daily pastebin goal
8%
SHARE
TWEET

Ryuk yara

James_inthe_box Dec 30th, 2018 308 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. rule Ryuk
  2. {
  3.     meta:
  4.         description = "Ryuk"
  5.         author = " James_inthe_box"
  6.         reference = "https://app.any.run/tasks/d9ae261d-4504-4c5f-a381-682be7272494"
  7.         date = "2018/12"
  8.         maltype = "Ransomware"
  9.  
  10.     strings:
  11.         $mz = { 4d 5a }
  12.         $string1 = ".RYK" wide
  13.         $string2 = "UNIQUE_ID_DO_NOT_REMOVE" wide
  14.         $string3 = "RyukReadMe.txt" wide
  15.         $string4 = "BTC wallet"
  16.         $string5 = "No system is safe"
  17.  
  18.     condition:
  19.         ($mz at 0) and (all of ($string*))
  20. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top