/* GenieLocker ransomware detection rules for BastionGuard / YARA 4.x Purpose: - Detect known GenieLocker Windows, Linux, and VMware ESXi samples. - Detect probable new variants using high-specificity static indicators. - Detect the GenieLocker VCJOURN auxiliary journal artifact. Response model: BastionGuard reports the match to the user. The user remains responsible for deciding whether to block, quarantine, allow, or investigate the file. Intelligence sources: - Kaspersky Securelist, "Toy Ghouls' new toy: the GenieLocker ransomware", published 2026-07-30. - Tom's Hardware Italia, "GenieLocker si evolve: Windows, Linux ed ESXi sono nel mirino", published 2026-07-30. Notes: - Exact-hash rules have critical severity and high confidence. - Heuristic rules should be reviewed in context before quarantine. - MD5 is used only because the public IOC list was published as MD5. - This file contains no automatic response or hidden enforcement logic. */ import "hash" /* ------------------------------------------------------------------------- PRIVATE HELPERS: EXACT PUBLISHED SAMPLE HASHES ------------------------------------------------------------------------- */ private rule GenieLocker_Known_Windows_MD5 { condition: filesize > 0 and filesize <= 100MB and ( hash.md5(0, filesize) == "a50eaaf514f4f84e61ca2455a8789753" or hash.md5(0, filesize) == "f08f476f26b01d142ca73923de65fc0c" or hash.md5(0, filesize) == "fd46a80c2f45577263328984edf7f4dc" or hash.md5(0, filesize) == "de3cfbb50f66079bfee20a6f64e59433" or hash.md5(0, filesize) == "780c8f4c6f077da4da96582987920362" or hash.md5(0, filesize) == "d87d0b01d95acc936b7dc47b8f41937a" or hash.md5(0, filesize) == "34a7f28e0bb69b0d49bacc88bdf20ac1" or hash.md5(0, filesize) == "5d62c1349b8981c396c9a23f4f8f053c" or hash.md5(0, filesize) == "a8842616c9057d5cf6e1fe1fa8c3c160" or hash.md5(0, filesize) == "34b8828635f88078735799a3c1ac8e28" or hash.md5(0, filesize) == "d3e06eb34d8eee7ef92cac3ad0a20ff5" or hash.md5(0, filesize) == "c68b6862725777651085650db34947fc" or hash.md5(0, filesize) == "9cd514ff2809ce0b993e3b8649e82a94" or hash.md5(0, filesize) == "824ca1e906cc073ee5b0f3519df69a8f" or hash.md5(0, filesize) == "25480dad40152ef3d0c6d38eecc9bd9b" or hash.md5(0, filesize) == "7dad78584795aa5c160520cc6accf260" or hash.md5(0, filesize) == "18f61c6d686cffd131c9fd3f3437064b" or hash.md5(0, filesize) == "9969a8221312dba70dd5cbddf83a146c" or hash.md5(0, filesize) == "f7b9e36e94163a9a303160945f99267a" or hash.md5(0, filesize) == "b893eafed0659f70d4ac250f09073723" or hash.md5(0, filesize) == "d661cf666b9acbab7cfeae1127a261a9" or hash.md5(0, filesize) == "3a4479b51890373bfc4a011ef41fe376" or hash.md5(0, filesize) == "58c0dda52b8f069660166d61fd74f911" ) } private rule GenieLocker_Known_Linux_ESXi_MD5 { condition: filesize > 0 and filesize <= 100MB and hash.md5(0, filesize) == "9201e35e2993612612919a3c71302cab" } /* ------------------------------------------------------------------------- EXACT IOC RULES ------------------------------------------------------------------------- */ rule GenieLocker_Known_Windows_Sample : ransomware genielocker windows exact_ioc { meta: author = "Calogero Scarnà" created = "2026-08-01" modified = "2026-08-01" description = "Detects published GenieLocker Windows samples by exact MD5" family = "GenieLocker" threat_actor = "Toy Ghouls" platform = "Windows" severity = "critical" confidence = "high" response_mode = "user_managed" recommendation = "Review alert and block or quarantine if the hash match is confirmed" source = "Kaspersky Securelist, 2026-07-30" reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/" condition: GenieLocker_Known_Windows_MD5 } rule GenieLocker_Known_Linux_ESXi_Sample : ransomware genielocker linux esxi exact_ioc { meta: author = "Calogero Scarnà" created = "2026-08-01" modified = "2026-08-01" description = "Detects the published GenieLocker Linux and VMware ESXi sample by exact MD5" family = "GenieLocker" threat_actor = "Toy Ghouls" platform = "Linux/VMware ESXi" severity = "critical" confidence = "high" response_mode = "user_managed" recommendation = "Review alert and block or quarantine if the hash match is confirmed" source = "Kaspersky Securelist, 2026-07-30" reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/" condition: GenieLocker_Known_Linux_ESXi_MD5 } /* ------------------------------------------------------------------------- WINDOWS PE HEURISTIC The condition requires a PE file plus combinations of GenieLocker-specific journal/extension strings, unusually long exclusion/termination lists, command-line options, and anti-debug/service-control APIs. ------------------------------------------------------------------------- */ rule GenieLocker_Windows_PE_Heuristic : ransomware genielocker windows heuristic { meta: author = "Calogero Scarnà" created = "2026-08-01" modified = "2026-08-01" description = "Detects probable GenieLocker Windows PE variants using high-specificity static indicators" family = "GenieLocker" threat_actor = "Toy Ghouls" platform = "Windows" severity = "high" confidence = "medium-high" response_mode = "user_managed" recommendation = "Inspect path, signer, parent process, hash, and matched strings before quarantine" source = "Kaspersky Securelist technical analysis, 2026-07-30" reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/" strings: /* File-encryption artifacts */ $journal_magic = "VCJOURN" ascii wide $sample_extension = ".03ffc1c4a3da0f02" ascii wide /* Highly characteristic exclusion and target lists */ $folder_exclusions_1 = "$recycle.bin;config.msi;$windows.~bt;$windows.~ws;windows;boot;program files;program files (x86);programdata" ascii wide nocase $folder_exclusions_2 = "system volume information;tor browser;windows.old;intel;msocache;perflogs;x64dbg;public;all users;default;microsoft;appdata" ascii wide nocase $file_exclusions = "autorun.inf;boot.ini;bootfont.bin;bootsect.bak;desktop.ini;iconcache.db;ntldr;ntuser.dat" ascii wide nocase $process_targets_1 = "sql;oracle;ocssd;dbsnmp;synctime;agntsvc;isqlplussvc;xfssvccon;mydesktopservice" ascii wide nocase $process_targets_2 = "excel;infopath;msaccess;mspub;onenote;outlook;powerpnt;steam;thebat;thunderbird;visio;winword" ascii wide nocase $process_targets_3 = "vmwp;vmms;vmcompute;mssqlserver" ascii wide nocase $service_targets_1 = "vss;sql;svc$;memtas;mepocs;msexchange;sophos;veeam;backup" ascii wide nocase $service_targets_2 = "GxVss;GxBlr;GxFWD;GxCVD;GxCIMgr" ascii wide nocase $service_targets_3 = "agent_ovpnconnect" ascii wide nocase /* Command-line interface */ $option_percent_long = "--percent" ascii wide $option_recursive_long = "--recursive" ascii wide $option_log_long = "--log" ascii wide $option_percent_short = "-p" ascii wide fullword $option_recursive_short = "-r" ascii wide fullword $option_log_short = "-l" ascii wide fullword /* Anti-analysis and process/service manipulation APIs */ $api_debug_local = "IsDebuggerPresent" ascii $api_debug_remote = "CheckRemoteDebuggerPresent" ascii $api_hostname = "GetComputerNameA" ascii $api_terminate = "TerminateProcess" ascii $api_control_service = "ControlService" ascii $api_current_pid = "GetCurrentProcessId" ascii condition: uint16(0) == 0x5A4D and filesize >= 20KB and filesize <= 100MB and ( /* Strongest known combination */ ( $journal_magic and $sample_extension and 2 of ($api_*) ) or /* Variant tolerant: multiple unique lists plus behavior APIs */ ( 3 of ($folder_exclusions_*, $file_exclusions, $process_targets_*, $service_targets_*) and 3 of ($api_*) and 1 of ($option_*) ) or /* Journal marker, target lists, and CLI together */ ( $journal_magic and 2 of ($process_targets_*, $service_targets_*) and 2 of ($option_*) and 2 of ($api_*) ) ) } /* ------------------------------------------------------------------------- LINUX / VMWARE ESXi ELF HEURISTIC The condition requires an ELF file and combinations of ESXi-specific paths, GenieLocker command-line help text, journal data, and libsodium symbols. ------------------------------------------------------------------------- */ rule GenieLocker_Linux_ESXi_ELF_Heuristic : ransomware genielocker linux esxi heuristic { meta: author = "Calogero Scarnà" created = "2026-08-01" modified = "2026-08-01" description = "Detects probable GenieLocker Linux or VMware ESXi ELF variants" family = "GenieLocker" threat_actor = "Toy Ghouls" platform = "Linux/VMware ESXi" severity = "high" confidence = "medium-high" response_mode = "user_managed" recommendation = "Inspect execution context, target path, hash, and matched strings before quarantine" source = "Kaspersky Securelist technical analysis, 2026-07-30" reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/" strings: /* ESXi-specific paths */ $esxi_volume_path = "/vmfs/volumes" ascii $esxi_welcome_path = "/etc/vmware/welcome" ascii /* File-encryption artifact */ $journal_magic = "VCJOURN" ascii /* Help/argument strings reported for the ELF build */ $help_percent = "-p " ascii $help_workers = "-j " ascii $help_recursive = "-r " ascii $help_delay = "-w " ascii $help_daemon = "-d" ascii fullword $help_log = "-l " ascii /* Common argument descriptions; useful when symbols are stripped */ $text_percentage = "Percentage of file content to encrypt" ascii nocase $text_workers = "Number of encryption threads" ascii nocase $text_delay = "Delay before start" ascii nocase $text_logfile = "Path to log file" ascii nocase /* Potentially retained static libsodium symbol names */ $sodium_xchacha_encrypt = "crypto_aead_xchacha20poly1305_ietf_encrypt" ascii $sodium_xchacha_decrypt = "crypto_aead_xchacha20poly1305_ietf_decrypt" ascii $sodium_box_easy = "crypto_box_easy" ascii $sodium_box_seal = "crypto_box_seal" ascii $sodium_init = "sodium_init" ascii condition: uint32(0) == 0x464C457F and filesize >= 20KB and filesize <= 100MB and ( /* ESXi paths and multiple specific CLI strings */ ( $esxi_volume_path and $esxi_welcome_path and 3 of ($help_*) ) or /* ESXi target path plus journal and CLI */ ( $esxi_volume_path and $journal_magic and 3 of ($help_*) ) or /* ESXi paths plus cryptographic implementation evidence */ ( $esxi_volume_path and $esxi_welcome_path and 2 of ($sodium_*) ) or /* Tolerates modified help formatting */ ( $esxi_volume_path and 3 of ($text_*) and 2 of ($help_*, $sodium_*) ) ) } /* ------------------------------------------------------------------------- POST-IMPACT JOURNAL ARTIFACT GenieLocker creates a small auxiliary journal containing the hardcoded "VCJOURN" magic. This rule may identify an encryption artifact rather than the executable itself, so investigate the affected directory immediately. ------------------------------------------------------------------------- */ rule GenieLocker_VCJOURN_Artifact : ransomware genielocker artifact journal { meta: author = "Calogero Scarnà" created = "2026-08-01" modified = "2026-08-01" description = "Detects a probable GenieLocker VCJOURN auxiliary encryption journal" family = "GenieLocker" platform = "Windows/Linux/VMware ESXi" severity = "critical" confidence = "high" response_mode = "user_managed" recommendation = "Treat as possible active encryption; inspect nearby files and running processes immediately" source = "Kaspersky Securelist technical analysis, 2026-07-30" reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/" strings: $journal_magic = "VCJOURN" ascii condition: filesize >= 16 and filesize <= 1MB and $journal_magic at 0 }