Indicator (IOC)
Essential information
- Value / Name
166156f803ab0174f7623d7c84082bbe4e7c2f12- Confidence
- 100/100
- Revoked
- Yes
- Valid from
- 26/10/2022 09:11
- Valid until
- 29/01/2024 08:11
- Pattern type
- yara
- Published
- 20/12/2025 22:13
- Modified
- 20/12/2025 22:13
- Author / Source
- AlienVault
Description
Detects unpacked exfil tool used by BlackByte ransomware
Pattern
rule blackbyte_exfil_unpacked { meta: copyright = "Symantec" family = "Alias:ExfilTool" description = "Detects unpacked exfil tool used by BlackByte ransomware" strings: $str1 = ").Login" $str2 = ").NewUpload" $str3 = ").CreateDir" $str4 = ".PreloginMsg" $str5 = ".UploadCompleteMsg" $str6 = ").UploadFile" $str7 = {FF 20 47 6F 20 62 75 69 6C 64 69 6E 66 3A 08 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 75 6E 6B 6E 6F 77 6E 00 00 00 00 00 00 00 00} $c1 = {44 24 68 44 31 C2 88 50 10 0F B6 54 24 56 44 0F} $c2 = {FB 48 89 F7 4C 89 C6 E8 54 ED F6 FF 4C 8D 43 01} condition: all of ($str*) and ($c1 or $c2) and filesize > 8MB and (uint16(0) == 0x5A4D and uint16(uint32(0x3c)) == 0x4550) }Labels / Tags
Marking (TLP)
TLP:CLEAR