nuclei-templates/file/malware/locky-malware.yaml

31 lines
762 B
YAML
Raw Normal View History

2023-08-01 11:37:58 +00:00
id: locky-malware
2023-03-05 16:58:03 +00:00
info:
2023-03-09 18:14:31 +00:00
name: Locky Malware - Detect
2023-03-05 16:58:03 +00:00
author: daffainfo
2023-08-01 09:54:35 +00:00
severity: info
2023-03-05 16:58:03 +00:00
reference: https://github.com/Yara-Rules/rules/blob/master/malware/RANSOM_Locky.yar
tags: malware,file
file:
- extensions:
- all
matchers-condition: or
matchers:
- type: binary
binary:
- "45b899f7f90faf45b88945b8"
- "2b0a0faf4df8894df8c745"
condition: and
- type: binary
binary:
- "2E006C006F0063006B00790000"
- "005F004C006F0063006B007900"
- "5F007200650063006F00760065"
- "0072005F0069006E0073007400"
- "720075006300740069006F006E"
- "0073002E0074007800740000"
- "536F6674776172655C4C6F636B7900"
condition: and