Ransom_Win64_Magniber_CR_MTB

YARA detection rule by roadwy

Ransom:Win64/Magniber.CR!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00

rule Ransom_Win64_Magniber_CR_MTB{
	meta:
		description = "Ransom:Win64/Magniber.CR!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 "
		
	strings :
		$a_01_0 = {48 ff c1 e9 50 ff ff ff 7a 5e 6f 0d 9b 8e 3e b7 2e 13 99 a2 c8 a2 da 45 86 5e eb 94 43 1a 5b 18 c8 1e 65 b3 5d df f7 db 56 8a d0 e9 40 ff ff ff 2f 36 90 06 e6 eb 05 bf 73 af 37 04 48 ff c6 e9 f8 fe ff ff d5 56 2c 56 a2 5e 21 ca 65 ed c6 d2 8a 86 ed 02 00 00 eb 15 ca d6 27 60 91 b5 0c 69 2a c7 dc 92 2c c4 f3 59 e9 49 fd ff ff 32 86 c0 02 00 00 e9 1f ff ff ff } 	condition:
		((#a_01_0  & 1)*1) >=1
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f10871d3-3e6b-45bf-b374-468a99bf8552

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion