RansomWare_GermanWiper

YARA-2019-0013 Critical general Active

Detects RansomWare GermanWiper in Memory or in unpacked state

RansomWare_GermanWiper.yar Valid Syntax
rule RansomWare_GermanWiper {
	meta:
		description = "Detects RansomWare GermanWiper in Memory or in unpacked state"
		author = "Frank Boldewin (@r3c0nst)"
		reference = "https://twitter.com/r3c0nst/status/1158326526766657538"
		date = "2019-08-05"
		hash_packed = "41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c"
		hash_unpacked = "708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447"

	strings:
		$PurgeCode = {6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8} // code patterns for process kills
		$Mutex1 = "HSDFSD-HFSD-3241-91E7-ASDGSDGHH" nocase ascii
		$Mutex2 = "cFgxTERNWEVhM2V" nocase ascii
		$ProcessKill1 = "oracle.exe" nocase ascii
		$ProcessKill2 = "sqbcoreservice.exe" nocase ascii
		$ProcessKill3 = "isqlplussvc.exe"  nocase ascii
		$ProcessKill4 = "mysqld.exe" nocase ascii
		$KillShadowCopies = "vssadmin.exe delete shadows" nocase ascii
		$Domain1 = "cdnjs.cloudflare.com" nocase ascii
		$Domain2 = "expandingdelegation.top" nocase ascii
		$RansomNote = "Entschluesselungs_Anleitung.html" nocase ascii
		
	condition:
		uint16(0) == 0x5A4D and filesize < 1000KB and 5 of them
}

Rule Metadata

description
Detects RansomWare GermanWiper in Memory or in unpacked state
author
Frank Boldewin (@r3c0nst)
reference
https://twitter.com/r3c0nst/status/1158326526766657538
date
2019-08-05
hash_packed
41364427dee49bf544dcff61a6899b3b7e59852435e4107931e294079a42de7c
hash_unpacked
708967cad421bb2396017bdd10a42e6799da27e29264f4b5fb095c0e3503e447

String Definitions

{"name":"$PurgeCode","value":"{6a 00 8b 47 08 50 6a 00 6a 01 e8 ?? ?? ?? ?? 50 e8 ?? ?? ?? ?? 8b f0 8b d7 8b c3 e8} \/\/ code patterns for process kills"}
{"name":"$Mutex1","value":"\"HSDFSD-HFSD-3241-91E7-ASDGSDGHH\" nocase ascii"}
{"name":"$Mutex2","value":"\"cFgxTERNWEVhM2V\" nocase ascii"}
{"name":"$ProcessKill1","value":"\"oracle.exe\" nocase ascii"}
{"name":"$ProcessKill2","value":"\"sqbcoreservice.exe\" nocase ascii"}
{"name":"$ProcessKill3","value":"\"isqlplussvc.exe\" nocase ascii"}
{"name":"$ProcessKill4","value":"\"mysqld.exe\" nocase ascii"}
{"name":"$KillShadowCopies","value":"\"vssadmin.exe delete shadows\" nocase ascii"}
{"name":"$Domain1","value":"\"cdnjs.cloudflare.com\" nocase ascii"}
{"name":"$Domain2","value":"\"expandingdelegation.top\" nocase ascii"}
{"name":"$RansomNote","value":"\"Entschluesselungs_Anleitung.html\" nocase ascii"}

Threat Analysis

This YARA rule is designed to detect general threats.

Severity Level: Critical

The rule uses pattern matching to identify specific byte sequences, strings, or behavioral patterns associated with malicious activity.

Detection Capabilities

  • File-based detection for executables and documents
  • Memory scanning for running processes
  • Network traffic analysis support

Command Line Usage

# Scan a single file
yara RansomWare_GermanWiper.yar /path/to/suspicious/file

# Scan a directory recursively
yara -r RansomWare_GermanWiper.yar /path/to/directory/

# Scan with metadata output
yara -m RansomWare_GermanWiper.yar target_file

# Scan process memory (Linux)
yara RansomWare_GermanWiper.yar /proc/[pid]/exe

Integration Examples

Python (yara-python)

import yara
rules = yara.compile(filepath='RansomWare_GermanWiper.yar')
matches = rules.match('/path/to/file')

ClamAV Integration

clamscan --yara-rules=RansomWare_GermanWiper.yar /path/to/scan

Rule Information

YARA ID
YARA-2019-0013
Created
August 19, 2025
Last Updated
August 19, 2025
Last Imported
Never

Threat Intelligence

Risk Level Critical
Category general
Detection Confidence Analysis Pending
False Positive Rate Not Available
Last Seen in Wild No Data

Export Options