termite_ransomware

YARA-2025-0847 Critical general Active

Rule to detect Termite Ransomware

termite_ransomware.yar Valid Syntax
rule termite_ransomware {

   meta:

      description = "Rule to detect Termite Ransomware"
      author = "Marc Rivero | @seifreed"
      reference = "https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/"
      
   strings:
      
      $s1 = "C:\\Windows\\SysNative\\mswsock.dll" fullword ascii
      $s2 = "C:\\Windows\\SysWOW64\\mswsock.dll" fullword ascii
      $s3 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Termite.exe" fullword ascii
      $s4 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\Payment.exe" fullword ascii
      $s5 = "C:\\Windows\\Termite.exe" fullword ascii
      $s6 = "\\Shell\\Open\\Command\\" fullword ascii
      $s7 = "t314.520@qq.com" fullword ascii
      $s8 = "(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG" fullword ascii
      
   condition:
   
      ( uint16(0) == 0x5a4d and filesize < 6000KB ) and all of them 
}

Rule Metadata

description
Rule to detect Termite Ransomware
author
Marc Rivero | @seifreed
reference
https://www.bleepingcomputer.com/news/security/the-week-in-ransomware-august-31st-2018-devs-on-vacation/

String Definitions

{"name":"$s1","value":"\"C:\\\\Windows\\\\SysNative\\\\mswsock.dll\" fullword ascii"}
{"name":"$s2","value":"\"C:\\\\Windows\\\\SysWOW64\\\\mswsock.dll\" fullword ascii"}
{"name":"$s3","value":"\"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Termite.exe\" fullword ascii"}
{"name":"$s4","value":"\"SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\\\\Payment.exe\" fullword ascii"}
{"name":"$s5","value":"\"C:\\\\Windows\\\\Termite.exe\" fullword ascii"}
{"name":"$s6","value":"\"\\\\Shell\\\\Open\\\\Command\\\\\" fullword ascii"}
{"name":"$s7","value":"\"t314.520@qq.com\" fullword ascii"}
{"name":"$s8","value":"\"(*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR)|*.JPG;*.PNG;*.BMP;*.GIF;*.ICO;*.CUR|JPG\" fullword ascii"}

Threat Analysis

This YARA rule is designed to detect general threats.

Severity Level: Critical

The rule uses pattern matching to identify specific byte sequences, strings, or behavioral patterns associated with malicious activity.

Detection Capabilities

  • File-based detection for executables and documents
  • Memory scanning for running processes
  • Network traffic analysis support

Command Line Usage

# Scan a single file
yara termite_ransomware.yar /path/to/suspicious/file

# Scan a directory recursively
yara -r termite_ransomware.yar /path/to/directory/

# Scan with metadata output
yara -m termite_ransomware.yar target_file

# Scan process memory (Linux)
yara termite_ransomware.yar /proc/[pid]/exe

Integration Examples

Python (yara-python)

import yara
rules = yara.compile(filepath='termite_ransomware.yar')
matches = rules.match('/path/to/file')

ClamAV Integration

clamscan --yara-rules=termite_ransomware.yar /path/to/scan

Rule Information

YARA ID
YARA-2025-0847
Created
August 19, 2025
Last Updated
August 19, 2025
Last Imported
Never

Threat Intelligence

Risk Level Critical
Category general
Detection Confidence Analysis Pending
False Positive Rate Not Available
Last Seen in Wild No Data

Export Options