Signature Base unknown stable yara

MAL_RANSOM_LNX_macOS_LockBit_Apr23_1 [yara]

Detects LockBit ransomware samples for Linux and macOS

View Source

Detection Logic

( uint32be(0) == 0x7f454c46 or uint16(0) == 0xfeca or uint16(0) == 0xfacf or uint32(0) == 0xbebafeca )
      and ( 
         1 of ($x*)
         or 3 of them
      ) 
      or 2 of ($x*)
      or 5 of them

Field Validations

Loading…

Comments (0)

Loading comments...