cryptonar_ransomware

YARA-2025-0697 Critical general Active

Rule to detect CryptoNar Ransomware

cryptonar_ransomware.yar Valid Syntax

rule cryptonar_ransomware {

   meta:
   
      description = "Rule to detect CryptoNar Ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/"
      
   strings:
   
      $s1 = "C:\\narnar\\CryptoNar\\CryptoNarDecryptor\\obj\\Debug\\CryptoNar.pdb" fullword ascii
      $s2 = "CryptoNarDecryptor.exe" fullword wide
      $s3 = "server will eliminate the key after 72 hours since its generation (since the moment your computer was infected). Once this has " fullword ascii
      $s4 = "Do not delete this file, else the decryption process will be broken" fullword wide
      $s5 = "key you received, and wait until the decryption process is done." fullword ascii
      $s6 = "In order to receive your decryption key, you will have to pay $200 in bitcoins to this bitcoin address: [bitcoin address]" fullword ascii
      $s7 = "Decryption process failed" fullword wide
      $s8 = "CryptoNarDecryptor.KeyValidationWindow.resources" fullword ascii
      $s9 = "Important note: Removing CryptoNar will not restore access to your encrypted files." fullword ascii
      $s10 = "johnsmith987654@tutanota.com" fullword wide
      $s11 = "Decryption process will start soon" fullword wide
      $s12 = "CryptoNarDecryptor.DecryptionProgressBarForm.resources" fullword ascii
      $s13 = "DecryptionProcessProgressBar" fullword wide
      $s14 = "CryptoNarDecryptor.Properties.Resources.resources" fullword ascii
      
   condition:
      ( uint16(0) == 0x5a4d and filesize < 2000KB) and all of them 
}

Rule Metadata

description

Rule to detect CryptoNar Ransomware

author

Marc Rivero | @seifreed

reference

https://www.bleepingcomputer.com/news/security/cryptonar-ransomware-discovered-and-quickly-decrypted/

String Definitions

{"name":"$s1","value":"\"C:\\\\narnar\\\\CryptoNar\\\\CryptoNarDecryptor\\\\obj\\\\Debug\\\\CryptoNar.pdb\" fullword ascii"}

{"name":"$s2","value":"\"CryptoNarDecryptor.exe\" fullword wide"}

{"name":"$s3","value":"\"server will eliminate the key after 72 hours since its generation (since the moment your computer was infected). Once this has \" fullword ascii"}

{"name":"$s4","value":"\"Do not delete this file, else the decryption process will be broken\" fullword wide"}

{"name":"$s5","value":"\"key you received, and wait until the decryption process is done.\" fullword ascii"}

{"name":"$s6","value":"\"In order to receive your decryption key, you will have to pay"}

{"name":"$s7","value":"\"Decryption process failed\" fullword wide"}

{"name":"$s8","value":"\"CryptoNarDecryptor.KeyValidationWindow.resources\" fullword ascii"}

{"name":"$s9","value":"\"Important note: Removing CryptoNar will not restore access to your encrypted files.\" fullword ascii"}

{"name":"$s10","value":"\"johnsmith987654@tutanota.com\" fullword wide"}

{"name":"$s11","value":"\"Decryption process will start soon\" fullword wide"}

{"name":"$s12","value":"\"CryptoNarDecryptor.DecryptionProgressBarForm.resources\" fullword ascii"}

{"name":"$s13","value":"\"DecryptionProcessProgressBar\" fullword wide"}

{"name":"$s14","value":"\"CryptoNarDecryptor.Properties.Resources.resources\" fullword ascii"}

Threat Analysis

This YARA rule is designed to detect general threats.

Severity Level: Critical

The rule uses pattern matching to identify specific byte sequences, strings, or behavioral patterns associated with malicious activity.

Detection Capabilities

File-based detection for executables and documents
Memory scanning for running processes
Network traffic analysis support

Command Line Usage

# Scan a single file
yara cryptonar_ransomware.yar /path/to/suspicious/file

# Scan a directory recursively
yara -r cryptonar_ransomware.yar /path/to/directory/

# Scan with metadata output
yara -m cryptonar_ransomware.yar target_file

# Scan process memory (Linux)
yara cryptonar_ransomware.yar /proc/[pid]/exe

Integration Examples

Python (yara-python)

import yara
rules = yara.compile(filepath='cryptonar_ransomware.yar')
matches = rules.match('/path/to/file')

ClamAV Integration

clamscan --yara-rules=cryptonar_ransomware.yar /path/to/scan

Rule Information

YARA ID

YARA-2025-0697

Author

Marc Rivero | @seifreed

Repository

Yara-Rules_rules

Created

August 19, 2025

Last Updated

August 19, 2025

Last Imported

Never

Threat Intelligence

Risk Level Critical

Category general

Detection Confidence Analysis Pending

False Positive Rate Not Available

Last Seen in Wild No Data

Related Rules

Xtreme

YARA-2025-0555

Medium

MiniDionis_readerView

YARA-2015-0004

Medium

Maldoc_APT10_MenuPass

YARA-2018-3751

Medium

Mal_Dropper_httpEXE_from_CAB

Export Options

Similar Rules in general

YARA-2023-0001 CRI

cryptonar_ransomware

Rule Metadata

String Definitions

Threat Analysis

Detection Capabilities

Command Line Usage

Integration Examples

Python (yara-python)

ClamAV Integration

Rule Information

Threat Intelligence

Related Rules

Export Options

Similar Rules in general

Detect_Mimic_Ransomware

SystemBC_malware

detect_catB

detect_Typhon_Stealer

Nosu_stealer

detect_Lumma_stealer

detect_StrelaStealer

detect_silence_Downloader