Essential information

Value / Name

SECP0 ransomware detection

Confidence

100/100

Revoked

Yes

Valid from

28/07/2025 15:31

Valid until

15/05/2026 02:41

Pattern type

yara

Published

21/12/2025 15:11

Modified

15/05/2026 02:42

Author / Source

AlienVault

Description

Pattern

rule secp0 {
    meta:
        title = "SECP0 ransomware detection"
        description = "match embedded ransomware note decryption key and xor key"
        date = "2025-07-25"
        author = "Lexfo"
        os = "Linux, maybe Windows"
        score = 90
    strings:
        $key = { 6162636465666768696A6B6C6D6E6F707172737475767778797A7B7C7D7E7F80 }
        $iv = { 0001020304050607 }
        $chacha1 = "expand 16-byte k"
        $chacha2 = "expand 32-byte k"
        $chunk_1 = {
                        C1 E0 18
                        09 D8
                        4?
                        8B 4D 00
                        89 81 F1 50 10 00
                        35 6A 02 00 00
                        89 81 F5 50 10 00
                        4?
                        8A 86 A4 00 00 00
                        88 81 01 51
        }
    condition:
        (uint16(0) == 0x5a4d or uint32(0) == 0x464c457f) and (all of them) 
}

Labels / Tags

Labels: double-extortion encryption ransomware secp0

Marking (TLP)

TLP:CLEAR