{"group":"losttrust","count":1,"rules":[{"rule_name":"losttrust.yar","rule_text":"rule LostTrust {\n\tmeta:\n\t\tdescription = \"rule to detect LostTrust ransomware\"\n\t\tauthor = \"ShadowStackRe.com\"\n\t\tdate = \"2023-11-26\"\n\t\tRule_Version = \"v1\"\n\t\tmalware_type = \"ransomware\"\n\t\tmalware_family = \"LostTrust\"\n\t\tLicense = \"MIT License, https://opensource.org/license/mit/\"\n\tstrings:\n\t\t$strOption1 = \"--onlypath\" ascii wide\n\t\t$strOption2 = \"--enable-shares\" ascii wide\n\t\t$strEncodedLog = \"ENCODED : %ws (total files : %d)\"\n\t\t$strExt = \".losttrustencoded\" ascii wide\n\t\t$strDecryptLog = \"decrypt file %ws, %ws\"\n\t\t$strReadMe1 = \"So we decided to change our business model.\"\n\t\t$strReadMe2 = \"This is serious business for us\"\n\tcondition:\n\t\tall of them\n}","sha256":"68851c38b1010e69465d8c6118e595e9c0cd2d96b44a4fbd94b893a04705c560","byte_size":651,"updated_at":"2026-06-24 05:16:02"}]}