TRELLIX_ARC_Ransom_Black_Kingdom

YARA detection rule by McAfee ATR · GPL-2.0

Rule to detect Black Kingdom ransomware that is spread using the latest Exchange vulns

rule TRELLIX_ARC_Ransom_Black_Kingdom: RANSOMWARE FILE {
  meta:
    description    = "Rule to detect Black Kingdom ransomware that is spread using the latest Exchange vulns"
    author         = "McAfee ATR"
    id             = "c38e6dbf-7fb9-52f0-acd0-f824647b6041"
    date           = "2024-06-01"
    modified       = "2021-04-06"
    reference      = "https://github.com/advanced-threat-research/Yara-Rules/"
    source_url     = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/ransomware/ransom_BlackKingDom.yar#L3-L49"
    license_url    = "https://github.com/advanced-threat-research/Yara-Rules//blob/fc51a3fe3b450838614a5a5aa327c6bd8689cbb2/LICENSE"
    logic_hash     = "334e84a9469367ed64509203feb61b5f64d5a7e38d29ff5c5089631246b06588"
    score          = 50
    quality        = 68
    tags           = "RANSOMWARE, FILE"
    malware_type   = "ransomware"
    malware_family = "Ransomware:W32/BlackKingdom_March2021"
    actor_type     = "Cybercrime"
    actor_group    = "Unknown"

  strings:
    $0  = { 7D 3F 63 4F 62 7C 5E C4 D8 93 18 9F 17 31 F6 24 A6 AD 45 8C 3D 89 E9 CB 22 C6 9E C4 B4 B5 88 B1 A7 30 7D 89 63 EC 29 4C 5B 71 8C 3D 85 69 2B 8E B1 A7 30 73 2F 8E B1 6F 65 EA 5C EC 17 83 4A 66 5E }
    $1  = { 3E 77 4F 20 38 FD E7 73 77 25 3C D1 1B FE B6 FB 82 CF 6A 03 E1 B3 4E 13 4C 78 A2 CF DC 1B 7C D6 3A D1 67 EE 4E 78 A2 27 FE F6 94 EE 33 69 14 3D 1B 0E 84 CF 7C DA E7 C3 03 7C 26 3D D1 5B 97 9F }
    $2  = { 0C 67 4D 0A 24 27 CD DD 9B 68 21 3E C0 B4 A5 DF 94 B1 9D 39 BE C0 C5 62 34 6F C7 A1 D3 2C 0F A5 BC 9D 96 34 40 91 07 09 A2 36 53 60 65 0F 5A 90 96 85 91 22 20 EE C0 F8 15 7B 3E 2B 95 EA 2C E9 }
    $3  = { 7B 72 51 26 61 78 C5 2B A7 31 33 3F 9E 8A 1C 32 7A 23 9F B8 1B 90 1B AB 27 55 FC AF D8 A7 53 F4 79 91 51 6A 5C 98 A6 CA AC 9A 1D 50 65 DE 56 5D 87 F1 20 B3 51 9D D9 1E 09 D3 53 B7 12 0E F9 F2 }
    $4  = { 2E 23 3E 25 76 70 37 CA 68 F9 C0 F0 26 A5 CD DC C0 8F C0 DC E2 1F 61 C6 12 F1 98 3A 29 BD 3D 98 6F 82 39 A7 69 2B 0E BD 47 8B 6C 81 15 56 4D 5B 06 71 34 6C F7 CD DB 61 22 47 EA 7A 4F AA 7C 71 }
    $5  = { 2B 2C 32 49 09 4C 8A 1A 97 34 E7 51 5D 10 F7 8F D1 B9 33 9D F1 90 2A C1 D4 AD E7 0C 27 C8 A2 CA 7F 34 16 B7 B9 F0 D1 0E 67 51 9D 58 9B 8A D6 4D 64 35 CC 2D F4 C2 09 2A 4B CE F7 05 3B 19 4A E5 }
    $6  = { 0B 29 7C 7D 79 EC D3 39 B3 0E 87 77 5B 67 69 90 9C D8 86 D1 FB BA F2 04 1D CC 4F B1 1B 5B A7 77 AA 62 6A 9E 8C AC 14 F6 4B EA 52 99 A8 E3 04 A2 2B A2 5F A4 F7 AC 4B 95 E8 AC C4 2E C3 3A 3D E4 }
    $7  = { 0D 46 50 3D 4D FD 82 5D ED 41 C9 4C 05 5E 1F CE 11 34 C6 F6 3A D8 0D CD 74 27 F4 BD 50 2F A1 86 07 7B D2 26 53 AB 09 8C 96 EC DD A2 65 57 FB 82 BB A0 53 CB 20 67 C9 DE A7 EE 0A F6 A4 4C 46 8A }
    $8  = { 2E 77 4F 20 38 FD E7 72 77 25 3C D1 1B FE B6 FB 82 CB 6A 03 E1 B3 4E 13 4C 78 A2 CF DC 1B 5C D6 3A D1 67 EE 4E 78 A2 27 FE F6 94 EE 32 69 14 3D 1B 0E 84 CF 7C DA E5 C3 03 5C 26 3D D1 5B 97 9B }
    $9  = { 5C 42 50 51 0A 8D EF 34 63 BF 74 10 DE E0 E7 27 59 B8 A9 4A 4D 05 44 BD 9B 4F C0 84 6E 61 84 4F 4E 06 B7 79 AB F9 06 A4 50 F5 A2 AC 4C 57 CF 76 17 98 C5 39 17 5F 09 2F D2 42 9D C2 79 09 E3 82 }
    $10 = { 7C 78 7B 38 61 77 B4 D7 F1 F6 B9 E6 FE 17 15 4F F1 5B D9 E3 F1 DA 94 A1 E1 06 46 54 E7 50 0A 0B 86 A2 0A 4A A1 6B D4 E1 6F 19 A8 73 39 60 DE 86 8F 10 F3 82 CD EE C1 F1 5C E7 18 83 92 41 DA 10 }
    $11 = { 2C 3C 6F 6B 2E 59 7A C7 46 FF 76 64 08 7C 7E 89 9A BC C2 7A C6 0F A5 45 D9 CF 43 23 06 38 96 D2 99 F5 71 32 FE 3E 63 E5 67 EB FA DF 29 63 65 A1 B2 C0 16 3D D8 A4 F3 DA BA 04 C7 7F A3 9A 99 CB }
    $12 = { 7B 3C 5D 7C 73 D3 4D 1A 6C 66 B9 19 90 D1 62 CA CD 89 EC EA F5 91 AC 56 C9 5A B3 15 1E BA C1 68 7F B7 49 92 4B 7B C2 79 17 FE 50 CA 6C 14 17 FE DB CC 5B A2 B7 C0 3B 1A EE 4F 57 32 E6 9D AC 14 }
    $13 = { 40 63 57 77 5C 42 58 4F 11 A1 61 0D 3A 8A 31 F0 94 FA 25 2B C3 E1 07 38 BD 31 0D 53 6D 3A 2F 9E C5 C2 19 96 AC 4D CF 52 37 AE 3A 44 67 D5 67 8E E2 98 3E 42 82 AD FB 1F DE A1 63 52 10 9B A7 A7 }
    $14 = { 2F 26 56 63 68 0C AC C6 67 31 B1 1A A7 8D 58 8D 7B 54 AC 06 C6 34 89 05 D6 B8 F5 2C 60 8D 82 08 B0 C6 C5 F1 C1 1A 2F 69 60 8D 36 3D FA 2A 36 5A A3 87 DA FC C9 06 B4 86 54 8F 3D A8 FE 36 31 2E }
    $15 = { 2B 37 48 0D 63 4C 79 9C 46 8B 77 54 04 36 8C 7B 89 1A DE 3A 55 6D F8 88 56 6E B8 CB 3E D6 F0 17 1B 59 C3 5B B5 7F 3B 75 D9 01 7B 7C 9D 52 D1 E8 7F 48 79 5A A5 8A 16 69 5B 98 BA FE AF 66 A7 69 }
    $16 = { 0A 76 37 2D 4F 48 8E D5 64 9A 19 B4 2E 9E 42 B1 DC C2 E6 26 55 E7 04 17 11 A6 23 5B 82 5D 79 1C D6 51 94 92 30 9D 46 96 45 94 F7 8B 1D CA D1 7A 5B EA 57 41 66 B8 A8 EB 76 A5 2C A1 05 2D 72 4A }
    $17 = { 3D 0B 63 5F 78 9C 6C A6 AD AC 54 95 48 AA 50 9C 99 D0 C8 DD 82 3C 99 70 44 23 B9 01 75 B0 62 E7 0E BB A6 7F 93 7D 62 2F F4 1B 59 D2 1E 76 3A 26 D3 67 59 F3 29 7D 12 B7 45 4D 82 67 6C 5B 7B 4A }
    $18 = { 22 5B 64 2B 7A 09 E7 B0 6A 4D 3B 95 D9 79 27 AC 46 DA BA E3 EC E9 3A A4 B3 07 25 9D B9 C0 13 61 C9 05 B2 40 67 8D B8 30 EB 7E 17 2E B9 39 EC B1 88 ED 35 04 B3 70 9A 74 67 72 B7 BC 94 C8 3F B6 }
    $19 = { 27 46 5E 49 76 1E EC AF 44 9A 3A B1 47 90 7C F1 C3 D5 F1 61 D3 53 E2 36 BF 99 40 AE C0 99 EA 4A C0 35 25 76 80 36 26 02 9A 15 B3 E9 78 AB 84 D0 02 4A 1E 34 5F FE 58 A8 1C DA 2F BD 61 40 89 71 }
    $20 = { 3B 74 31 21 0B EE 47 62 B4 47 DF 04 4B 5D 6F 41 D5 38 24 C3 E2 CD 17 A3 5D 71 02 93 52 B4 7D A3 81 1C 60 45 8E AA DE BA 53 2F 75 C5 4A 3D DF C7 4A B3 BE A7 A5 1A F8 1A 4A 68 8F 5D 7A 10 37 8C }
    $21 = { 27 6C 41 45 3F 8F 2D 82 79 98 0E AD 33 28 E2 47 8A 3D 84 C5 5E B6 68 23 1A 12 EE D1 50 E4 96 62 2F CB 2C 04 D9 CB CE 25 7B D9 7B 9E CE 40 40 37 58 9A 18 55 73 F9 36 A7 8D A8 8A D4 3E FC 39 48 }
    $22 = { 27 27 49 5F 5B 1B 4D 92 0E 35 A5 2B 6A 5D B6 A7 F8 B3 1A 26 87 3E 20 C5 33 88 69 65 67 D6 92 B4 B1 F4 A0 B9 26 7E 4B BD A1 72 8A 5E 88 3F D6 90 29 A0 76 69 AC 1D 0D C2 2E 31 57 C0 28 70 5C 19 }
    $23 = { 3E 55 52 67 2C 26 C4 F2 28 24 AF 19 6F 22 2D 37 0F 9E ED BE F1 19 B8 C3 DD 96 41 4C F3 52 99 12 23 4C B0 8A A7 B2 A0 34 A5 16 35 31 9E AC 44 D4 7F A6 87 47 BA 4B 2F D2 A8 84 37 3A DE FB 5C 84 }
    $24 = { 20 73 5E 63 2C 6C 70 37 5B CA 93 5E E3 9B 7F A5 08 20 5E 9C C0 34 CB D1 93 A0 D1 C1 E3 A9 A1 38 18 B9 EB 7F EF B1 18 91 E7 12 21 DB 71 43 28 6C 7D 36 A9 1C 1F F7 61 5E 38 F0 2E 5C 1B A2 4A FF }
    $25 = { 0A 3D 69 34 48 60 D9 44 AA 8A 46 90 80 19 AB 08 5E 02 5A A6 93 D3 81 A3 4D 8D CF 11 6B 25 B0 C6 23 55 D9 38 93 D1 F6 4B 98 39 86 C7 E9 56 C2 23 03 A9 AB 10 96 80 BF 4B 74 46 0C 5B 08 74 12 AF }
    $26 = { 7C 5B 79 65 2B C6 6C 9B C3 6B 11 73 0D 55 6F FA 1C A1 61 6C A5 9C 0C 34 4F D1 F6 B5 0C 9C 25 93 29 D6 99 CD F0 B8 94 F1 54 0A FD C4 F4 31 95 72 06 B0 74 8A B6 AE 3B 90 69 CD 91 14 7E 09 70 9B }
    $27 = { 22 57 44 2B 42 DB 79 A5 E6 CA D7 45 E9 A8 D9 77 5E 42 16 C9 5F 60 94 A0 5F 05 D7 DA AD BB 03 EC 4B 34 44 98 3D D2 91 C2 E3 2F C3 92 99 BC B4 D2 22 19 38 6E 75 DA AB B8 D2 EA 93 DF C5 2A 24 8B }
    $28 = { 3C 0D 4A 68 79 25 94 D2 F2 3F 10 A4 65 B3 8B 75 D2 72 31 8C A0 E5 32 A8 A1 83 F8 CE 5D EE 6B 45 EC FD C9 6E 4F F9 15 88 32 47 2E D8 CD FA 69 F9 28 68 A5 03 F8 21 D8 48 CB B9 7B 58 33 2D 8F 84 }

  condition:
    uint16(0) == 0x5a4d and all of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

009d8dd4-4003-4a89-9a5f-d2512bdbfdd5

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion