{"group":"darkside","count":1,"rules":[{"rule_name":"darkside.yar","rule_text":"rule Darkside_linux {\n\tmeta:\n\t\tdescription = \"darkside ransomware linux version\"\n\t\tauthor = \"Alienvault Labs\"\n\t\tcopyright = \"Alienvault Inc. 2021\"\n\tstrings:\n\t\t$s1 = \"[END] Remove Self\"\n\t\t$s2 = \"[CFG] Landing URL#[\"\n\t\t$s3 = \"Welcome to DarkSide\"\n\t\t$dec_loop = { 0F B6 02 84 C0 74 1C 0F B6 B1 DF A7 89 00 40 38 F0 74 10 48 83 C1 01 31 F0 48 83 F9 20 88 02 49 0F 44 C8 }\n\tcondition:\n\t\tuint32(0) == 0x464C457F and all of them\n}","sha256":"1979d2e395bc484f5d6735d2ac2fc61ebbe775c01e7626d3e526ad2ab141d65f","byte_size":423,"updated_at":"2026-06-24 05:16:01"}]}