Detections

Analysis of Flash Alert: EtherRat and TukTuk C2 End in The Gentleman Ransomware

EtherRat Delivery Leading to The Gentleman Ransomware

sigma · generated; parse required before publication

title: EtherRat Delivery Leading to The Gentleman Ransomware
description: Detects EtherRat binary dropping The Gentleman Ransomware payload and
  wiping system event logs.
logsource:
  product: windows
  service: sysmon
detection:
  selection:
    Image: '*\wevtutil.exe'
    CommandLine: '*cl*System*'
  condition: selection
level: medium
tags: []
references: []

MAL_RANSOM_TheGentleman_EtherRat

yara · compile required before publication

rule MAL_RANSOM_TheGentleman_EtherRat {
  strings:
    $s1 = "EtherRat_C2_Client" ascii wide nocase
    $s2 = "The_Gentleman_Ransomware_Note" ascii wide nocase
    $s3 = "DisableAntiSpyware_Registry" ascii wide nocase
  condition:
    any of them
}