Indicator (IOC)
Essential information
- Value / Name
fad2ec0b036a6574ef4ebc132ad9256c036c6388- Confidence
- 100/100
- Revoked
- Yes
- Valid from
- 26/10/2022 09:11
- Valid until
- 29/01/2024 08:11
- Pattern type
- yara
- Published
- 20/12/2025 22:13
- Modified
- 20/12/2025 22:13
- Author / Source
- AlienVault
Description
Detects exfil tool used by BlackByte ransomware
Pattern
rule blackbyte_exfil { meta: copyright = "Symantec" family = "Alias:ExfilTool" description = "Detects exfil tool used by BlackByte ransomware" strings: $data_str1 = {41 B9 04 00 00 00 66 66 0F 1F 84 00 00 00 00 00 43 0F B6 84 02 A0 00 00 00 41 30 00 49 FF C0 49 83 E9 01 75 EB 49 83 EB 01 75 D5 40 B7 09 48 8D} $data_str2 = {32 10 05 AF 59 2E 0D 38 32 59 C0 99 E8 A5 87 CB} $data_str3 = "@BCEFHJLNPRTVY" ascii condition: all of ($data_str*) and filesize > 2MB and filesize < 3MB and (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) }Labels / Tags
Marking (TLP)
TLP:CLEAR