Essential information

Value / Name

2164c82bd1894f31b366d5c97276c29e1721b5e5

Confidence

100/100

Revoked

Yes

Valid from

29/03/2023 23:27

Valid until

01/07/2024 23:27

Pattern type

yara

Published

20/12/2025 19:38

Modified

20/12/2025 23:47

Author / Source

AlienVault

Description

Pattern

import "pe"
rule ARestore{ meta: author= "@luc4m" date= "20230312" modified= "20230312" hash= "7f86b67ac003eda9d2929c9317025013" description="ARestore in makop ransomware toolkit" tlp="CLEAR" strings: $junk_1= { 2B 09 28 [4] 14 16 9A 26 16 2D F9 14 2A } $obj_1= { 38 [4] 26 20 [4] 38 [4] FE [4] 38 [4] 20 [4] 20 [4] 59 9C 20 [4] FE [4] 28 [4] 38 } $obj_2= { FE [4] 20 [4] FE [4] 9C 20 [4] 38 [4] 12 } $string_1 = "ADLogic" nocase $string_2 = "GetUserFromGroupAsync" nocase $string_3 = "WriteResultAsync" nocase $string_4 = "ParseLoginAsync" nocase $string_5 = "GenerateCredentials" nocase $string_6 = "GetUserAsync" nocase $string_7 = "IsAuthenticated" nocase condition: uint16(0) == 0x5a4d and pe.imports("mscoree.dll") and ( (1 of ($junk_*) or 1 of ($obj_*)) and 3 of ($string_*) ) }

Labels / Tags

Labels: arestore lockbit makop mimikatz phobos psexec puffedup putty run registry ydark

Marking (TLP)

TLP:CLEAR