Detections

Analysis of Cat’s Got Your Files: Lynx Ransomware

Lynx Ransomware File Encryption and Service Termination

sigma · generated; parse required before publication

title: Lynx Ransomware File Encryption and Service Termination
description: Detects Lynx ransomware executing batch scripts to disable security services
  and encrypt network shares.
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: '7036'
    ServiceName: '*VSS*'
  condition: selection
level: medium
tags: []
references: []

MAL_RANSOM_Lynx_Locker

yara · compile required before publication

rule MAL_RANSOM_Lynx_Locker {
  strings:
    $s1 = "LYNX_ENCRYPTED_EXT" ascii wide nocase
    $s2 = "YOUR_FILES_HAVE_BEEN_LOCKED_BY_LYNX" ascii wide nocase
    $s3 = "ChaCha20_Poly1305_Tag" ascii wide nocase
  condition:
    any of them
}