/* This Yara ruleset is under the GNU-GPLv2 license (http://www.gnu.org/licenses/gpl-2.0.html) and open to any user or organization, as long as you use it under this license. */ rule ransomware : svpeng { meta: author = "Fernando Denis" reference = "https://koodous.com/" description = "Ransomware" in_the_wild = true strings: $a = {6e 64 20 79 6f 75 72 27 73 20 64 65 76 69 63 65 20 77 69 6c 6c 20 72 65 62 6f 6f 74 20 61 6e 64} $b = "ADD_DEVICE_ADMI" condition: $a and $b } rule Ransomware : banker { meta: author = "Fernando Denis" reference = "https://koodous.com/" description = "Ransomware Test 2" thread_level = 3 in_the_wild = true strings: $strings_a = "!2,.B99^GGD&R-" $strings_b = "22922222222222222222Q^SAAWA" $strings_c = "t2222222222229222Q^SAAWA" condition: any of ($strings_*) }