318 lines
14 KiB
Text
318 lines
14 KiB
Text
/*
|
|
GenieLocker ransomware detection rules for BastionGuard / YARA 4.x
|
|
|
|
Purpose:
|
|
- Detect known GenieLocker Windows, Linux, and VMware ESXi samples.
|
|
- Detect probable new variants using high-specificity static indicators.
|
|
- Detect the GenieLocker VCJOURN auxiliary journal artifact.
|
|
|
|
Response model:
|
|
BastionGuard reports the match to the user. The user remains responsible
|
|
for deciding whether to block, quarantine, allow, or investigate the file.
|
|
|
|
Intelligence sources:
|
|
- Kaspersky Securelist, "Toy Ghouls' new toy: the GenieLocker ransomware",
|
|
published 2026-07-30.
|
|
- Tom's Hardware Italia, "GenieLocker si evolve: Windows, Linux ed ESXi
|
|
sono nel mirino", published 2026-07-30.
|
|
|
|
Notes:
|
|
- Exact-hash rules have critical severity and high confidence.
|
|
- Heuristic rules should be reviewed in context before quarantine.
|
|
- MD5 is used only because the public IOC list was published as MD5.
|
|
- This file contains no automatic response or hidden enforcement logic.
|
|
*/
|
|
|
|
import "hash"
|
|
|
|
/* -------------------------------------------------------------------------
|
|
PRIVATE HELPERS: EXACT PUBLISHED SAMPLE HASHES
|
|
------------------------------------------------------------------------- */
|
|
|
|
private rule GenieLocker_Known_Windows_MD5
|
|
{
|
|
condition:
|
|
filesize > 0 and filesize <= 100MB and
|
|
(
|
|
hash.md5(0, filesize) == "a50eaaf514f4f84e61ca2455a8789753" or
|
|
hash.md5(0, filesize) == "f08f476f26b01d142ca73923de65fc0c" or
|
|
hash.md5(0, filesize) == "fd46a80c2f45577263328984edf7f4dc" or
|
|
hash.md5(0, filesize) == "de3cfbb50f66079bfee20a6f64e59433" or
|
|
hash.md5(0, filesize) == "780c8f4c6f077da4da96582987920362" or
|
|
hash.md5(0, filesize) == "d87d0b01d95acc936b7dc47b8f41937a" or
|
|
hash.md5(0, filesize) == "34a7f28e0bb69b0d49bacc88bdf20ac1" or
|
|
hash.md5(0, filesize) == "5d62c1349b8981c396c9a23f4f8f053c" or
|
|
hash.md5(0, filesize) == "a8842616c9057d5cf6e1fe1fa8c3c160" or
|
|
hash.md5(0, filesize) == "34b8828635f88078735799a3c1ac8e28" or
|
|
hash.md5(0, filesize) == "d3e06eb34d8eee7ef92cac3ad0a20ff5" or
|
|
hash.md5(0, filesize) == "c68b6862725777651085650db34947fc" or
|
|
hash.md5(0, filesize) == "9cd514ff2809ce0b993e3b8649e82a94" or
|
|
hash.md5(0, filesize) == "824ca1e906cc073ee5b0f3519df69a8f" or
|
|
hash.md5(0, filesize) == "25480dad40152ef3d0c6d38eecc9bd9b" or
|
|
hash.md5(0, filesize) == "7dad78584795aa5c160520cc6accf260" or
|
|
hash.md5(0, filesize) == "18f61c6d686cffd131c9fd3f3437064b" or
|
|
hash.md5(0, filesize) == "9969a8221312dba70dd5cbddf83a146c" or
|
|
hash.md5(0, filesize) == "f7b9e36e94163a9a303160945f99267a" or
|
|
hash.md5(0, filesize) == "b893eafed0659f70d4ac250f09073723" or
|
|
hash.md5(0, filesize) == "d661cf666b9acbab7cfeae1127a261a9" or
|
|
hash.md5(0, filesize) == "3a4479b51890373bfc4a011ef41fe376" or
|
|
hash.md5(0, filesize) == "58c0dda52b8f069660166d61fd74f911"
|
|
)
|
|
}
|
|
|
|
private rule GenieLocker_Known_Linux_ESXi_MD5
|
|
{
|
|
condition:
|
|
filesize > 0 and filesize <= 100MB and
|
|
hash.md5(0, filesize) == "9201e35e2993612612919a3c71302cab"
|
|
}
|
|
|
|
/* -------------------------------------------------------------------------
|
|
EXACT IOC RULES
|
|
------------------------------------------------------------------------- */
|
|
|
|
rule GenieLocker_Known_Windows_Sample : ransomware genielocker windows exact_ioc
|
|
{
|
|
meta:
|
|
author = "Calogero Scarnà"
|
|
created = "2026-08-01"
|
|
modified = "2026-08-01"
|
|
description = "Detects published GenieLocker Windows samples by exact MD5"
|
|
family = "GenieLocker"
|
|
threat_actor = "Toy Ghouls"
|
|
platform = "Windows"
|
|
severity = "critical"
|
|
confidence = "high"
|
|
response_mode = "user_managed"
|
|
recommendation = "Review alert and block or quarantine if the hash match is confirmed"
|
|
source = "Kaspersky Securelist, 2026-07-30"
|
|
reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"
|
|
|
|
condition:
|
|
GenieLocker_Known_Windows_MD5
|
|
}
|
|
|
|
rule GenieLocker_Known_Linux_ESXi_Sample : ransomware genielocker linux esxi exact_ioc
|
|
{
|
|
meta:
|
|
author = "Calogero Scarnà"
|
|
created = "2026-08-01"
|
|
modified = "2026-08-01"
|
|
description = "Detects the published GenieLocker Linux and VMware ESXi sample by exact MD5"
|
|
family = "GenieLocker"
|
|
threat_actor = "Toy Ghouls"
|
|
platform = "Linux/VMware ESXi"
|
|
severity = "critical"
|
|
confidence = "high"
|
|
response_mode = "user_managed"
|
|
recommendation = "Review alert and block or quarantine if the hash match is confirmed"
|
|
source = "Kaspersky Securelist, 2026-07-30"
|
|
reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"
|
|
|
|
condition:
|
|
GenieLocker_Known_Linux_ESXi_MD5
|
|
}
|
|
|
|
/* -------------------------------------------------------------------------
|
|
WINDOWS PE HEURISTIC
|
|
|
|
The condition requires a PE file plus combinations of GenieLocker-specific
|
|
journal/extension strings, unusually long exclusion/termination lists,
|
|
command-line options, and anti-debug/service-control APIs.
|
|
------------------------------------------------------------------------- */
|
|
|
|
rule GenieLocker_Windows_PE_Heuristic : ransomware genielocker windows heuristic
|
|
{
|
|
meta:
|
|
author = "Calogero Scarnà"
|
|
created = "2026-08-01"
|
|
modified = "2026-08-01"
|
|
description = "Detects probable GenieLocker Windows PE variants using high-specificity static indicators"
|
|
family = "GenieLocker"
|
|
threat_actor = "Toy Ghouls"
|
|
platform = "Windows"
|
|
severity = "high"
|
|
confidence = "medium-high"
|
|
response_mode = "user_managed"
|
|
recommendation = "Inspect path, signer, parent process, hash, and matched strings before quarantine"
|
|
source = "Kaspersky Securelist technical analysis, 2026-07-30"
|
|
reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"
|
|
|
|
strings:
|
|
/* File-encryption artifacts */
|
|
$journal_magic = "VCJOURN" ascii wide
|
|
$sample_extension = ".03ffc1c4a3da0f02" ascii wide
|
|
|
|
/* Highly characteristic exclusion and target lists */
|
|
$folder_exclusions_1 = "$recycle.bin;config.msi;$windows.~bt;$windows.~ws;windows;boot;program files;program files (x86);programdata" ascii wide nocase
|
|
$folder_exclusions_2 = "system volume information;tor browser;windows.old;intel;msocache;perflogs;x64dbg;public;all users;default;microsoft;appdata" ascii wide nocase
|
|
$file_exclusions = "autorun.inf;boot.ini;bootfont.bin;bootsect.bak;desktop.ini;iconcache.db;ntldr;ntuser.dat" ascii wide nocase
|
|
$process_targets_1 = "sql;oracle;ocssd;dbsnmp;synctime;agntsvc;isqlplussvc;xfssvccon;mydesktopservice" ascii wide nocase
|
|
$process_targets_2 = "excel;infopath;msaccess;mspub;onenote;outlook;powerpnt;steam;thebat;thunderbird;visio;winword" ascii wide nocase
|
|
$process_targets_3 = "vmwp;vmms;vmcompute;mssqlserver" ascii wide nocase
|
|
$service_targets_1 = "vss;sql;svc$;memtas;mepocs;msexchange;sophos;veeam;backup" ascii wide nocase
|
|
$service_targets_2 = "GxVss;GxBlr;GxFWD;GxCVD;GxCIMgr" ascii wide nocase
|
|
$service_targets_3 = "agent_ovpnconnect" ascii wide nocase
|
|
|
|
/* Command-line interface */
|
|
$option_percent_long = "--percent" ascii wide
|
|
$option_recursive_long = "--recursive" ascii wide
|
|
$option_log_long = "--log" ascii wide
|
|
$option_percent_short = "-p" ascii wide fullword
|
|
$option_recursive_short = "-r" ascii wide fullword
|
|
$option_log_short = "-l" ascii wide fullword
|
|
|
|
/* Anti-analysis and process/service manipulation APIs */
|
|
$api_debug_local = "IsDebuggerPresent" ascii
|
|
$api_debug_remote = "CheckRemoteDebuggerPresent" ascii
|
|
$api_hostname = "GetComputerNameA" ascii
|
|
$api_terminate = "TerminateProcess" ascii
|
|
$api_control_service = "ControlService" ascii
|
|
$api_current_pid = "GetCurrentProcessId" ascii
|
|
|
|
condition:
|
|
uint16(0) == 0x5A4D and
|
|
filesize >= 20KB and filesize <= 100MB and
|
|
(
|
|
/* Strongest known combination */
|
|
(
|
|
$journal_magic and
|
|
$sample_extension and
|
|
2 of ($api_*)
|
|
)
|
|
or
|
|
/* Variant tolerant: multiple unique lists plus behavior APIs */
|
|
(
|
|
3 of ($folder_exclusions_*, $file_exclusions, $process_targets_*, $service_targets_*) and
|
|
3 of ($api_*) and
|
|
1 of ($option_*)
|
|
)
|
|
or
|
|
/* Journal marker, target lists, and CLI together */
|
|
(
|
|
$journal_magic and
|
|
2 of ($process_targets_*, $service_targets_*) and
|
|
2 of ($option_*) and
|
|
2 of ($api_*)
|
|
)
|
|
)
|
|
}
|
|
|
|
/* -------------------------------------------------------------------------
|
|
LINUX / VMWARE ESXi ELF HEURISTIC
|
|
|
|
The condition requires an ELF file and combinations of ESXi-specific paths,
|
|
GenieLocker command-line help text, journal data, and libsodium symbols.
|
|
------------------------------------------------------------------------- */
|
|
|
|
rule GenieLocker_Linux_ESXi_ELF_Heuristic : ransomware genielocker linux esxi heuristic
|
|
{
|
|
meta:
|
|
author = "Calogero Scarnà"
|
|
created = "2026-08-01"
|
|
modified = "2026-08-01"
|
|
description = "Detects probable GenieLocker Linux or VMware ESXi ELF variants"
|
|
family = "GenieLocker"
|
|
threat_actor = "Toy Ghouls"
|
|
platform = "Linux/VMware ESXi"
|
|
severity = "high"
|
|
confidence = "medium-high"
|
|
response_mode = "user_managed"
|
|
recommendation = "Inspect execution context, target path, hash, and matched strings before quarantine"
|
|
source = "Kaspersky Securelist technical analysis, 2026-07-30"
|
|
reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"
|
|
|
|
strings:
|
|
/* ESXi-specific paths */
|
|
$esxi_volume_path = "/vmfs/volumes" ascii
|
|
$esxi_welcome_path = "/etc/vmware/welcome" ascii
|
|
|
|
/* File-encryption artifact */
|
|
$journal_magic = "VCJOURN" ascii
|
|
|
|
/* Help/argument strings reported for the ELF build */
|
|
$help_percent = "-p <perc>" ascii
|
|
$help_workers = "-j <workers>" ascii
|
|
$help_recursive = "-r <dir>" ascii
|
|
$help_delay = "-w <sec>" ascii
|
|
$help_daemon = "-d" ascii fullword
|
|
$help_log = "-l <logfile>" ascii
|
|
|
|
/* Common argument descriptions; useful when symbols are stripped */
|
|
$text_percentage = "Percentage of file content to encrypt" ascii nocase
|
|
$text_workers = "Number of encryption threads" ascii nocase
|
|
$text_delay = "Delay before start" ascii nocase
|
|
$text_logfile = "Path to log file" ascii nocase
|
|
|
|
/* Potentially retained static libsodium symbol names */
|
|
$sodium_xchacha_encrypt = "crypto_aead_xchacha20poly1305_ietf_encrypt" ascii
|
|
$sodium_xchacha_decrypt = "crypto_aead_xchacha20poly1305_ietf_decrypt" ascii
|
|
$sodium_box_easy = "crypto_box_easy" ascii
|
|
$sodium_box_seal = "crypto_box_seal" ascii
|
|
$sodium_init = "sodium_init" ascii
|
|
|
|
condition:
|
|
uint32(0) == 0x464C457F and
|
|
filesize >= 20KB and filesize <= 100MB and
|
|
(
|
|
/* ESXi paths and multiple specific CLI strings */
|
|
(
|
|
$esxi_volume_path and
|
|
$esxi_welcome_path and
|
|
3 of ($help_*)
|
|
)
|
|
or
|
|
/* ESXi target path plus journal and CLI */
|
|
(
|
|
$esxi_volume_path and
|
|
$journal_magic and
|
|
3 of ($help_*)
|
|
)
|
|
or
|
|
/* ESXi paths plus cryptographic implementation evidence */
|
|
(
|
|
$esxi_volume_path and
|
|
$esxi_welcome_path and
|
|
2 of ($sodium_*)
|
|
)
|
|
or
|
|
/* Tolerates modified help formatting */
|
|
(
|
|
$esxi_volume_path and
|
|
3 of ($text_*) and
|
|
2 of ($help_*, $sodium_*)
|
|
)
|
|
)
|
|
}
|
|
|
|
/* -------------------------------------------------------------------------
|
|
POST-IMPACT JOURNAL ARTIFACT
|
|
|
|
GenieLocker creates a small auxiliary journal containing the hardcoded
|
|
"VCJOURN" magic. This rule may identify an encryption artifact rather than
|
|
the executable itself, so investigate the affected directory immediately.
|
|
------------------------------------------------------------------------- */
|
|
|
|
rule GenieLocker_VCJOURN_Artifact : ransomware genielocker artifact journal
|
|
{
|
|
meta:
|
|
author = "Calogero Scarnà"
|
|
created = "2026-08-01"
|
|
modified = "2026-08-01"
|
|
description = "Detects a probable GenieLocker VCJOURN auxiliary encryption journal"
|
|
family = "GenieLocker"
|
|
platform = "Windows/Linux/VMware ESXi"
|
|
severity = "critical"
|
|
confidence = "high"
|
|
response_mode = "user_managed"
|
|
recommendation = "Treat as possible active encryption; inspect nearby files and running processes immediately"
|
|
source = "Kaspersky Securelist technical analysis, 2026-07-30"
|
|
reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"
|
|
|
|
strings:
|
|
$journal_magic = "VCJOURN" ascii
|
|
|
|
condition:
|
|
filesize >= 16 and filesize <= 1MB and
|
|
$journal_magic at 0
|
|
}
|