• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    DMALocker Ransomware Detection

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    ReversingLabs Yara@ReversingLabsYara
    •updated Jul 15, 2020•0•28

    This YARA rule detects various versions of the DMALocker ransomware. It identifies specific byte patterns associated with file encryption routines, enumeration of shares and logical disks, and remote server communication, indicating the presence and activity of DMALocker.

    YARA

    Tags

    T1486 - Data Encrypted for ImpactT1083 - File and Directory DiscoveryT1021.002 - SMB/Windows Admin SharesT1071.001 - Web ProtocolsTA0040 - ImpactTA0007 - DiscoveryTA0008 - Lateral MovementTA0011 - Command and ControlMalware DetectedFile Encryption DetectedCommand ExecutionNetwork ConnectionWindows

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?