Common Information
| Type | Value |
|---|---|
| Value |
rule RagnarLocker {
meta:
author = "McAfee ATR Team"
description = "Rule to detect unpacked sample of RagnarLocker"
version = "1.0"
strings:
$a = { 42 81 F1 3C FF 01 AB 03 F1 8B C6 C1 C0 0D 2B F0 3B D7 }
condition:
$a
}
|
| Category | |
| Type | Yara Rule |
| Misp Type | |
| Description |