{"group":"datakeeper","count":1,"rules":[{"rule_name":"datakeeper.yar","rule_text":"/*\ndatakeeper ransomware\n*/\n\nrule datakeeper_Ransomnote\n{\n    meta:\n        author = \"ransomware.live\"\n        family = \"ransomware.datakeeper\"\n        description = \"Detects datakeeper ransomware ransom note or artifact\"\n        date = \"2026-05-04\"\n        severity = 7\n        score = 70\n\n    strings:\n        $name1 = \"datakeeper\" ascii nocase\n        $name2 = \"DATAKEEPER\" ascii\n        $onion  = \"datakeeper.onion\" ascii nocase\n\n    condition:\n        any of them\n}","sha256":"a3b5443ffe2f9dfa8795a2c425c15798ea952931c7c58d316a0ad75109c322b5","byte_size":470,"updated_at":"2026-06-24 05:16:01"}]}