d5acd577558083997e12bcc256f4b169ea4e32aac5fa79de2
MD5 89a29be289c227e8bacd27d7c278532a
SHA1 dade79e51cc19a1e6b75ad7674c17c8b6abc30e6
SHA512 b34a8bd623f956940f465829a7fddc013171f916cc3875f677279822769f38eac041cb81983b146166d693ddbc1f96a9a995f0c73e76d78bc43757d0d84853e8
TLSH
T1A65195DF28288DCB415D9B5C28E284CB7945992F238F5857744E28C90F43624F3A7EB2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_b374k_extra.yar

SHA256 6f2e68104e13809b12d04bbba7c1c98f6906b90b8f6662e85f3d99dd4b6798a7
MD5 f4bd631e093e8b5f92646695e54e840a
SHA1 02920b72734e56e8bd01f504b6cffd4fd2dfc1a0
SHA512 8c9a0331399eb87a8165682e70bd2e3bc87494bc26fa1802d14140126ac594c576c40233a1d87419fdfb4e48142a369b5480fd2866ef9d2f77a3c45d2bc425c8
TLSH
T1E4B09240A9A44408BA9336A4D3A04A256038356A9B98AD260AC31A3AE92AA43A52C2D5
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_bad_pdf.yar

SHA256 31113aec43265a7c1a12944a9589eaf2b2e7093ac05fd55ac0b562d80778b1ae
MD5 b79945e64f7897e927af0ce53680b734
SHA1 de578de58737d4fafcdde4a8c8da5becc5411801
SHA512 8d417e3b706bb9dd5d00f3caab90737e4680240beab1d7f4de0c7dac720c3ff96c6ca4942c772fff710bd1b58baf377904ca61d007f1323e2fa10ddb21e5bd98
TLSH
T168F020A31F0036874448480A0A92820EEC46B28B80953071F60C1BE40FA5DB9EBEBDDA
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_brooxml_dec24.yar

SHA256 4f1da86352411b12da0ec2b9dd2d05fa6b26f6265c14bbd2840f3abe00aecd22
MD5 98d28b035fbdac9c43610a2374893bfe
SHA1 e1ca378fc99027aa56ca804ae9c6744415f714a7
SHA512 93c6e6ef0b2b192b814cc722755fd1d369db7a3db845a9a9c7e698b6d1393391eee89f606f48534df48ae197006846d28bb535e53a5be4811c65ba12cf1fbfdd
TLSH
T130F08B562B1FB58F54EC40C17CD5B10971B12C17A232889474EDCBD44F4DE6888F1A94
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_case_anomalies.yar

SHA256 5aac6ad3492e161db9c968a65a276abac0bd87443a7f025aaf7ddc485934ee41
MD5 98cc03f605154870874422d230f3c6a3
SHA1 b2bebb3f85974e381fa15cee4b9f8cbbf4c847ed
SHA512 bba7a519eb9157a0121213441f63aac1d7b12569f3a20a0a12fd9e9843075fc2cd2020948357c67906f1153ac7bba6bb589a61f645aff9ad16868f9a0b4cbe5a
TLSH
T14421E109BC50646C6B1F40DA6727B11D3B08A08B42948155BF6D8AC90F02975C6FA1B2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_cert_payloads.yar

SHA256 ba0931f1654d718d0146e731b02790bc2bfccdc029f569ea5117a94699324859
MD5 c00c31ae9d758f89ca95f0228215ce01
SHA1 9e8b1fae8dde17ce93be3e5475cc2e5330b40eeb
SHA512 6cab46447cc65cb86a19e812471d918a52aad92200f2155c521508c93e5817b12905f5a32bb5cdf85807c29c50c62559e88158927205fb0a86001c2049126236
TLSH
T19701C0132B517CA6585F913A92E2D8094218A02BAB861C86BB4E11D42FA1EBBE07F5D1
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_chaos_payload.yar

SHA256 5727330930d7137e8e47e6875e589adeb71d45a54c8c89dacd7c67c0c0efe76d
MD5 724334fc7fb6a66a408e0fbdd9a07328
SHA1 02bd08e20be1893d3f031cd33a950f1b49ca35f7
SHA512 88818dc12194f67395c703a74a7a436e8745d4ddac10f4854e32bca5683c7efe489203e3fee64fb96dd904cb51f13d7e6c4edf43db5bdd78d6e3841ab02137de
TLSH
T1FED08C431E40884CEF52F3C4A2A55302E62500AF8F84AEAA918505A56F03B97938D120
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_cmd_script_obfuscated.yar

SHA256 440a5886184dad7cf4159e5341ad4f1974c67c273ba0b6be84420a0a315e48ec
MD5 05cbf69a4a89672733a630d8ccef605b
SHA1 8bfc3abf983cce5e7b38a64cc26f85ac46b1ad84
SHA512 fe0eb1de030e48737359cda5b029d4be5eb8c5233a80828e7cd731b8a8b4a5498a1e36ceb0d576593776f4a6dc603dcf1763fbe6f0beeb63339b22106d2d7a8c
TLSH
T1C201440BEE0138CA280DBAC941F34404F831B9672FAD8927B50C14DC1F1D579C59DB32
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_cn_hacktool_scripts.yar

SHA256 6ea32573f85c63a2e270805d886a8e99faa9c1a903d9cb2c61f3298b21db565e
MD5 caaee5c278609b3b663292502276db0f
SHA1 2ce36fa60f1db11c3f1e250f901193987b7be834
SHA512 eb2835ac50f47466fd8b8c69c667a24c3ddd3c1943f29f3f293a02d5b17bf93247ce5b01d2a83c98f76f2e1445260d36d1452efaa8e55464a5fdcb24a848327c
SSDEEP 96:FYeTSLiCTk5Mds0BjCEHKxuHiZOcNEHdH29TBh28yq:25L05h0lCEOuuOcNEJ2972e
TLSH
T171C12317EE5026FACE4F54C5CB67C107E259A48B33A894B8B84D89DC1F09579D3F6230
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_cn_hacktools.yar

SHA256 f7ea0749b4e523215130cb1441d44fc64dd3df766bb4af105819d08aa806f223
MD5 343a2536b642649d86f90ea2d62e1944
SHA1 44293061fc507d369e51a38235efa2d545273855
SHA512 5ac5789d7cee2cc93fe496de16265a817a189d5d8b2b82ef3e6b73ad93ac85fd3d9be9a067b5be446e771cb4d36ce4ad9b6fdae4acd1dea17becfde0555f56c4
SSDEEP 768:39zl3ieYMwQ7IsOF6q1AhL/02gN40vUDHamdVqsToEv5avDPHZBj:3hRkZhSh0IHamHRKvz
TLSH
T15FA3862BEF8034598E8E25ECEE978147F32D20DB97EC80BB84959CDC71892BB95F5510
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_cn_webshells.yar

SHA256 4775d01a68755e57dd63d934d5277dd290d8bb11a6c88094913370140a4c5ea0
MD5 43b3bd9eb8820abc321d7133273cc917
SHA1 4088351009c9466e2ba2124271da071c7b3476be
SHA512 e6434d87291b1f18d753c142c88b2ba8fd30fbae0412234e87615e541eef60124d614f74be2e37923cb991e3c3f7cbe0718ca465905e33705880cda2658e9ccc
SSDEEP 384:f4F2ERlFIvfREiU85MLyBxzGUfGjoo2QGELaAPA:f4FHRsEiBFGh2QGMauA
TLSH
T18CE27327AF9026DA8E4F14D9DF938143F225648B6399B4B9784D88EC5F065BDD3F2230
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_cobaltstrike.yar

SHA256 e7604c2466d60ab4d15508eb3af85f72591cdf75f094ad559bf6c69805880938
MD5 7c526a7d1d52cd9894d1e019a77aa328
SHA1 becb60f5ab90485a06f4ebaf97fe991559579790
SHA512 c18478a50a0b891d7e7769c311b55f6d66f9abbb9f77b446c698ccbf7c078a23e7366207726117ee01a92b194ae745ffa02374cac172b35f5cbef82206177810
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_cobaltstrike_by_avast.yar

SHA256 203a3cc1a742ca4abf0f8a365a328f74b3aa68bf68785b6551801ebc705f27ee
MD5 bf65dea9bd05d55e969ce7b07f8e16e0
SHA1 03f643235605889b7bb8ec055314882df75d2f4e
SHA512 fbdb8d003818efc19bd2302ff61b0b8a82d1405ecc50b0d52903cb99053ba917c9d35119ba24207d7dee3536e9eda515af4d22ff61e7365214188f949e1b8262
SSDEEP 384:SnN9zm0355IwhCP9zHPqlpT7BgQCUEuchMHkuqcIWf8+LDjb1VEEuc6yTuRf89VF:Da9W/Z/ROPHTV
TLSH
T1EEE24584DC019C93485E91692E117CE86879393334D127C7FDAD33D0AF3E93AA9963E6
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_crime_bitpaymer.yar

SHA256 7c5df0a3ef7e1cfc75cfc15e94b403f717a03549e723c2132a0c1b64ee063719
MD5 144cde64f09029149ab5db188553c718
SHA1 0e1a9b52883c19d926345fd0bbc371b6e8c155bf
SHA512 79c8a5aaf0e876a819a543ed44482316850d4f49adc206a00a4ed1f44ce79f93464bb8e2fd22f88f37c336cd7aaeaa4cb60166b95c0d1988561307a0d0671a4d
TLSH
T148F0C00E2010106AC5E88D4D54D4A8416726984F13D090F2FADE0BBC2F88C3BD1F1202
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_crimson_rat.yar

SHA256 cbe4f0a7128955fcdd8f80d3a77a9ad3968237858aa7cf2ae83ff358e16696a6
MD5 c6c5c2650b834a51124f9a9fa98c9856
SHA1 165fc58888b841013fbf5db82cf1c52821306d9c
SHA512 59dc16f51d9f7f1b80ec4ef8f8a5378600e5a65551fabf2d8694d2bfa11692b007cf2ba567b1a36dd34ac39f17c5a09369366a21731601f2be44cf3f6ce81748
TLSH
T1A331442FFE6405D5C44ED15DF62EE163F116408743499826B80D2ACC5F27BADE2EEDA0
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_crunchrat.yar

SHA256 d1466dbed3cd7a5a1708cbc4c135d372cae0025b9e80ed253f7c3bc5c19d4cbf
MD5 4325ef907fce1d27e6a30e1467c67d7e
SHA1 6974ddc41e995d3ea940b0251d4674548f4c9e82
SHA512 79a24ea9203db706600f92d7be8a193f544416617068c125320ca81b221fb6cf4983e32ba8a8a43ccfd0aafb1212ab2a26ffe76c514fcb31b19c7b6a5544363a
TLSH
T170119017BD002FE9486BE9C4F6A7B26762398247D7885868FC4E04DC5F2127EC2E7394
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_dde_in_office_docs.yar

SHA256 96f8e9090e620cc09d4afccd0b26c872a71c1953f35e53361fc515495bcf98f3
MD5 e2a3b0b5f03faf9dfc3ed3dba95217cb
SHA1 369c2d6bbe113a4c7a4f25f7c6b4ead520b277d1
SHA512 ca1f4e05888b6d26abbbaa170a3469a239bea7e4ea029bb75a0599253bb1c45a5cecf6fdaf5b4b2f6f697a270ee7d3dd379ecc14b589b53cb6eaae6f56f64bae
TLSH
T18E410037281A29EA4AAD2054C0E3D007A6B7310B37456DA2B9CF86C51FA1F72C1E31B2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_deviceguard_evasion.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_doc_follina.yar

SHA256 2ddcaf6313b56f10103ab725d3c6044840d272731c51e0adbd236fd50d14d534
MD5 eaa147a0d143f363cfa87698bfe1ed37
SHA1 75cc79795d4cc2b45ca842a2ba5ad1f906523cfe
SHA512 a7701c9a625c2893e394d1929f279758016252294e86b43e573d2aa5690b9d54aa74d32a1a46467afe87b4322ff2d95d8bb6dba6aa011e1bc938d6b3044b2db4
TLSH
T14521D01AFF6C2856E50B3DF42BA2194F701A854790C1C8C3BD0C67D50F10A79D0E6BA2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_dropper_pdb.yar

SHA256 2e7ce616b86f808265439c35dab256ae81c86ca5e4ef2d4dc5af71e458520e76
MD5 33edd94efd83bd6c09e41ab4d145b248
SHA1 db43471d887642eee6b82b8ebb97456cdbc2cbbb
SHA512 354d278050a3a7ec746b7b7505478c10cf23e8d1d0e0a21e8ca83ceeb11381ecdd3898e9dc39d4a97dfc9f1161ad2c9114be6cbb63ed49fa5aa6935232faf577
TLSH
T1ACF0EB1729903AEA1D4E38A6FAF78049F153818F2294887E78CD84C81FB2539C1E2228
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_elf_file_anomalies.yar

SHA256 bf6701ad6fc1dcf3b8f85e5faf48f0945a7aacbb6a5a5642b9d8d20449197ed2
MD5 c25ae31c5860e98918d5bee5cebed5b7
SHA1 3d19e389fecc067e1cdf9ccb8c4d9a51b40236bb
SHA512 7c6ed26a18aa131cb4f48e66df770d63878f7ddfa0c2086ff437af39ff471fdc43543440a24235abfef1b38fc2383115311061558cf4d255a063c98e25459a4b
TLSH
T18E0110229E0052F04A6D80995F6A880B216259576348E1AEB88E08CC0F06AB5D7E3FE2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_empire.yar

SHA256 0b96f2718369ba56d1c302db218938fafc0dc1053ec35f369f5516b5f372039b
MD5 f040d5a14e90bcd99a082eaba33829bc
SHA1 fc1b0401816896ebdcfaa84e01642baf64765597
SHA512 755d2699924126645064b8297075cf02b2877876d081e5da6269afb54495bfa05b5d8964a08aad8462ca118358dd86832e763aab453c4be12be259b97b3e71b9
SSDEEP 192:w+AMwniih/X2qAyVRlTJjG+Z2UyD2r7IoR22Jsaqva/jN+8skqb0tT4tCaBEQLkw:qnfRv72T6Hu2S9BZkPtUE2Ug3gSTN
TLSH
T1CCD276376F0426D70E4E91C5D9A7A007F215601FB6D8A994F40E89AC1F279B9D2FF123
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_enigma_protector.yar

SHA256 fc625f9b40e979b41c0869471d77e5785325fb034e7c6dee61bd650fd550c0b5
MD5 b1842b1ca304a25e244532d54fe19076
SHA1 44ff17692b59486a9f0844230e22dc66c21439b6
SHA512 5685079064e5e41cf6be669a0db951c16b645e3099458e3fead316f0f153ee53afcb8520f237647c4b08fde0d1c52a4cae08992ea0cc0f14373ccd62ba76168d
TLSH
T18C41531B6D60719BA8AD63C8D2A79605F4116397A3EAC4927DCE18B80F03DB0C5F1666
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_excel_xll_addin_suspicious.yar

SHA256 b23d78c3b7ce6a7f90796b0e0761893e8933823d6a7b7308a724e2cbc76f2079
MD5 376390686e71a22eb65e777727eb439e
SHA1 5bb8583201f5be22d327e35623e43e7743f3038f
SHA512 cf07ea0c433581336131116d9cf66663652c6a44e12efee8614a8412bd1c0a612a6bdd266d382ab07acc288e7d4dc59d07b9840c67545b8b58fd0f78afb680b3
TLSH
T18761FF434A2A14CA3B4B9A525C6579BE213B090BA22C4480326D29D71FADD303E7FE26
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_excel_xor_obfuscation_velvetsweatshop.yar

SHA256 e237f59771a7d3deb6eef0e553e5076d0d929e0741c99c74fc644bf98bdcda6e
MD5 e11e5f5ddd32080116a5c1db87952127
SHA1 fb167d26854d1bcad5c49bb114851ef457001b0c
SHA512 aa221c78b946d67bfb24357a0a8a838c715975dafb7b79df6c7cacc28b3a9d1dd4f4f4418b6207fcab629d1cbda684c4848ea412029ad1df35b31d210a4a3cc5
TLSH
T1E32163DA6E2128E9AE0C628A4C72711EBE395F0F56DA04C7780C670CCF0B934D2EB125
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_exploit_cve_2017_10271_weblogic.yar

SHA256 22b6d223694eefac7a9ce644e1ff567f1b26b3c90111948ed1d443639df39405
MD5 90e898d2bcfcfa99a9ddcd3037c73949
SHA1 f1dce9508730e4c8bc50ac4759c5963b137508e4
SHA512 2ec06877587bb25fc3b2b0cfee914a28b8cc58a20eec95dfe8147f12db5e3272719a6ef6d1ea8019301c81945305950ccba26fc1eae1cb81b5046a9db9e8fb97
TLSH
T1132135239C702ACE1D1E15AD84F1418E2602E617858D09E7F52C25D85F83D74F6DF8B6
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_fake_amsi_dll.yar

SHA256 35743cab69e5df774e5966ecedbc90ad94dbb929677a502c63e16759c9259389
MD5 09a609a566df6db8db9102990a058a23
SHA1 bc6436e8efd6ec12b6d90ba937b8c8936ba5de46
SHA512 4f6923418262481ec8be995a8ed7145e8044399e2a6eb09afc630fda60caba27b72120e5f16fa815c91d718fe8b88b9c760797053fd54a5edd4ce0b9feaf8bff
TLSH
T19641400B3F5C10F56D49A1D85F6AA4CE220A68675110BD517E4D03DC2F82DA0D9F6BE7
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_faked_versions.yar

SHA256 a1823955d01a1bfa23597ab776583f06cab6917577d0644eef6f0e13d6715d3e
MD5 8f38cbba8769b9c87b3f93001e45e0f2
SHA1 57a94d3d77a6b127bceb06f11110374e175be0a2
SHA512 75f5310226b1945726aec35ffa3fb0cdf733ef1c127b933eb69c894033e85c8d1723249698ee3da9e89ed17a7b7a07b343fcb21863a845a75f73810ce69394a5
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_file_anomalies.yar

SHA256 523ba34810a1befd3aaf8ee964b48aa12862db8fdd16d1c56d5f197f818ffc6f
MD5 87ca4957b57579bb8bf985173314e2bd
SHA1 2f222a84df00ba84eddcc3050feb3522fb62a11d
SHA512 68424cc3296332be68ae389d17a4fb050e71d24f38a643387ed65cfb7d0be0e68238ed1b8ecdfadbfb3d952cc5040dd84676cb3ed60c8e9c4e79c21df7627c37
TLSH
T17571ED032F86814D88496B6C67B1910772216D0BAA934DF4B58F67F08F00EFC92BD567
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_fireeye_redteam_tools.yar

SHA256 ce7bc60872a68bf6c085982f63c1f442053951651020e6d62118034fb134b7dc
MD5 ef235f803e418ef6b096ab98840dfe75
SHA1 12333966314cdff98cbb7ea9924919808889b677
SHA512 637bcb342c9ca115e79fb21c22ab61b7f10a1575255add20c1d0b1b7795ad7473b5af2826882a786d3151ca88358c7b2e5a8e654c3fb9be6e91b6443be285f90
SSDEEP 3072:cTqZ2Z0aYwJcj4X0WGT3G04Jnav1a4b/u2wj9Ft/K:wUpb+K
TLSH
T17A244082A8A7049DC2591E0D2EB7719CB134BD0738D008E7B45ED2B49F5EC3ADAF7496
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_floxif.yar

SHA256 c0745a4346b6af39c5122c18068c80e29fcbed3366b4010fa48f0b05db772644
MD5 d9e61db5addc0aa50cfce958a0138b4c
SHA1 906cf0ceb149a5015c71a63e39ac772a7e617a57
SHA512 a7646fcd298fa28024b439a6cca5786cb103294b08a4263c55549a1ca338ecd9b59f1f41dd838e870e0fd377c42c68c9dcf07a27610190cb6e4dd8391ebd9a2f
TLSH
T1C301F415683016930D3DF1C84761071EB021D4A7923659D5F6DDB5B59F57CB7C2F1030
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_frp_proxy.yar

SHA256 2e5d0fcd4a3806f746be6d5e0cb88ce1c224608c36f14091290ea9e72a4b6ea1
MD5 f488034f1d4f9053abc6b885c67b5091
SHA1 7436d120dc7cd94db9ebac02e090e9be5a23956e
SHA512 30c9eec311b5346835caf96d1644f4e0e74e25aa51be0133ad4794ab35d659bc06a64b346b1fbe2e023e760d648143e15279b192edc9d4562ee7f1ebb0cb331e
TLSH
T110014402FDE016C3C90E94D16C27CA536326250713992128750D95EC1F0B9F8C2E6E22
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_gcti_cobaltstrike.yar

SHA256 0f23b573e80b46b14a237a9fd13d4dfb72c1dfacc4fad1d0b02fa505ec6aa26c
MD5 6afc3141f06a3581e1164f623e7fa139
SHA1 09fd90fba7da526b4962176bab183ab1f3a6e012
SHA512 acd76eb07665094d21e52e135aed8c7589248b3637cbc3e2466943899cc374b81e00a35feb542df313002825b15bc43701ac33af194283a658b757770eb8da79
SSDEEP 3072:0O9zJMdqlYT1JLrmyoL5fOwwegLgCdXWFkOnenqQkqKk6ft2fwAaNGxzTYYjyQl1:0O9zJMdqlYT1JLrmyoL5fOwwegLgCdX9
TLSH
T157F3F9665D8044B543448AAD1B6578DABB2D500B62B60EDEFD8F83EC2F9E8DC81F44F1
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_gcti_sliver.yar

SHA256 bc6a5061eaa2c6b4ab3d6723274c8b5e1f13ce64f38c8acff84e55fc15a0d141
MD5 d04f3904d3eb6fb3580da2a3a5e4e437
SHA1 397dde6e334030ec824a04fdbfe7781747f5d927
SHA512 b0e56b707f60f5445eb63977765bf41692bc252574d4842cfc38e67cba0915734c54e4cc2b2d10ba306c5df54341ea0b86ac59280e593d2badba9a2858ac4d33
SSDEEP 96:sf49/XHFCdG8B9vGLHW8WLy4PZqt49/XHFCsV9f8LhOJH5y8abyID/:8IXHt6JGTWjDPZqtIXHLVOFOJH5yjV/
TLSH
T1CAB1117A29D059A30F652F71DF8AB0CABA02C14B13258D9B3D4F43DC0F03C6AC8A55E6
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_gen_cactustorch.yar

SHA256 a50ff1e0814944032c4eab3e9acac1c5f8ba5f1be51858898c369f5bd3cfa27b
MD5 b44103f584b724211b2d2f2918430358
SHA1 5d1eb4fc4a7d90259cdc9be2f86a108e90e6a287
SHA512 8a11be6f4dac7a9e82c404cfdc48ec4b5852738f76080c3b3514898910eb4d6a94b6a615feac3d1820b26db3b9bed312b0d690e8dae06fad408debbc6dd537a1
TLSH
T1AA417417BF801DC5C946E2E8DE8B418BE345C26B4388B8B1388D88DC9F1699CD3EEC15
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_github_net_redteam_tools_guids.yar

SHA256 11625b5d1b9d32e8a11af8e77785082270814ce6ed625235d30d05846037841d
MD5 07ae9ecfcdde00f21393fbc8ade0d9d8
SHA1 b7a1a7438e7178b82ff8eef57f7e6862a7df3cbc
SHA512 01f6f08f99dbd32615795b89a519d7522d9d2e55c187d1b3fd0f11910b565fd2d20d983594401b9e81a951c3dece7c4ab45d3841c83ff2d9be68363485b28405
SSDEEP 1536:e0lW+6ZXxZ7yW2VlOkjwG19q1d6qOuCfhmzA+:/72zyJTO8nyzA+
TLSH
T1682402A7BC3428E35F4E51C4CDDAA20EF225E817A9D485D4F9AEC2944F1043DC6E279B
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_github_net_redteam_tools_names.yar

SHA256 87c3a6a0c9c0b99ad17b3f34e1605b170646c3d47c5f5f6c882169755884b338
MD5 6f6283a938ea3a0c0a822e1b49d5bff5
SHA1 f74c60ee555da42e314250fb1b21f2988f26c551
SHA512 bf00be0cb466cd1f4695045a800a7926641970a9e95baa8bb8640c6cb6080c96811db95676bb270d154de9d256da44c6948bfc50793a7a08dddec66b9e2263f2
SSDEEP 96:Xbr/lrWxVECrrrgjrcrB5+Dr6JrqrErLHICyrrAeRrhrWyHe0x9ryPreiN0rIprk:+EzW5+63oC0bHeT3rBT9VPZbLxmRtd
TLSH
T100E23F5BBC642D934F4F61E09DE7620EB118B41B6EC44894BD6DC3A80F64D38C5F26AB
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_github_repo_compromise_myjino_ru.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_gobfuscate.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_google_anomaly.yar

SHA256 7d2fe82901ac9880aa9aaa0aa12efc5f9e74b7724f25924f4c9d96b76f405374
MD5 7f240779dac682c6b9ab2db02bca88c0
SHA1 885471750951695ac4fa1d60228e161c6b44e077
SHA512 553a9a438599b457e1b0cea8733884dd21c5433d5aae1d04ac2fa0c30170ace55f22e35037d60376683797d717c011118041af29d5e4cd3c8734861192816430
TLSH
T178019C0B593898A1646D3E692471080A55627553A6CECCC3350D1FE80F768E4C6E9562
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_gpp_cpassword.yar

SHA256 c9aecf6fb5ab4b1b1e85ff4c0735d283ab1eaa1472f1d7a7cb8a40abd0e96b17
MD5 1737701c45af36a341a5f218d8b24815
SHA1 c885d54fb08e10e724f6e49f2b16de571a4af445
SHA512 3a02153672ac2ae3021ead24105cf484c7802fe1879356b02353483f463e887729aaee4ed94984c6e9b8bb8b6b9b1b072c7a0b6e250f24d39f56d6cfd85ed15a
TLSH
T11601B1223D802C560AC9E0E59F52A30BB722904BB24194A97A5E83CC5F63935D2F5633
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_hawkeye.yar

SHA256 999213b6d7d4a5b5daf27b29d6907ee3bd41f8eb4f290d9e884c5b3f2d49e9f9
MD5 803715f54015bb0f31e7d7409e40cf21
SHA1 55979b930576bb60a5175d683f9224bed2b48602
SHA512 83779681f165c23476802bfb97f3244b8943bef4019e34a5e6c4a3b881bc705f8271abbedcea565eee0acdd1e5675094ccd4c756ff75935dbd54ee6a4824d388
TLSH
T1FBF0C0671B51BB85084C8182BE73D3067116950772851893B4EF50DC4FC6AF7C3F5D49
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_hktl_koh_tokenstealer.yar

SHA256 03ad55ab8f84444402621c106db00dbcbe22d88b1f4f4eb0ff1160e929f4c763
MD5 89c014751650309a47e512f61760b817
SHA1 6de9292c86e4c9fb9b7e4ee0c62a6f1c08130b0e
SHA512 f32945979f558fc591b3aebbce35459d3fd88a17be34d661163e7921d4468d076d2ee261bd8e1f2ffe44deefd70064ea29060e884cb510029eaa5b0000963252
TLSH
T19301FE613C9093BDB19800C8974A1906700CE14BE6B46ABDB88D44ED6F10C71A2F59F3
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_hktl_roothelper.yar

SHA256 96b691dd89602d600d27fe2150d3443b08b37a419b062201ee2058c37d6ef43f
MD5 fd465ad031de91ec7381f1f41c6b0806
SHA1 e72c420f88a799268a8b76555731ec3e5a9cd4c1
SHA512 c1f4565a013336d85c76b62c5147727be2b276497b77d804e325b59015cd28dc0c88d2fd7d8e8d8000be76c8d24f45a113072940086c1d568ba0829bceb0ffcf
TLSH
T124415E1ED99A605EC02225BCAECAA84F325C149303D8988A94DF1FFCB186DB015FD992
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_hktl_venom_lib.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_hta_anomalies.yar

SHA256 1797d3bdd540b4e80e50327e347022bedf6694d4248501eafc2ca123ef574b31
MD5 ef1d986da11b74f2da6f979409a95efc
SHA1 279bbbd2318a7840823ecb187c1962b447b657a0
SHA512 979b16b14a62198940b1b1dbf160c022b1133822dd146cdcdac39ed9e0a415ffba2c3ac77e324d434ad9933531893c387eef74f07fc691e7ecb450be20c0aa1c
TLSH
T1740110029E11398A9B8EE08196679116F136604F978644FAF54D51E92F6337BC2DF232
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_hunting_susp_rar.yar

SHA256 e86d7489e40ea4de78e2558cb1603e31e9f6a9af9ae1eea3b510305fbc2e3738
MD5 ad25e9cb6d0120b4ad597d4f549e1a77
SHA1 ec193b3d5661a8b57eee986a96c16503e4b54738
SHA512 72f03f840021c72f32a5e0fc81bab558d95172938193588d698f00dece1df3f2237421114352ce2371e619274477026fb3f4203bf1c2719c2448fbedd0ff0794
TLSH
T12811080F559029822C8943D79BB23531D112B1EB6ACD91607C5E9E9C2F89B6C8DA43F7
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_icon_anomalies.yar

SHA256 d8ab82494ed861a5115be0f53df4d81ad110dc4c95f1aae5d9e4c7df6b2a90e6
MD5 868663bbb205b7e043871f1031faeb7e
SHA1 2a8b2e467461a1fbe96511219a8d4e3ea9d86fe5
SHA512 d77e35220194b16c4efc8e5e6a7175c73a4dc61054b444e47576eb14ea2e3d1cab51f11dfb18804a5424ec7103988effeee5a66f38cb69257e229cb1ae462437
TLSH
T12F61900A6F23D99D04347F3F2A407504A931ED576A8344F7B94F6B76DF8493240B8A1E
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_impacket_tools.yar

SHA256 5added72a0cc1e4ee4e748c7e977c8a3c08ac78be0b2e956c5409fc7684b1b07
MD5 c4389d0336d7c60ea2429f1d22e6deb4
SHA1 9e778d8a3f9640632ba07631af8a2bb192f24617
SHA512 1a49c7ac82b3f501bae6003f1802d643ad8032c5e9dcc2cc118e7f09de8b17f625ad608dc09c06916a5d753c3d6b66de765d32d78675e4b713f70b98da32a253
SSDEEP 384:Rujb1UEM4JraU49R2U2YcjcylFoefptHmW6GPSCBp1S3V54m:Rk1UEM4BaU49R2/Ywc8Fo6ptHmW6GPS1
TLSH
T18A8220179E4018DB8D9E70C8DEBA910BB1176A6BB3D99471B54E0CEC1F1207EC3EB921
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_imphash_detection.yar

SHA256 784ab0cf265014475075708a5236a1a0764c2a7f4ed7c3561acde7c65bf5893f
MD5 3d06dd1847c3b5a5c2b366229ac0e4df
SHA1 3d320792d2ad315dbf20c512f4b0553c95b9f3fb
SHA512 53b52b1fc1886341fce968910506512fb47417756c0e7bf18961625efe6d2a7b3eff9f709fd4011183c9cae58b12bf30002d0cd4c75fdd11a3eb0d4fc2535381
SSDEEP 192:BiZ4jEi7VTj9d4Ip1/GwYTJDuHSSR7JRadWwK7:cajEoZj9d4Ip1/5YTJCySRFwdve
TLSH
T17502DEF6D28138EC4A49A563CD25216C0396CE27D35E0094782C59AD0FA7FE4AEE7CF1
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_invoke_mimikatz.yar

SHA256 03e4100abcc558ba6a2f08a71b6532aac1ad86302efa4f2603199083de07eedf
MD5 b3f92d041364be009e9aff91c8615db7
SHA1 939d1a77281c83dd688fe3d678d1357fd3f884f4
SHA512 e63b03ca32d148c8b0c6cae5f5b17ffb3058095f68f19fd8097d7fc8f282098a344ab59064c7610804183abfc1fbcaf04d9cf4ac6f99496d17ea3c27692039e8
TLSH
T1A711CE366E483803DFD7F0ACDE818302ED28B04B5A589DAE91DE4928094277A12DE223
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_invoke_psimage.yar

SHA256 644f33a5f6cafbb34986488bf30e12d3bd974ba56cdc0fbcce1d52b18cab6f94
MD5 218c941e0ba20500b2e1ac2f60020d0e
SHA1 f469587af00832c5f60259eb0c89921f829e730e
SHA512 66d9f8ba314c302292304ce3a4d53f26d5c377cdb10aec3bafef1c46288c6277fc9ec16a0cd867986c6a7d212c624527dc541161382c5085ff30098c074c3501
TLSH
T1A2210D2028172EE4C53A37DC9625B08A523244033BD54FDB706C33A0EF62838E3DA205
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_invoke_thehash.yar

SHA256 99ad47b7e348d532fd7470f6fca0cba9fc53cbc7dfb4d3efe96c3fb8915cbc7a
MD5 df604adb6035647d224affaa04bbd091
SHA1 7c9194925a560620e39fbd8f8b50aa7d64550538
SHA512 2a57a9eee0c2787f4ee3fefa1bc3096b1d3fa6e1eed0b088e2becd6c86bf67b7733fdcf886220980b6a057a4a154ad5f94b9f1b65a310bea39e74a1c21c7f0d2
SSDEEP 48:k2afOTvDTM6V6cxhbTvDTM6C5g6IXL4qeclnT8hTM6ftmu98vaTM6I0JqHwp4+6l:jvvj6mfvveE8qegTC9fOw+0Ji+6l
TLSH
T120917522BF0416C746C6E1858667A00BE31798975A8CA8D4F01E59E85F437FDC3EF025
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_javascript_powershell.yar

SHA256 eccdaa17aa3ae7a228387253ffb360d5e7c6629f393f75e902d492e8c8d677d0
MD5 b86ad58e04f313c226d6b427ac3f3105
SHA1 38554967a208861072c144d707a57b896e2c2d06
SHA512 51dc13cee88a0016f6fd1a932b8fd132ed1a5098a71aab86d118fdda8feac722249b8abbc2a7ab7f42652bf07e9bd7d991a2cef3aff504aa981c296c752ecb3d
TLSH
T175F047332F701DD74D4EB0DC8E42C0197919754BD9594591765F066C2F1B8A4C3E5178
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_kerberoast.yar

SHA256 206b0ed8c7d4e48b3a3fce43e1b40c5c34613ceba65861f87feeb25a73a81206
MD5 38d3b1010fb10b8f753db9ef30c15fd6
SHA1 59ebaf5213e7cd65990ae0ec1c65d064ca5f4a45
SHA512 82e954d00dac8b56e3915d402ba106e9bbdb442d4eb6d66910ee454f3ad806e803568259a55ffd44c96881d3e246530bb8442b14a33c21c746e7cba674900743
TLSH
T19E517267DE406D5B8E4A20D9CE63C803B73C61C7A74C82BE53EBCA5E768C26B42E5015
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_khepri.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_kirbi_mimkatz.yar

SHA256 7d6000ad4d3e78ec1e58352e83eaf0b934f666930c05c04fee9f38667d7bdbd1
MD5 c4320f6c1b5ba3ee3e7a6278ed1862f3
SHA1 059a53850b86fcfde97d307f585b5439016c2d8f
SHA512 67730ee88643d10270cae9829f319f3729514e09c8b51237809d67c7c37ff04d37bd39c5857d2a07fef1e66530e8eb87b69e40ee132ed523c7d70a926b8d1ac9
TLSH
T182018B109CC13295C847E86C8FF5E385F0A1710F325428DA79CEE274DF22A2169BF150
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_lnx_malware_indicators.yar

SHA256 09b915860e82e373b501cb874699d74e42f04eb4c72a73edf85fdb01b02d3eb1
MD5 eb344f96058adb0104918031105d5676
SHA1 c04df9923e439b7c783cf14b0d9d76f55814c441
SHA512 c2219af27e2b69b222794382bdfb3fd0e80d44f6cbeafc9e586522ee674faef029c30c815e58960365ddd080644caade2a9ae384dded82500a857e47c965958f
TLSH
T1FD11E1267EF0A5EA859B51FC49829E4F6011A28753443121BE5D17CC1F058B8D3E7D69
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_loaders.yar

SHA256 17d6988816f294a3ff7d3afb8cb374ad04371b3f67b10eebbe73818c873811aa
MD5 7d9754350d7ba02ac1f06c672904f00c
SHA1 b6d1382160e0e8034b50e0f7247fea187164d1fc
SHA512 71ff8f51e7bf35d17bc8a26dd39a45bf725113bb8c8250de031023cc346e446f6c549859fbcfdd3213e265a0ff88d59a9aa48511fe134caff5f4dd4326f4bd89
SSDEEP 96:4uiO2R1GiqS1f7o7Q8Q10X/192VE1yWJTXIwJ:4Siqkzc2PWJTIwJ
TLSH
T1BBB1721BFE103AD24ACFD0D8E953888BE512D48B93C5A4D5786E449C0F0E9B4C6EE937
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_macro_ShellExecute_action.yar

SHA256 c1eba4861b25852040da78c6128358b3b3dc821c4e2b63b904752615262441d6
MD5 4a36f52b7bad12910bc3ef3b74215714
SHA1 b18749f303e3227c31b2752fd380942e00823791
SHA512 8c46ca2bb5a100059a09d5f9e3a8f2ef8ea5b59c2d90a226edb6a9d3bc0c90a147e593c998cd35f90195f4b4d392ff7e8de05634abb16b1d9410593754407b4e
TLSH
T17C31B7ABEB1476C9899DA76D954520176074203B927DC828F1EC41C86FEDD71C4F6220
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_macro_builders.yar

SHA256 e051c100d0c820249994aa8eb5b0c08ca96aa34c85f8e972ba33aceedbcd1f70
MD5 de0c5374e21f8e542eead457cb130602
SHA1 25218d44cc44b3c1f89dd46881171c205ebf95fa
SHA512 37c0705b1ade942252a96cc575912dfc0537a43eefde6169315e838d7c601314451adc7c5af83dd6a647501277503b29ef18b08b95d9eb5b6df183b23e096d19
TLSH
T1E2F04C169BC425EBCD8C4CC1B9F3C459B41160DBA20220D87C8C65C50F359F4C9A6F6E
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_macro_staroffice_suspicious.yar

SHA256 b7eab94e484c6bcc8775ad1f894272da67f5d330a147296f4ecdda137822f606
MD5 ba31cd3ae9186acc63d379198d35b248
SHA1 8c0287c6db4d71598209ea96ef6f69a57122cb1b
SHA512 535db57f2da179ab42c68da6cbb5e2a313d80eb09addeac9efe7af619d3caa4ae62b7c4388557ac3f9a86e319d2e66c3e8ce2e84240cb1f6754e8bea411e39b1
TLSH
T15A3195426FB048C7415C832E286B85693112345B5B4E4C99B38EB1C41F1BAB4F5DFC73
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_mal_3cx_compromise_mar23.yar

SHA256 0bcfd59c215dcddcf9a328123455d9f5d4f4f6310ed3a88939ecb85dbb2cbb71
MD5 0f576fcaf41eb3b1bfcd109a2869e1ec
SHA1 06249d362ae588141152c66f76133055ff0cbe5f
SHA512 88d82178329f4640704146d0b9e9e3c80b6b61b2c203d325821b2786543ac86070ad815a77fbab88d7569dafc4bc682f6540a693802af9879c25741331232c38
TLSH
T1D951B907DB1035E5985D43589DF3E083F110A61BB0DA08D0B68E53D02F13979E6F9272
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_mal_backnet.yar

SHA256 c42b56db87ec6bf3ea9c44a071bf4aa49788c1fe7fe261dd2397fddedaa751e8
MD5 289fddeafbe452ada944c2bfd3f3a1fe
SHA1 bd603d58db798749acdc88b1947a489cd7a25eda
SHA512 e29ee66fcf476c60f5ae9b6d2afdbe4856e471eaa590406bbb3df79979e447313407e247a5a25eb734f71af3e549a40989aee9eedbe3a1f1b9e3727246a18ad8
TLSH
T19001FD0AFC40128AB9AD408AB52BE50771079483628884283C0D649D4F01B72C7F53F1
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_mal_link.yar

SHA256 3271d22e543e595ed3de9ee8a92b87cd5973f26f31587f44d13ea0dc133dc73a
MD5 a4f30625aade94373adcc222dbd1c9f6
SHA1 4338b66c5f965e30c6dc614926f42415cef1e628
SHA512 dcec9f4d15ce2b89e22b1f88aba365e59ab9c0b9ee5574278eeb72c8ad9478b2df71904e8838beb70bbda0d5ecdc4907c3a8086258205aa8494f70c293580e96
TLSH
T11C1161273C4878A9A84A39D471E21909A138B54B12CCCCE3354C80D42F1243CD1F3631
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_mal_scripts.yar

SHA256 005453335167461d2d0eb8b902e1c0b5bf57943b0db4aa7e575a51166d178376
MD5 1751ead97c379826961ba647520a808a
SHA1 8499855037f5500a70bd0b11e99da8f69a1be8b9
SHA512 0d64f75fb72f1c3eb01767fd3f5a83b32b5ae36d7c0fe29edd5b6f1296b1813560dc3a5790aee9667a0f77d23af96122d5394e05c9bc2301cc4a0a628f231188
TLSH
T1FF8185137E502EEB0F4F30E8AEE3820BB1266407668998A9BD5D41DC1F1297DC3F6535
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_maldoc.yar

SHA256 7d01133da8d308d08386176948eb15a3225170d374490873517f73b5e39008b7
MD5 27aee7a87e5607c915933d8c3c1e8cdf
SHA1 4a3f7ce4d3efe9dc68c1944d949b8a8c173a7732
SHA512 f6f09ffe599a48bd2febc87e641ee47ac6f21bf9e9d59629fcf31098f5280887166d52f3caef76cdaca1eb013a362f7efb40a9268053bb3f6c1e3fbbbdc4c036
TLSH
T13AF0E1565E061CF1271C024FC51B5317F203141BA5B44065F4AF415CAF72D69C6F67A6
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_malware_MacOS_plist_suspicious.yar

SHA256 c57c5dc295619566960d62bcb1eb26ec82be3bf794faa6930e4b2a6a42c754cf
MD5 fbcdc101115fc29ae0235724db32407b
SHA1 73235aca5bf6a573175b72b00e216efc620d9aa9
SHA512 76b192f1bb308768aee44271c35c7d0ea64f218df5f7214a5a9aac817e7a41558b8eb7d61eb09a031dcf8ab95dbd7c6da6c6b68e1f45a2fc1c5d842dd21b8b9b
TLSH
T12B618416FF64A4C94E2CE2ECA286186E654422CFC62614D0BCCF23D51F06901F5F3D38
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_malware_set_qa.yar

SHA256 7cef70c27871665eebc1da59e91f38d7124ac38d112a8c810a23c58360faf452
MD5 5cf86143400f1598b579af174aac4139
SHA1 90ee2f891575d3660de1d97527f0bc7aae9048c6
SHA512 c892aa31ea13e949cedce79b7081c5ea9a03f63b5a8c6c5ef2023d70ebac77f0fb2279a0be2f89bd385cbb6f88f41ebab3668cedd165ec741d4865dbe14409f0
TLSH
T123D022C2FEA42009A083F070A280808BF10230BD8714F6BB49952A22600AE53219C230
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_merlin_agent.yar

SHA256 8f3db2354cf3f6ca7e5c5a20a96fdd5b8bae7c4f90261c4401c4c1e83813a25a
MD5 cb56da4f197d67773d47d2d41c155e3a
SHA1 42f4bac00c25a83096cb0e80b75cc3ed3e51f68c
SHA512 0bf9719f0f6334e5fdfa95879fe58388afabedd55c895e6ec23c08c610e79ac729296f91bb26a9cc5b176824335365281cd7eba573d29f4f895332b185018795
TLSH
T11D1112CA08022D7F0285160DB3C15546653501C38379BFAF08FE65DFB144F2042E77A8
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_metasploit_loader_rsmudge.yar

SHA256 9442524f94ab3ee59ecec194985e8d4dababf821afaf91f3a96eb87c8466a0af
MD5 78c77bfb344c5e0defb9a55ce9a98678
SHA1 5ea7ff961177e5569946d59b80d209f555f9d841
SHA512 d62f3e306a053bdcb0059a3bb39e4dfa7f8a35fd8585e309a60123ecddf7a494c117a0e7ade60326817f6b26b275970cf7c8f29cf4896c4c4250bce1b6545495
TLSH
T15E115012AF507C8A4D86F2CCEE86C587E12920DBD7A9C4BB80E5846C318A6B690DC092
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_metasploit_payloads.yar

SHA256 58dde2fb4843d46b5bc9c5555ca0221310dcf0aaf3611669fc9bf8a02d68a4ce
MD5 3e4d3179963ca1e989a12e95f70b88a1
SHA1 946d16393396cf3eb51b0890ccd4cea04bb04b93
SHA512 47f21975e2fb2c90f86733df1b553d95432fc21f32ba800f6e70222be3a29c35187144d88f1a068ff97fce4fdd460dfab3e77fa6c65a8cc4eb9e50b2c98aebe5
SSDEEP 192:8ids9gz3LQyVXPs8Md6IbuF03Y6iZhfJnu4DbUYYe:8idvbQe/JILo68fJfUYH
TLSH
T1A852B6127E402DDB4D4E90D89ED7D147E226B04BA788B0B4B95E49EC5F0B4BCC3FA0A5
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_mimikatz.yar

SHA256 bdafd19f621f71ac0b0b2cd7ab4b8b6b32307db412a9a6d502be205ce4f337dc
MD5 1ab4f1735300acb3b443f57c5ba09699
SHA1 3f8d48e72a6eb2e2d2fabfd9d4440854a1da2218
SHA512 47d2bb2be160f4d2f4afd3f310921d369be38b52ef01787d8d471c68672b5e5d9a4116e967409d703fc84314bd0c7978be5283073afbee61409784764115adf1
SSDEEP 96:jUwEjnG+osKRTWtBr598Xbcs2l/9bjW2VHLfpi5wiG1:whehYBrT2bcX3LRiX2
TLSH
T1EBA16026BD8060A3C10BA09CDFA7A18B3262650766C04D94795F73E8DF16A72C3FA656
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_mimikittenz.yar

SHA256 a180fa2db98245faa2c2413e5de76836401a10f8cd0c560c89a23a8c8a2bdf7d
MD5 a1705476a540f180a849e6eed9d94a8c
SHA1 95f605cb6e32adfaff2f9b8f7e1ff768ea1cdd05
SHA512 b6f0611c230d3cc888e78f3745174580c55226e88026ae2237ea9e408091f1e729cf960f63ef544c1841efa6cb56f41b91c4a945e74604b81b6234f311309071
TLSH
T19CC092016C04640DB087F2A0E7A00316F00621AF5B24A93B469609262A02B07499C221
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_mimipenguin.yar

SHA256 660eb71be42dfbb43eb696479db9b2cacd64c936e05d0fb3d6e7a05495486793
MD5 1394cc84fa80066841c675fe7c924f75
SHA1 c64547942ab73ea89084a17080035d10c883b5ca
SHA512 23ee536955277ccd2ea09ff2c87f91ec0fb7965e18bfec5837ef6fd4e731657a94790638c7b93e340b2a0d0af2cdce105cf69122068a0ea8205f1372a1d27c82
TLSH
T1EA512107AE6058E54E0FF0D89A934207E72551DB77A27494B95D0C9D0F6317EC3EF822
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_net_xorstrings.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_nighthawk_c2.yar

SHA256 8442598052f6fb285a1c7ab58ee94f038f56e1e765709c382ea751b2f4681e5d
MD5 cb35fdde470687011252b86676d576d2
SHA1 2cae2bc39603add14d27b0e505bf6e9e117e4fd5
SHA512 7200abfdc6e42c50c7df2ac6bb310bde3ea45aba63078973bdf1c442f2b5395ac50b34316ac52e9d125d2111dd592cf1f3dc1c6f23a3bd08030cb003c1d82fc3
TLSH
T110210169FE22B80C515B3D9E0FB27444A1A35413AA6849D3F0F892FC65DED209A7A943
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_nimpackt.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_nopowershell.yar

SHA256 a4f565f0fa950240d1351df4802d0014cc53db2f8d034ec906d0fa4963354f40
MD5 022756a890fa2258766ec490ffc1a5ff
SHA1 b26aa9dd37fe412283ab994198f416c816ec0bbe
SHA512 a2ccbe293c12b6d5948e26f35370f3895bd9835dc376cd14c42218685a6abbcbcd8a9a755f7c16ac4bd144e34af40841c6a8d33802d0079dc6d3986a2da9f5e7
TLSH
T1C1B0125068E9842370023388D344C124D824257FC31C49B1AB854906708B92E919C124
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_nvidia_leaked_cert.yar

SHA256 22e681210c87e501ee114d02499f5cb2f566725279723d15765e22d639b03c7c
MD5 69bbd18abd009214b8d6af54bf7f0732
SHA1 b5fd71b32aaa8de7e8fb4b876770fb2465b387b2
SHA512 43e971d3e98a358af628baa3cc8d625ab0d424e4767d7ec7aa31fe41394423b708312bfbe2aaf418cc0951b616b94b696c7ddaeb02dc45dfd4190474b2ab3907
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_onenote_phish.yar

SHA256 1553e71f855c801b2420751117a6b25bdd49fbd926c79a733b2e0b7cc1785fbb
MD5 aa9b0645ce0d69ec6daed52aa69051d8
SHA1 93743b9846b282677c924d782696216276f452b7
SHA512 0dd667d8e478f6074a6aec548b5eeb3e78a7649a3c5d9a2f8a4228e737a3ea4e92715fbd5745131a4a3680a2f78b7ce2aeecee9db4f9398827163b0e2c8ce1eb
SSDEEP 48:OerfvysM6jYtPYornlV1WjilGGG7FoMNNVgneeKzM6jFbzGhOXJRa6eXErUI4itb:9ys1Y1DrnFW25Gzvz1VcNImsPr
TLSH
T186B1632A3AA763568D0C3C696E31204D5115C20F9211D9D3399E42F82F9DE3FE2F70AB
MD5 SHA1 SHA512 SSDEEP TLSH

polyglot

rules/community/signature-base/yara__gen_osx_backdoor_bella.yar

SHA256 5b81051b1dd3bc13aee6950dc491c7b000506e214643813c29be8d6fa259efa7
MD5 2b9a0eeb1aedbe7dfbf341814b6705ec
SHA1 773d919098e7be8d0057e8fc34c97afab6bbeab2
SHA512 2cc8d5d224433ea0987b36c53d6cdb04f4c179e70e917f2e9dccea511b17a0942befdfa77c12358d05607ff786f0b4b62bce3f2975a614d1ba755b903b356067
TLSH
T17A319CA3FFB041D9885F91E19DE999873A45119733D26DE0720C19DC9F028ECE2EAE44
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_osx_evilosx.yar

SHA256 9619326c04632047a37e8e1b437efc0f34d7cdd2919f119b7396a4a64fe46129
MD5 07a02677ab4c6d4a2d957c934e58190a
SHA1 e40f997a98eafe4e28704ee92019fdc4d119ebae
SHA512 9d7075af12128b53ff231b961f19da17c4a9f9978e265449d207267932466190bd85a0ceb05b15aa0c2ecd1f6112d513eaf7944223305f5700ee619adc6c3b48
TLSH
T1CA2183177FB0A0C84B4EB0A092FE8547320E298BA32474B5740D07E80F25D70D7AB919
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_osx_pyagent_persistence.yar

SHA256 1f2a26ccc89587cb01998ef1d38edb11a73cd6bee4e9f569ec9c3518f051537e
MD5 7624559fe3944b60605e384c63b184a6
SHA1 7b58dc444c5ccaa6a0dbfeb0b5d24af0742862ce
SHA512 c60851935c1d37ca8dbcd8c94b9ba581d881afec69c83eda52dff2892c3fc9911cedb98f2f7d7d54be491a6307dd87ccbcac53d43483f1c4a837a8a2df86ff2e
TLSH
T12F314102AFB4A5E0CBDBB1D50BD4CE671200940B97A35910B70D11EA6F82991E72FE6D
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_p0wnshell.yar

SHA256 8db8907f21fce67b54e74ac992c9af71d7c8d2c04a46da522950d6521346807d
MD5 9725ba3eff70e212b0a53cd64f034745
SHA1 d3ea5bdb0ecaeef6816ec7c0edff0270c7f01f67
SHA512 04cf45e0292e34489d0c93c041c703fe9485b4dff3d822dbbc897da19638794ae4dc416a326dc07d045bddc0c95dd10fa04b70c7b7e196acd1e819332e14c879
SSDEEP 192:OzxNSfKv1LsUeaOilggENMrBzSt8YLVwTd2YLs+f7w:OzHSw9BOiu5YtSheTPLs+Dw
TLSH
T19A026236AE8014D64A4FE0CCEDA6A147EA0E988F56895C44BD0E14DC4F139F9D3FF552
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_phish_attachments.yar

SHA256 6fb48f2b60803ba753223c23e519d310553c42184afa6ba730525268e2deedc8
MD5 3877fb772988ae7750211b21d7ef19d5
SHA1 6cf317fd916f9e87a0855436fd3eb87525d30876
SHA512 3dd4f4e200e0eefc153b40382076ec1cf20be753a79e1790b7e63a3e5b51d549b2ef58c8e158f63d4666eb2719131b33373132b45a009df08319885935386cc8
SSDEEP 96:fO1IBHFff+3z1RvnIeI1rSsO9N2KExigt7eeZMdk5yzsQhRs0E8GXAimdwf:fvB1f+3vIeI1usOPkHetbYQARSwf
TLSH
T135A14C217E027FC640AE929F692A6A04368B1287E3DE3CD0764D28CEDF57150F5EB934
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_pirpi.yar

SHA256 66b3972493daf565e31f8507b5ce28ac92327941ee1583527154d3339dd21fb0
MD5 3669a25414607bf27e643eb5d79b7ff2
SHA1 52b21b886784bb14411ef27db30290997277e124
SHA512 88eef12cca885d56bc385139a22c0603526786fe1f783d7da1f2c452d4017aa9ba717980d3084a7919e5ea48d6c8a96e4cdffd82186e053c0e844420cdb1d9ff
TLSH
T1B5511027EF40749E8A4BE6E8EE86C58BF32D10D763D885AE41858C6CBB445EE41FC610
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_powerkatz.yar

SHA256 ff45c3fb00c189928c4375f607e195a2366dcfe106a1dd9b88b3ab814fcc9f7e
MD5 a5d7933f0ca687746641284d24167eda
SHA1 8789bfdd3aeebe8149fef0cf6bdea69636979a61
SHA512 0c5e72a463c1554e0fd591706d31c332ae5bdad247142f314f17adcb1c469fa5e50dfc71250046afa385d142d5ee7841ba9b40c7b6ad5707b8df769d046f8e51
TLSH
T1ECA012C19900140DB04230D4E3D40612500A31FA43589E2227851C262011903065C110
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_powershdll.yar

SHA256 75646831ce0f91a96260f3f1aadc95e598e88bad53327c301c3051c423005327
MD5 8e71d0ebafa94b0fc45dd9fa00a52549
SHA1 5bef2cac797dd32b231813249b763a73bd43a592
SHA512 dfc27ac6c890237df6e80ff326a8cdabcae0c3df5ec41ac0e08fca1592481158930b915ff817541aaab7d0d3f56f01916b3ef1af930fce128edeb7ad185e0221
TLSH
T11F112323AD3416844A1B61CCD8A7838FF12950DB175E89D4770E5CA01F13552E2DEF2D
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_powershell_empire.yar

SHA256 f61acb6662af18d3365cb753bfe627ca7c7e1f59a2a574c7b7b843691ebd5867
MD5 97ebde26544996678cdb111e80aeee74
SHA1 ab8b4e2e413a565fdef884116109c55d909be2ea
SHA512 c84a7983b0d76e915eeac436fbded9810985fb8b621c6b470b908993dcee70730beb3bd14b61ef34571560a165ea884732f8562a35b4824b86d491bbc9ba5013
TLSH
T174C02B90C1A0104DA04230BCD3200131E00021ECC3208A67778D182E3104A1304DC02C
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_powershell_invocation.yar

SHA256 cd4ee3ad4781995a9818ae5064482f354fff697ffea9251c370570ab0ca8c38a
MD5 e00f1b08a86210bb53433f66b6762015
SHA1 4328ce4610aa8f2990b7c3f1b1db1aec091ea96f
SHA512 d0dbc6a3f7d3b4d9622be7c2eb90cbb9570f1fb989b48ad409d057ca8ab866a2aaf8821912ed88fa614c181b67951cbda43a6c6c8a0104350265b1fb844fa5d0
TLSH
T1945148BA7DE24641948F45FE6B5746AD300A21C713C01A413C2D93C56F89A3EC2EAFE2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_powershell_obfuscation.yar

SHA256 360eefb4da3779223efaafccb07b12823760112ac9bfe1bac23a9ad36b55862f
MD5 2f311f12bc7f9b7bdc605ea67ee2c8c3
SHA1 6573a12ae88faf8fe24602b3d03022caf2028803
SHA512 f29d1c1af50536d05b77b5e938deb5182dfc187900dc88cdd81de212807c3b7fb24c8ab07e8d479d8dbec63d596ff24692265e39176009d054f5b04c9e16fd02
TLSH
T1003140B36F6868994A4FC0CC4AA3D10BF01A640F93D9A9E2724E05D84F16DB7C3EF105
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_powershell_suite.yar

SHA256 09e01c823ef9b94434b25894e0749577166d2f1d9edfe19d03126ac021260a75
MD5 b775258e3c31e75d5db2e8e39a92007c
SHA1 3d9c865132ed4288104cbc6ef501bd8f78f413d8
SHA512 d19662c8c07a9e7cd26587afe68cd1362ab17d027fb07a04693736653883d9fbbe4de124469e665d03fbb7fc46b7203559887dc11f18e565bf2761c9749b9b5e
TLSH
T1D4717423BFA02EF2484D52CD1E55455BB213000BC24A3995B47F89CC9F1699DE3FAE29
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_powershell_susp.yar

SHA256 18f2c99b7213595b9a6cb28ae9993367957df0aae73664dd4d9f2008601d943a
MD5 168b6dd9da40f10b3b4e135af6724596
SHA1 26aec751da4d53290a812e2ddbec35a6623ef9dc
SHA512 a9f24cad3189c5fc9f3d7235c2e7bbe9f89ea70a4ccfec6cf1d2eee3f46f8f70bb6134c0f53bd1680c112ca71fc06722ca17cf009e69a1e73d62d5c90eb4c745
SSDEEP 96:HW4Df56QgyxoeaKGk2K5e10QzQR3m1Z1P1Bl1e09M93x1bMESzsD1vPWht6jtMrb:2IMGxQg5eqbUXO1DbZ2GO7VrkZ2IEV
TLSH
T1EC32950B7E700A99884FD0F96B53AE0AF115404FA39444A0BD3E8ED81F159B6D1FF725
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_powershell_toolkit.yar

SHA256 ffea99c398c1f5fd003d944aae60b68d41a4746852706a98257a7d2207bd4105
MD5 dff93909df308080e45ecd541b9662d5
SHA1 70a023b48d42595eff14c9064997dfb6ad996fed
SHA512 237dadf6d883fe8d592da68da70f016fa75f0be0e17ed045c7e34f97e9777a8fec10d43d5304ff41459a69389159fa23dbd74c1bfbff39ada8e9b42cf926415a
TLSH
T17AD02B10FC04004CA04BF0B4D3800042E041315CC32CDE1E134268293012B4F205C314
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_powersploit_dropper.yar

SHA256 cef8de29a755fc5b51ccbee8ad568bde33ad70aeeaf0164f89b1c6190c95f08d
MD5 b18e3f4930ecb2c6ad80ad20eb80a585
SHA1 8483b7c37e5b2e9dec2bf30bb6f457e5eed558c6
SHA512 0096bad8b62009066e910acaa76a0a2bf58817ef01b3e14e52ff186e2ac4faf66c780b92e7cfa53fc14d3dfdd0fc23d674e1ea9618f73efb9d995c174033199f
TLSH
T1D101FE203C30E472804E6379A54AF6197666E75B01C969F3FCAD02EC1F41DB4C0EA3BA
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_ps1_shellcode.yar

SHA256 f0b2f53a50a8cd79d283ba029cd6de1cef107c499e7cce6853f41a06d57185d6
MD5 f12150e0c0bfaba551b9082de1a616dd
SHA1 3d73e76fdcb5d66d47bfd30eef4120a88b8baaff
SHA512 e2bffffffd65983edebfac18df6b8a5a60973f33d83dbe3e6b12ed9c7e7380eaadaad3b7e0ad14a2614ff202b99ec236791eed47a92feaf60446d7732cbcf429
TLSH
T1CDF0A3229F04398D457DA19A58BAE14FFC1D640B454414B1FD5E0B980F23D90F2F3761
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_ps_empire_eval.yar

SHA256 edeec2460b6da457d55192c00a0cc904531f868f26c38b36b75cadf0b2ace73a
MD5 bb7c0be690b2ecb62f371b79fe3ca402
SHA1 6870a92960f0d72b50c4d6818d603f9728adcb7c
SHA512 139a137ab7aeb9a3835fbce7d93f9bcd1f220919ab2098e7862ff43cb411ffac919b595d19c0025e7720400b478927096ee98329aefe9c9870699bb71bcbeafb
TLSH
T16131F03B6D5436DB0E4EE08CD463510AE121515FE3AC8A9075AE08A81F07A26C1FD235
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_ps_osiris.yar

SHA256 b44f67eafc4bc9643111f6c04b22c6a6d7081737bd36f320a043e5bfac885d78
MD5 20199c84cd3ba6b68486ca9c0f517b85
SHA1 a336846e75e5ca08cf5893c8620db13212197f5d
SHA512 d8dc2e7a4b54d48ecb5ceabe05b4027fb55a9e2527b766c5f928e9526056c0e3fc33d98ba4a9e29503588078fd576ca7dc5eff900d3704a64e6d4f531939af9b
TLSH
T185C012016E60501CF193E1E5E3B04133DA4250AD0B947F2F92C518F57F07B5B9A9D214
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_pua.yar

SHA256 14690c2069f08a444875dac97da85dcdd4424a377102bf94a7f8678e78132254
MD5 93407dfaed1bed6dca7bef9dd98661e8
SHA1 c4e4d9eb03dd17c6e0f4e5b8d4676ca2877197c7
SHA512 267ba62854f17aa9c41bd9a6763899e8ee729810710ddc8771f07cba03aad36b44c9bdcf941ecfc506d27a2dfec1e8e0d1c04382fb27f44cc1c3ba55a7c9ea20
TLSH
T147112D279E102CDB0E1D12856CA3842A374250D7FAEA1090F85E8C9ACF065B9E3E9834
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_pupy_rat.yar

SHA256 2e41be33b023d591f297d1740591ec377f0718c296bf1c844b56fcba708cf83d
MD5 c5012e69f986e57d268081de2546b534
SHA1 a2a73d54ae53224fb2931867a139ab92cf2d18ff
SHA512 69f70fc2226c39dad605cc4445edfcb7c743786c1bb795b0106a495c14924962b8a9c61f4d9cdaec7f8c4b9788d0671144bc25d368b3153037fbdf8ab53e8033
TLSH
T1B941742FDE5060C08A8EF9D8D656845FE61308AF86C574D4F41E5D6D0F2A6AD83EF823
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_python_encoded_adware.yar

SHA256 29d3b5122b39951fdc68ec31fa3a6d778314ee6195e07bd7ba0a039de6c0a7a5
MD5 0b06b4a81bbcac0abb396cd438383e3a
SHA1 d13d6ac2d8138e1361383261a92407cd8416d8bd
SHA512 4dc2b5872c27558e0b74a31524cd705303a323277f215ec55af6e447565c6d4b4cde2386bbdfcc8f0c248e13bf383380cbdc60418b85fd2124b2c22fc50f7653
TLSH
T1D001DD93BE1428DE284EC056452B700C256C116B636711A17C8D13DC0F63B75D6F6075
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_python_pty_shell.yar

SHA256 089d34f2cec574a86a886947eb6f2682e0a09565612ccaab5e366be06c9116b4
MD5 fd59b0de74e2a9c82f842d43eed65bf3
SHA1 610ec15dbc101924e3f2cd8a76a24ba31415d8bd
SHA512 95291f8a102339a11aba51febcca2526a3a891e021275c116de33aec6f7e540566c8b92a406fae0d048ba6c752546c19dee02923cf8a37ea0b789e91701bc9a3
TLSH
T19901CB52AEE011CA662E40CC881B814775225847178864B0B76E44E8AF23FBCC1F2F7E
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_python_pyminifier_encoded_payload.yar

SHA256 e0d4d211425e73939304070569d470cf749cb61ea0ddbc3705a13025fd7341f4
MD5 95a9c4a69a2ba2e6bc6788a1fa571c8b
SHA1 a514cfffd8b12bdd915a32597506ea528404012d
SHA512 efaabc1bd39656284c400c882583b68a7844e0c0ee7488441ecd90b3ea0fab3cf2da24aec59f652df0a41c55fda8429b9d371aaca26b517787b971a17e7900c1
TLSH
T1322181C38B926ADE6E4D8F44C83A6488202AA12F876605A8305C0FC80F039F1F8E3536
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_python_reverse_shell.yara

SHA256 e31e100bbcf061575f416331e956fc574713ac1414a0e6b44740e705053b1f46
MD5 c94ab6e357352d4ea764cff53b3ee386
SHA1 d1789331c787da84c64929efee0a3b3dbe9c6631
SHA512 29ab9e8188fa8ef079bba50fdd3e178d1dd8e8b4f04545572714b7aa55a63209203a5f374117f4256110a61bf3aaf7e6cd534481ad44a00fc584d429a080bb99
TLSH
T15931653A6EA190CF4A4FA259809B618B332D115FD3A178D4B64E23E81F11E7CE3A0964
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_qakbot_uninstaller.yar

SHA256 e574f8a03bdab5594e11e5f5fcf2ac4abdedc5628ea572ca95a19c0a0c973a4b
MD5 4f0e28a545ed4b57cc719397aa2e9bc3
SHA1 0d28b77a2d03638ef92d8b489ab76852d908fab7
SHA512 b578f9843312e9693ff23b88aba267bf7581f0b31f953ce216f8717ee54b99f19487f50595c57705c726935fd27d23a98ea4967b7cc27cc6efb5b1272fa44591
TLSH
T16F310243686C2190892D234F4BA5B48AA2316647B1D60CE2F9DD97ECCF6A874CFF7851
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_rar_exfil.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_rats_malwareconfig.yar

SHA256 504fc7263759d9e740d17736962b587bbebc4d5747a1f52fc337459bcf0abe93
MD5 963447b80a5eb325497277544e9d1114
SHA1 f3d282a9fd4222c53bdb5d045361a4cfdc7dacfe
SHA512 37819dbf7cb4e1bbe5f29eba1f487271e4359dde56588937be0e4ca1abe0fca2a845d5494ee3121259f2ab5700c0405b29e2528ea2bb23c2f012f39f9623e8c7
SSDEEP 384:VoGCsnZ4cfhfTrjhQlVaqs2DsV9zzoovnyDpeSz+:WGCoScfh3jqlVk9zzvyD4v
TLSH
T11BB2821D26387D190C8DA82EDF98984675745183012E94DEC8EF9CBE308E963EFF5B42
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_recon_indicators.yar

SHA256 baeb6cedf0e9e6410b404b796f3149f2543907adba07c93be7daa71a0f43c9c8
MD5 df1064d62a8dfdbd22d28a5a1eaca9f3
SHA1 908d01739b2efc3e7150fda369ccaff68767dfbd
SHA512 b9e0eea2dd72829b05d13a7cab1609503d64a8d9fa794150b62f06217674fe65f8e290bd89835745d74339993987f5b0c6f2c386567c75e1da89b924e37a975d
TLSH
T121512F523FD02A9A8649D0FB9F26431AE003C01B439575A8B47C55DCAF4156DC3FDDB1
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_redmimicry.yar

SHA256 e3c0ad9dce76d4ca981323e42cb92d6d625f1086f80f9fd6d3bb0c204f553f2f
MD5 b3dfa3b21044064e4123939a376cb824
SHA1 3b44108619f4c0ed72f0f055b5dd284a80d624f5
SHA512 459dcaabbdb80d9e75eb45a814f583a07af486227f9a8d3f2c556d42fc016fca7e8469ad46af2b3d5777d1b401fc933d0cb8f4ee3c4dd747c4959601439ab4e0
TLSH
T1D451EF976DAC95E3C66AC1850872BA4721363007D2D2BE91778C42EC0F058ACD2FB91F
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_redsails.yar

SHA256 7f5d6d15990c61ca6dba4fbc7b617a3fb5c3d8fa1414a0cab574374f1edec3e4
MD5 e028b96a81c6fb47df2d172b11e9d897
SHA1 0e8f3b8466cc2f5d17c9bcb84ba9744fb5a8b27c
SHA512 bce5544821b0739d53e0fc4730a75aef38d143245f984813bfc5915d9487672c4a4183c35552d74bbd9888ae1db83539a1a5499a2dece818bce84d9363a8ed0f
TLSH
T14A31EF13BE8025E55A0EF0C8D953915FF31540BBE795A899B01E61DC2F168BAD3EF212
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_regsrv32_issue.yar

SHA256 a1823955d01a1bfa23597ab776583f06cab6917577d0644eef6f0e13d6715d3e
MD5 8f38cbba8769b9c87b3f93001e45e0f2
SHA1 57a94d3d77a6b127bceb06f11110374e175be0a2
SHA512 75f5310226b1945726aec35ffa3fb0cdf733ef1c127b933eb69c894033e85c8d1723249698ee3da9e89ed17a7b7a07b343fcb21863a845a75f73810ce69394a5
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_remote_potato0.yar

SHA256 3b8b535a6b478b36693840d7f597c1ad30dbbccc6736c9ccc1d4f86203ab672f
MD5 2205a6767c822d966a0ad959976994d9
SHA1 f5eef5e64c4629bf762815dc8e42e1f3227dc432
SHA512 3ccdb5db4fbb6c5fce41762247582aebd5de4e23c5f9e011c28324291a1aefea85afb52b85901532e239df2740fd4f9a49d05e066aff00ebab796b6e17cefcbd
TLSH
T1F501C0114EA02610C8CE40B2DB71B75E3476317F32D81D2E782DC9C90F516ACC5F29D2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_rottenpotato.yar

SHA256 ef397517f24974243aa869b6910c94ac4d83a97722bf845255ae86780c7b2b60
MD5 c56561d831bdce29e019694148a7dba7
SHA1 e60e6a4a00e951bc20250906f0ee0979d3e66f73
SHA512 e5cf81bcee6ee09b90ab52c46f140b4f064dceedcb89f50dd342ffc07907d9842e5e91adedec029fb0d8f0208ed4721ec3c8c1ab5fd1f5cb4f74592d08539c43
TLSH
T186C09205AE545118E452E2D8A3A49212EA04509E0B517D6A528969B12A43B8B854D210
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_rtf_malver_objects.yar

SHA256 c0c147cf3d300651cd82476f22c4de0bf46ed1482c5596661684289b60fb4f66
MD5 e70a06885bbab027b73aecde82541c2a
SHA1 15537f0c945f8b7059fbed520dc416189abe149b
SHA512 b753d560289637a17506736c5efe23efe381e7e4402d41e3d055545d2364c8b60d6d2909e161df2c6d872c4cc136cc958e2e482ffebc5b6b2aad30c0ea1bd0f0
TLSH
T15651A8032E401FDA5EDA15901E916B88E54D501E36427C447CAFD3C89F7743DD6FB842
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_sfx_with_microsoft_copyright.yar

SHA256 b7fc8ead82df83c00ab8804f38c110fa1836b19512c3637f6d831a25f1745d89
MD5 40e754e4aeaa9f8b105b58a850158756
SHA1 acfdc641b85e89ecff232fd0f1b1637617c386d5
SHA512 b9ef52fc4105eaa1b2e55a77b6eb015dd536fecc6d5424feb6e5d94905d1c76e32be555e3ef770d5b73327b159bc8159f6eee1a956e2674ac50724d5cb17b208
TLSH
T1B641BD057E6878C1B0283FCAF8315847616D6EA77589CCE3750CEAEC1F2E998D692061
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_sharpcat.yar

SHA256 b1df29aa0856a33efb1a5fcc00fbb079e83d274840265406d119de1ee9bd38f2
MD5 4558044dbbaa06b487bb7be11371ffdc
SHA1 1ba01260940b8dd250770634a5601eee7b9f28e4
SHA512 4e3e24dea4fcb78056aa02cefcde1512ffa749d26baea70d1f6c11fd53494b55a078e8550ae518b2c680e1b206ec6c7720139323c4c2616147c84d259f8d15b7
TLSH
T1040165179F44784F5EEE20DCEE838A0BD221319FAB5593578BC238EC30492575AF4052
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_shikataganai.yar

SHA256 359c41ec2548e924ddff27a7b773e4cde54c1923ed220469db9ccde113871866
MD5 6802c3a0e4e63812df7b9c65056938c6
SHA1 dac9ebadac0028c6499d63bc53a327741a8c1a8d
SHA512 0ec96f298e24f2da8439001a8559e7af3c14d19ab4de3609f283f58e1f64a1312c49e583a400a9294da6723c07afd636ba2738a3bbbf5c9ca1306e8ff5b5527a
TLSH
T19451B75968EA2D17A24B9D8F0FF4119FA59FC6132B833DB778EE50B0074984D798BE01
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_sign_anomalies.yar

SHA256 436a80379cd1003b449146443e821763002c8ba78ffb33730651610c53cf46b9
MD5 11d19120e3d34a5ac7b0f6f34cf9c969
SHA1 0e4ae58d2ec173c83545cfeb188a4ff5989ef8a8
SHA512 d4f2ac47412c2644aa60031d2557d5fab6b08ce1dd646e12e146c2dcd31ccf0b1e681b6018339235104f5546cfaf987fa2e100c3f6a867f442e60f7bc4bc1d36
SSDEEP 384:E1gO7xAgNae5ViHJI832o8xhmNKgQ8acIu1G:E+O9FIyiG832HhWvUB
TLSH
T11672D6C1E70827CE691C2F9589B20848132D191FAB9F94FA305CBE860FA3925B5F7C75
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_solarwinds_credential_stealer.yar

SHA256 2d46045e2613cad56bd6a83b138197aa47860c18f1ec0ebe0a6030471c56132a
MD5 e566f0854b9e0907e7468e04845d0cf2
SHA1 1912fc991a0fc4a2df3d725ff6212e26e8e181d6
SHA512 842d2975a5fe478664b10d12ab5f0fdc20c8d4692f9dfc357f64fe2c221d3033838acd342aa34ee6f6bf3820b2b0ec9ea9c3b2e10aed55a8af1676937805c4fa
TLSH
T1FF31ED07BD901A81968F22FBB54221D62428A4074BD80B5B7DBEC68E1F4066AC4F33A2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_bat2exe.yar

SHA256 69d3189ba55d30787501916c54672f3e3778e71f988ca5190e8fa924a7a71a4b
MD5 353ceb56d1a7baa9d0053c565317787a
SHA1 83d9c6054cddb83fbe7958f2a776908fc98c3984
SHA512 0884fdb8431b65bbff97a704eb5f4c7e59fe449615570908c01484dfa29b18af9208a6c1415ab9b0b1ad500563498e02539b795f24bd43e4b3defd2873563de7
TLSH
T120219E26FE601DCE79CA90D8AE17914FB247408FA3D461E0F85D598C1F124AE92E1B72
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_bat_aux.yar

SHA256 e6b08c582c6d146b30aa9384daeef1f5c45ed77f3d7ba33f2df2919a7d652745
MD5 b7c0fa98d18704ebc700601f586e9cee
SHA1 2bb50595eb39212e78a1d3ea8abadeb17e70a653
SHA512 af748921effbe2fbcd6ba47e3a09d59dd1afce785487bd366e4dd49e44b8d71dc22b8c494c3d5414e44feb8d26f5e3ec9f9b5f275e887e19bf7bdfb2846c542b
TLSH
T15E0120123F826692AC1D40AD092646008193358F6BD538277C0D88CC2FA28B8C3F6B76
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_cmd_var_expansion.yar

SHA256 fe40c35efa29cbc7e47509b882b3395f8230fff3e8fcdf53e0641d116aa6b8d0
MD5 d15866b78b37c9c932125d3e90b7edf6
SHA1 d65b81f72d42e44bf13ee069af8e26e83c5f6c4b
SHA512 29441c584e85dd08dbe4de4bb41ed4adc7a7d462509f9d1e4a4d9396e3b4b0f3c1ba62956121344aa1f719a2fa94222dc48321237a1839c6d48035b2c8ca3c47
TLSH
T106F0D44B576018E2CC9D50849451D50E7011342B73408475B48E0ADC0F145BACFF75D1
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_hacktool.yar

SHA256 97f497f17c2c356d879e0638ae65402cae95df7a7b903f60c1943f250d2c44b9
MD5 07e04991b460d3bea71a4be3411e2bf6
SHA1 fe722183827771c0942b5239e984b0fae9537a8d
SHA512 688e7cb3da7ed046594d122de48cf3f1c24dbf05c8f903424449417043c43f997f6c19c3f065bad271efeb88b2c0df2f68125cd26c737b4cc7480130bfc06656
TLSH
T1E121B803FF5015C2468D63DAD496811AB2365CA78BCF4150B40E45780FA683CC3F772A
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_indicators.yar

SHA256 572628fcbab8430a352ad69376b9f6e3e07f06318658e91a6d274bf416555199
MD5 0402fbb4d82a61f8787acb686c4442c7
SHA1 27bc8bc7462990ca488b2ee0a62dc7250a61cb30
SHA512 d37e2e57e648c71cfa723ff533e9d6aa1aa2f529bfdc08f8737ead062e070d18cc125519bf0759b176681c3879fd08d0268932db8aab1a6342037268ebab1ee9
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_susp_js_obfuscatorio.yar

SHA256 7984f1fc7fc340791e133e66c4e72abb6f4ff9b814d514aebec6590c3f26adaf
MD5 785327500bd1a2f1b2240909f2467adf
SHA1 665575f5ba83741a060be3170258ba07d043cc8a
SHA512 7b5ec42f44de7db4d89239d118e1708deede504466e9493f0884cb8c80326e494d36e0e7d68853e3aa590afb1ad9656e4503dd98f590e3c7dda21a776ea02f64
TLSH
T1D011358D7A2EF9AB4002716C481755B4233DF92BC7EC70D1544E8C381DD476882FD759
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_lnk.yar

SHA256 12963718410adeffb531c9a516812333cefde9516f3f39ec088b225ebecb065f
MD5 6af21738495f1e86ee636bb7540cea7c
SHA1 7dc1410c063006a7d0edde1f14d35b2b23f16245
SHA512 1e6aa7c35f1d5197ebac8f74c19891cbe4dbdc4c6ce20bac0a68a896b7f0020f76003e8a618265d5651e0368006d8ef2598ec40668deac032b49fce04bb73744
TLSH
T18CE0F1234E212CC1649C40814D12A60EE4417E47B3C84984341C0BC81F418B2D6EB1DD
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_lnk_files.yar

SHA256 1ac2357774fe5bfaad5085e2383ae40348c1e860c846bde686696cbfca6cfbe2
MD5 9d0a10418c382f91bd4cc5071c5572e7
SHA1 c463a87949bffd05c80b9e3e32978def477265ec
SHA512 c8d8c302de36cfd42eed31e39edef5946c7f6856b248eb22811c77ec70f96d19bdb339f3be0bd36c39f23b53a0f179ba686df7c97f003a91535de053a0c8d733
TLSH
T1FF4140767DA023D9850F80D7BE06592F7D1CB44F62C088A1BC6E47E42F50A76C1F67A1
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_net_msil.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_susp_obfuscation.yar

SHA256 85a86c9364987d291248494978c55bd3884cc004ebd1e4be2a9950d9095d21d3
MD5 f4671644b36c42a98e12574f74a8ba48
SHA1 b714121dca18f9b8ebe5492f243c96d22f62af9a
SHA512 f30bea055a5401f12c991895c0e2a870a81a8cd26b15d469c9630a015df46b45c5e419dec394ca2eaeac23c1cf3ae84b578e1c6dbf1c37ca43ad41faa57ef364
TLSH
T13C31230A3E613995D48F9448BB53AE0EF15E658F818445173E6F13E40F21E72C6F3B54
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_office_dropper.yar

SHA256 2178cf2bacad723fc2c6090c80bed399aa2cdfdcf087b7a2a02296d40be41240
MD5 2987b06f17fb736e80d8f3bc5f63666d
SHA1 a8a37f897e35957d474fadc729994fe96d6d5396
SHA512 0657bc57da17f9beb326428f0638b51012f2788f9da028d1a94a71a1443b04c25cf45f03c14b9ac95cd60dc2750792b89f8e961dab208c7c3490f55d5e5988ac
SSDEEP 96:jc1Jw1tfMP71SbeBkVU11YOX7XpFPYq9nSXo:xQVk2Tgq9S4
TLSH
T1E7914223BF1125DA854D9491ADB7D00F71012A9B62857873B54D09FC1F12DF8CBF79A2
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_susp_ps_jab.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_susp_sfx.yar

SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_susp_strings_in_ole.yar

SHA256 5dba3dd17b39fba7a060dda7b4521a7a4f2d8ce1637e1e75c3bc70ff77287409
MD5 eae413c43c39055c1b03e199cb751113
SHA1 4f0de548710f173c359f588000fe8ab8dd2dcc64
SHA512 eb595318ab75c5d455c8094fa713a1c6297524e74e192497015b3ac1d1a8caad5023809f58c841c2bebef382c771a6632a283f45ba0a8a55993e8657292df90b
TLSH
T1832116017ED15DC7C60D70257BB2B708B229B00F56D079C4BD6C8ACD1F2263585F10A0
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_svg_js_phish_mar25.yar

SHA256 bb1cfa9b34f24dc6ae7b5273e294e68e6b893ea259862aeb75c71e63d16873d2
MD5 d089c6d00affad1c85a0ccf167c86ea1
SHA1 048c5796d4364498411340e3d8c8536f9163bfab
SHA512 7a953d56e554877e277f3a056c732f4a99857d6a122254452bbf8dc8c0dae1bff1b1f5088bb68c1f73394f85ffb70a64652b4ba7c2ce1c9b7affd8c47ca6d3a4
TLSH
T1A03195EEEE80B8C9885E41851472C84172556A4F974E84F6744C7DC85F03972B8F3C75
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_wer_files.yar

SHA256 abbd869bf777ace5937f54063959c4082d3f1d18213110deaa0f05ffefd3c3e8
MD5 e2a90f9514a690afeba094d41cabbb4b
SHA1 f0d65d2d62c976171ee141f772049c0f1e4a02b3
SHA512 d119e426470e9f194938d7505e9afeb10de1feadb4fb8fb946a0665a4edbaf3c8632eaef3658068ea0493e4d2d8642ba11c72116c6193e0f95b73c2eac43bb61
TLSH
T17041004D3A40C2CA1A4E475672A3D4652015B52F5FC586AD3E0D46DE1F50AB7C2FA3E2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_susp_xor.yar

SHA256 f74f98644bab860042e6381399f10ab3da6cfbaed8724ac69f42b8223b79e282
MD5 a2f14fd6c5f6631b7bf6b1c042edb7eb
SHA1 816d8b931e50cb0d35b2c04d1461ee183ee415b5
SHA512 386a262cc21242f26fd492ca05bfd49e7cd0277a4eae195782df860c1708221e3c3d8da97538a8ac5887f818cd98e3a38a1ebe70fd33a3ffd7364271c0fc405d
TLSH
T1FE31A9067ED0548A874BC9DC76469D4E721AA14F43C07645BD4C64DC2F416B2E2F7BB2
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_suspicious_InPage_dropper.yar

SHA256 66a7da05254973d3ffbedf98cdaf94a65bedc9a9941790b54b2d0315dd984e7b
MD5 c5b4b593c0ead2de17e4480485e12cf7
SHA1 373dc1d788662a5653329e86ac65bc0434cd23d2
SHA512 a7ef04272bd6ae88b5c5fa5a00e5200cbc24c6e8b1a16d0cef61f51ff24a0220ef10640cc4a319190768d808f21f38dd37fe8a0d87e471ed95c3e566a63bfab7
TLSH
T1931127777524218D055943CC64B2A445B1746E9B718B94A0B51D65C07F0E455E0AFC37
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_suspicious_strings.yar

SHA256 03302a474cd4b8436c6476e02940b8539a2bcc960df0ce84003bca4374bd943c
MD5 2193d4b794acc4b467872df569282c20
SHA1 da6d7315fea0a66ad42c53b9b082f9805e8fad7d
SHA512 0ef184e1e438ee4aa75786f84b23c1399d1e3a2fa05cd26c41cf4abe3663f81ac32654a678cd47594c0e710458fb9249ef8b4a219f439dbac2c33e13e653387c
SSDEEP 192:qt+6udA1TQcQK/KA1siP14ibJZzgYC07a7r8pH/Pj3huu:qtkARsA1sq1ZbJB9E7raH/dX
TLSH
T1F34293133F102DD74D9E50D8D9A3950BB017A54FA2C4A8A5F85E45CC0F26CBAC3FA762
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_sysinternals_anomaly.yar

SHA256 d3c7837159d2266afdcb145fe65248a6a76efbbe110db66b7461539b693a6875
MD5 caf46c334f8d1b155954463c81ee0ebc
SHA1 3a5e19f73d784a5c4c7041464cd19f1c047ccb7e
SHA512 e8f2dfee59bdd69c6563ab578260167d16db7aa5dae31456614a461a73988070af983711adb1b6f77fd1043813178df49a6ff906b45674833f31a3d320690a0a
TLSH
T13F11AF2B7F01188FB88DE165FAC39807D514A0A7D340C669BC0D59992F46A7AD1FD364
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_tempracer.yar

SHA256 2fe4eaf1f8e74910e6c3c57b08760b40171f95a2cf69b98f53a6497c9e5db7cc
MD5 df6fac84713dfcf692ddb5de1c8a58bc
SHA1 95926156d01242f9bf388deb56796803fa5c1237
SHA512 f128f786d679b781cef48d5e62291e3e45bcbe0f62273acadb1332f3e022090cb5b821b1dde5eea7d0aa8c75dc458149812a8690a09d15119c937f25c1158474
TLSH
T1DA11140BBD503E4D4746E39CEAA54527E02920CE93DE802F4165D96C210473703FD355
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_thumbs_cloaking.yar

SHA256 a1823955d01a1bfa23597ab776583f06cab6917577d0644eef6f0e13d6715d3e
MD5 8f38cbba8769b9c87b3f93001e45e0f2
SHA1 57a94d3d77a6b127bceb06f11110374e175be0a2
SHA512 75f5310226b1945726aec35ffa3fb0cdf733ef1c127b933eb69c894033e85c8d1723249698ee3da9e89ed17a7b7a07b343fcb21863a845a75f73810ce69394a5
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_transformed_strings.yar

SHA256 02472f988ca22dba3de84f815192e910ea6b25227b5b2629597a1a60f364df1d
MD5 224c14bb682feb787a907930422cbe26
SHA1 5359c86d0933a57866d2738828a1c0329c3aefc9
SHA512 5007cef2220da6d5eb4674c1fc33527d22b6d1b96fa51107b0b4760fdd124f98008f5ccaaca124dbf04a12900c35119b5fff17530585596554a7cc9d873d10b6
TLSH
T113317A27EF9510C0C24AE7E4EC9EC5C7F25D49D393E898E9B5104D6EB2064EE02EDA60
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_tscookie_rat.yar

SHA256 3f68a3d1fb5eee49a3ab7721d0b601c3b808f5a72ed27e9ef889a43b15268e04
MD5 4b57361f3e298506b6164cb3967cdd6a
SHA1 3207de250cdb76ccec91753ec0aeaf84c169af30
SHA512 67e0844f91eb4ebb76d08718a7941420a46ff736bd669d1d5675695bc3b556a306128944a071e7bffaa9f8e48d811e7850b671952aef6b1dc55d049c5b470a53
TLSH
T10B21321B7F940894CA4BF3D94761C143E282508B67D655AFB44C0DE86F23B6A93EE711
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_unicorn_obfuscated_powershell.yar

SHA256 92e3aba0208cdabfe96dfbfc4f26c463e292d7785163d0ed78634740f24ef494
MD5 9ddebad74c90d94fd6673250f7f137fa
SHA1 eacf91bacca207e5fab24e7cb0c5345bccc2dc67
SHA512 9db08c8bac1d402b6193d764883d9c2bf995751640c05921519be1a1d9ef120184a9c9468d3e3f5708380dde348ef7dfbf5671a4bc19e729d82099d283cd2aed
TLSH
T1ED11E113FA0578DF9749B1D508B19014A0814B9FA1E808D5768D27D92F12E7C9CE77A4
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_unsigned_thor.yar

SHA256 22e681210c87e501ee114d02499f5cb2f566725279723d15765e22d639b03c7c
MD5 69bbd18abd009214b8d6af54bf7f0732
SHA1 b5fd71b32aaa8de7e8fb4b876770fb2465b387b2
SHA512 43e971d3e98a358af628baa3cc8d625ab0d424e4767d7ec7aa31fe41394423b708312bfbe2aaf418cc0951b616b94b696c7ddaeb02dc45dfd4190474b2ab3907
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_unspecified_malware.yar

SHA256 ea532772d9e77004d3a898e94c8ca45f2c360f852a9c14c6baa99fe103fe9ee6
MD5 00f168f43e2ab4fdf7312f389b640184
SHA1 dd8c3dd0b4822c563a94d4bd897c46f785f56e19
SHA512 2ba59f61925c785ca5948f0790f23f77669d26269fb6427d11ee2b8defe1a7aae8c5381d333a385e1691a227ab49ab1d504c915cdb7f5809deac5d8b52919262
TLSH
T17321006BFEE044C11A4B62DEEA6ED1873311418B53C95460794E09DC6F125BDC7FB860
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_url_persitence.yar

SHA256 3411ebf63c00143cc6af45f468b0819b34808ff0ba3587d1357974acd957468f
MD5 8b93b842879edc97a6e73ad69b1023c9
SHA1 c8833c402141666f8cd33c9b4c6e3530e9520628
SHA512 6bc54bf9ec9bd57342db7cc9c837dd0b8a86f24e2a14ce344a35f3d474e193239b2885ac04138838a07585c2ebbf775100eb2135058d51d5a68bce7e3a2c42d4
SSDEEP 192:QHxn8H6M95HhizzUkH9woBH/8fHipoHjaaoioXhzdLd42iUZVbb69UHJE4935H+E:QRn8tzBiHUkdzBf8fCyDaPiox02ic696
TLSH
T1FF42114FDF425CA3E9EDE2046462B953E655392B74CB5E05B8215EC81F08D10D8FB36B
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_url_to_local_exe.yar

SHA256 e9a311b2c514294aaf31723e56a731c1aa0ec67cc25f2253b38699785c40334c
MD5 dfcb8360010af98aba1479e5f9660e9b
SHA1 3a75856e97e77f0683c4c87f01ecfee921d59353
SHA512 c6f1ab287e32e701c1618d73b5bf85405531bd3f6dd58760f07ec86c4d6f4b245566a0c75b6b63b374a65c131d0531963c9b6e1672032f0aa7b7aa49dc27ae1f
TLSH
T131F041472E043AB78E4F90A41A13C14B7523500F329D88D5FC1D8E9C2F0957AC3E6276
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_vcruntime140_dll_sideloading.yar

SHA256 7c2624fa8b06883d567635cd90887351f2939ebdc5de555b90ca8d45db59830e
MD5 ea70314e7cbbd6ef8de72b77da8ed445
SHA1 b667ecd10494ab7b4c05f9cc5b356b9695749b3b
SHA512 fc5f2c09ee533f9286dc9e4af0e3b2949da9d51c9a2d13eb9af6b0f9d37ace3b656fd1c7d319f52c64e34bd9ac2a6a83683061c7fa0273e179b2bb66a6b68a94
MD5 SHA1 SHA512

rules/community/signature-base/yara__gen_vhd_anomaly.yar

SHA256 0ad34d1bd51f1a7e6019463affd95c3ae89b3b8083f2500a602c1ca83077b2bd
MD5 0a77554415bd10b017e8c21e9a1358d3
SHA1 2aab37dacdba721c00a64300872465fa79947906
SHA512 34c86ed71f1e1ea2e7b5a080b6fad4f812eb0ba85591c179fe219aaf636b8eefc54e0cb699d61e0499632900354d5ba1f287df18136badf9efe9bde3ff157e4b
TLSH
T11011CC263F1128C75C3A73E9EC726A5CB172012F0B424C8B358D31BC1FA6834E6D642B
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_webshell_csharp.yar

SHA256 caa53f6a4d6174d118912b36f6cbf6abecf2fa4f6d376899ab46a00454487e9d
MD5 7e3cfcd923e915819a6c7ed2dc00e5da
SHA1 5cf169e08fdba153735f5aef7a9b1fd2d1baf71b
SHA512 6739d7493817c19f2c3c8683e3d13998511125de6d097a0921bfd6b068e180b0282dffa84491074ae3839ff1fbc6ae80090cdf506446f5103c863917a78b4a71
TLSH
T1F711CE937E9459A44E8B52E5FD9E4600D22C009143F996F2EAAF54E448A681762FAE40
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_webshells.yar

SHA256 f1e77a2454d573d4c897dfc958c04b31ee5be886b3b4455d9ad69ebb7090ac68
MD5 a5a33658c90ecff10dcd01d2f97deed6
SHA1 8a4be28c29aac7806334c38fe484d94380580635
SHA512 1a49d61689056bf0dfaf121faa4be8018f6cc7503c4c55f512ec642dddb012dcdc417fec86639e581325f9a8a570eef28c7aea18b909f391dc595c36f76b432b
SSDEEP 768:g+JQLzfI73ivIdz4LpuBz2qE4LYL+OBzXMgQE20qpm20vVy9207D8E4NkPoQr20e:ezA3P0q70w807D830q40o0p
TLSH
T180A332367EC088E5494612E59FB8A6E21912104B5384B9563DAF56CCEF04CFEC7F2BD2
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_webshells_ext_vars.yar

SHA256 0c9305c3b911161c3649aefcd778f81f1501acfad8ee02bc342e91bcd3fedf1b
MD5 7aa2d33b7eee829969cc06ba6dab6f4e
SHA1 3e402e94743148bf886ec8126da115acc5c99562
SHA512 3dcaf55d11061b4aa4ec5c579e4cccd20aaff67e01effc11d726d790f61fb04e14798cd60ed3913cf1aa2c64f3fbd3249570a4e62b5cd6ad84dbde29e9b633c3
SSDEEP 48:T+Z0SapHmp5kjZ7OMv85DYQ8JLeyTqzhj3FcvxFoMxaz/SGS+ndon6FoIhc2bIW0:T7e5kjZ7OM5Tqzhj1cvxAeb+hOQrw
TLSH
T120818B2B4F9C844B188C2BD98FD154F7796C607992446AC6785EA084B709CFB49F6BC3
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_win_privesc.yar

SHA256 375d4d2962b34c03e98d4d33151403ff4433cbb9c6a44557c734540d15d152d8
MD5 b8eb407e65558003169c3ed19a015c04
SHA1 46ab6dfbfe1a3104749bd52d172fef3ca48d9a69
SHA512 30f30428820d6afb62a7603d2834506e1c785d6a1c80fa97f944a77ae241e5c3184ee9367a5dd08f65b89f1113a3cedb05317e0232ee77d56c6519c6540bb1e5
TLSH
T1F52186735E91780A064FF5ECE9C38503E17C20A5178D849BA2664C2C4060A932ADD011
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_winpayloads.yar

SHA256 8ae6f126c14f45b843c7311202436b778096b9570568e3d201e7ad83e7766dd0
MD5 f0387463e55f2bf7fcefa8b704c128ee
SHA1 9f51acc336ba38a39c84f96c87382475656439c0
SHA512 57555ad8e4dcb2a8580c658c07922fc1e65b40b73e751e71cd0888dc2e2b2d7c4fd6d1abbbddf362bdf2e53decd27e724d13f920e0e7fd8520c3de87557b1d15
TLSH
T17441532BAF2064D68E8EF08495E3850AE422255BBE965918705E5498CF1746CF3FF410
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_winshells.yar

SHA256 d2685da141d0ddf666db6704df2b2e72b72eb8a070aa0f4cce12fc6d2a5f5474
MD5 e4970d5e193fcec0dbb7846a7c9a210d
SHA1 f3b0e059061d6aba9ac916cc12f9254d7b753d30
SHA512 f1041a4f9817283ee6edf921c10b820ca562ce6a3023d78f4c7ce6db6411bf0da77edaacb328d2b96d4d93ad0b69aaf558444b906e8a7392a6f1c4bb359443fa
SSDEEP 96:bNsp4+PZN5//MoZxNy/pZ5O8WzbbuN3t4+PZa/rd1bNLSutMCNqi5N5moevo:bNkNKKNYDNV2bNLKCN4lo
TLSH
T10AB19317DF40246E4E4EE1DCFD67C553F12610ABA79C80AA766FC42CB7881EA80CD262
MD5 SHA1 SHA512 SSDEEP TLSH

rules/community/signature-base/yara__gen_wmi_implant.yar

SHA256 920b91a15d7e1dce78c56375ecea518649ae31ebe6ec4465f91c75a3444e8db7
MD5 82ccc02c52c8490b85cc6578fe2b6067
SHA1 1ef34d8c3b398123519582a577091b0d50b687e0
SHA512 a2d581d6f21e037672376a94589e7463f6caf89902617830d8d10742595edf1e56796b1d04eef4c2b5f0599c1a44fbb8d5b4159592b5ca6ced6f5644266a4fee
TLSH
T14C213212BFE45585444FE0D9FA518113E013949BA75878E6B51E15ECAF136EDC3EE011
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_xor_hunting.yar

SHA256 d7e42a77b37db514c6a7027826d2e83d627eda394010f5085236df0a5918359e
MD5 33d46cd0d5e04d59492469375e3d42a3
SHA1 291d41c58ba7346dc3523660ae2a173d233bf48a
SHA512 b4a9c38986489891096cd96eae26b25d1527a5c761b46a8280e780337e4da87e16252cb84c9562eced1e77d6250dfd8969a593234dd050e78c50733518042680
TLSH
T1924140077EB15489944B88D8F3A68D4B761A91A7D3C800847D2E0ACF2F20DB2D1FDBE1
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_xored_pe.yar

SHA256 3f72f78730662a2975f5965059d6064e78eaaa990a7bddf3a471b862927c11ea
MD5 0ade512a0b43d7f9dfadd8c54a76d3ad
SHA1 e726bc09c199dbbf06cd36efca178676a9949600
SHA512 bf9f6bb4937486f31cbac1a3183640b6a5daee9ed8ea655334f88eb92f412ef2f53795e8c982c017b58466db0570c76bcec9ad7c7f4f2362130fc1b4af5738ac
TLSH
T1D011238FCE200CF355DD51048C916185F3B2329F95C218C6B69EAE8C0F199B599F664C
MD5 SHA1 SHA512 TLSH

rules/community/signature-base/yara__gen_xtreme_rat.yar

SHA256 7284925149fb775b8a945c111baae420feb1cde91c6a1511bf0704edea61902f
MD5 6610a9de4b1212f17cc2e9ed0c574b92
SHA1 cb34a1695bd323d4307141fca944349fe6b05566
SHA512 9c8749012d4c355f564fe779e1064e070e260b0a7989e29acb3c7d173ffe590aea3ee1edfb64101ae06e0c712b4e28b30db13603f33cd5a6a352e5a51fdfa4fc
TLSH
T13761451BAD5029D7895EE094D953924BF202945BE7C48894B84E0EDC1F83AF9C7EE3A4
MD5 SHA1 SHA512 TLSH

rules/downloader_batch.yar

SHA256 5a0fe7bdf6891c49cc1d979c63f9494c30b4ca4dbd948babf85b8d2a482187d2
MD5 eac0d4b192160486c2204b26d39a4fd9
SHA1 ae34c3f8092511a473f8ec8e273cc6d20824f093
SHA512 c9317d4d932ab2f3ebc3e3792369c23cda27e22173699f3e189a94184ebe9d38a578e927f35136c2717efe7e3bd3a6d9d85bbf507767c348635da65af1b6e8da
TLSH
T179112F0F78088534958D93B5109A85EB390B62135A208FA7362FC5D87F6EA4CDAE35D3
MD5 SHA1 SHA512 TLSH

rules/manifest.json

SHA256 61605e49ebcd5fd9bb379864063aa1de1f1a692ec9b7adf3e9fa8fc6b6c32b04
MD5 21b2cc7d5d40f83cb31302425671c97f
SHA1 533c14f09114a8999991e156a30bb3fea49f442f
SHA512 50d46d2d3cf67c5a006e74bae68e32b397545cefdbf53cbbbdfbadb90e7ebbd26cdda117f9d041b39d7a4411a9fce8ca5926919fc7fbe796fa3197806547469f
SSDEEP 768:YBVt0AoEyov5lBTkug/QTLuurPF0kLXJGDWqr78Wq1A4SDfN4TUwiWjr8qIp1IRO:aQ7mubwKLJq1ee8qIDIbIQiJ
TLSH
T1C0F3DB24F0685EB76194711991120B8B1B1252874CB02B6D7B9CC6CF8F7DEAE39B5CBC
MD5 SHA1 SHA512 SSDEEP TLSH

rules/office_macro.yar

SHA256 082d60f7c71215941dde1826f73ce60f8d2421aa9afc73e11231c207f5b9580c
MD5 4b664ab6bd1bee24995d4ad51f4d29f8
SHA1 312405818b8e6524017d2488c5504ce811dcabec
SHA512 4b7e879aa551f5b9d21fe8b1ff4af8dccb84c6f9e0cf5e835adf7fdcd53c075abf44ef36976b640737a12df6402e73728dfde0cd65346e3c9c68bf1dbc7c4f45
TLSH
T1B0116B0AA9040C9359DE4BB405B7C0F71C11A45346646F43320FA1E46F1DB9DD0F39D6
MD5 SHA1 SHA512 TLSH

rules/packed_pe.yar

SHA256 617eb5b51f7091a5a4cfc387626ce351f99687798b531c112d0da69ad156b94b
MD5 e2791df1329f6696702774dc5fb2e325
SHA1 a90fb4e315a52da1f04db9775a1cf3b29b3ae1e0
SHA512 0304b8a0afcfaa4fcff1c601a865a5beb51eb27b9244b8210fa0a1e45b95c624780c72c00afd5f58e3b57930963ca5418e7f611c94ffef2621bfe2af380231c4
TLSH
T1E001BD6BE500519504EFC32E1CB7E9162B0BC16725544984B98F43E80F35974C2F32AA
MD5 SHA1 SHA512 TLSH

rules/powershell.yar

SHA256 975e86e027242cb335c76c60275e43523f0545fe5a7995074f1959c319fa142f
MD5 0f82c6e683ecf61d27de9bc7ae83bc35
SHA1 b750b4c1fd2da215d8a313a63fd34539cde99364
SHA512 c9629d4f362d43f2098e9f61ba83fe3621020166dc6cfb8f3da2d1c4507037c548b19115245919e95990125e4cb3379f383f0bcbe14a3e523ebaf219ae37c9f3
TLSH
T1AA11E73F5CA55400A58B83983A8368E95D4DA5D751580C937D7E96D50B01EBDD0F3FC4
MD5 SHA1 SHA512 TLSH

rules/ransomware.yar

SHA256 3ae4bbd73ec92cd2502553c5389481dc9e0a366b690f709ee9a03644a40fd1a8
MD5 2a25201baef16b9c7249e62c72ef5a93
SHA1 f9464b6b6fe012239c235e2aed79e6a710d3d1be
SHA512 ef53dddb4893f08235738e075b73f6ac247ebab09ada9727e44d085495ddf137d09e5469286b80eea6c0883988dd8cf74a09d99480118a5ebc5a5c5dc4e45920
TLSH
T19821261E3CA45418B58B52E53FA3E59E2909A1A7118446217D2E82C71F90F7DA1F2EC0
MD5 SHA1 SHA512 TLSH

Sharing

General

Malware Config

Signatures

File Explorer