YARA Rules — Community Threat Intelligence

GenieLocker YARA Detection Rule for BastionGuard

Join the BastionGuard community Sign in to start discussions, reply, follow topics and receive notifications.
Create account Sign in
Calogero ScarnàOffline
MoreLess
Member since
5 March 2025
Posted
1 August 2026 23:51
  • Joined Mar 2025
  • 0 reputation
  • 22 posts
#1

Author: Calogero Scarnà
Rule file:

GenieLocker_BastionGuard.yara


Installation directory:

/usr/share/BastionGuard/data/yara


Target platforms: Windows, Linux, and VMware ESXi

Overview

This post publishes a complete YARA 4.x ruleset for detecting known and suspicious samples associated with GenieLocker, a ransomware family targeting Windows, Linux, and VMware ESXi systems.

The ruleset is intended for BastionGuard's user-managed workflow:

  1. BastionGuard scans the file with YARA.
  2. A matching rule produces an immediate notification.
  3. The user reviews the alert and its context.
  4. The user decides whether to block, quarantine, allow, or investigate the file.

The rules contain no hidden remediation and do not automatically make the final security decision on behalf of the user. The

response_mode = "user_managed"

metadata documents this operating model.

Detection Coverage

The ruleset contains separate detections for:

  • Published GenieLocker Windows samples using exact MD5 indicators.
  • The published Linux and VMware ESXi sample using an exact MD5 indicator.
  • Probable Windows PE variants using static behavioural indicators.
  • Probable Linux and VMware ESXi ELF variants.
  • The VCJOURN auxiliary journal artifact associated with encryption activity.

Exact-hash matches are high-confidence indicators. Heuristic matches provide broader coverage but must be reviewed in context before blocking or quarantining a file.

Installation

Create the BastionGuard YARA directory if it does not already exist: 

sudo install -d -m 0755 /usr/share/BastionGuard/data/yara

Copy the rule into the directory: 

sudo install -m 0644 GenieLocker_BastionGuard.yara /usr/share/BastionGuard/data/yara/GenieLocker_BastionGuard.yara

The resulting path must be: 

/usr/share/BastionGuard/data/yara/GenieLocker_BastionGuard.yara

After installation, reload the local YARA rules through BastionGuard using the normal rule-management procedure for your deployment.

Integrity Verification

Linux: 

sha256sum /usr/share/BastionGuard/data/yara/GenieLocker_BastionGuard.yara

Expected SHA-256 for the normalized YARA file provided with this post (UTF-8, LF line endings): 

cfdce19bbfe46b491a2e86033b076930453ce5f7c8d8c386180babb962fe0dea

Recommended Alert Handling

Exact IOC match

Treat a match from either exact-hash rule as critical. Review the alert and, when confirmed, block or quarantine the file. Check whether it was executed and inspect the host for related activity.

Heuristic match

Review the file path, hash, digital signature, parent process, command line, execution context, and matched strings. A heuristic match is important evidence, but it is not by itself conclusive proof that the file is malicious.

VCJOURN artifact match

Treat this as a possible sign of active or completed encryption activity. Inspect nearby files and running processes immediately, then decide whether host isolation, blocking, or quarantine is appropriate.

Complete YARA Rule

Save the following content as

GenieLocker_BastionGuard.yara

: 

/*
  GenieLocker ransomware detection rules for BastionGuard / YARA 4.x

  Purpose:
  - Detect known GenieLocker Windows, Linux, and VMware ESXi samples.
  - Detect probable new variants using high-specificity static indicators.
  - Detect the GenieLocker VCJOURN auxiliary journal artifact.

  Response model: BastionGuard reports matches to the user, who decides
  whether to block, quarantine, allow, or investigate the file.

  Intelligence sources:
  - Kaspersky Securelist, "Toy Ghouls' new toy: the GenieLocker ransomware", 2026-07-30.
  - Tom's Hardware Italia, "GenieLocker si evolve: Windows, Linux ed ESXi sono nel mirino", 2026-07-30.

  MD5 is used here only because the published IOC list used MD5.
  The rule does not execute automatic remediation.
*/

import "hash"

/* PRIVATE HELPERS: EXACT PUBLISHED SAMPLE HASHES */
private rule GenieLocker_Known_Windows_MD5 {
    condition:
        filesize > 0 and filesize <= 100MB and (
            hash.md5(0, filesize) == "a50eaaf514f4f84e61ca2455a8789753"
            or hash.md5(0, filesize) == "f08f476f26b01d142ca73923de65fc0c"
            or hash.md5(0, filesize) == "fd46a80c2f45577263328984edf7f4dc"
            or hash.md5(0, filesize) == "de3cfbb50f66079bfee20a6f64e59433"
            or hash.md5(0, filesize) == "780c8f4c6f077da4da96582987920362"
            or hash.md5(0, filesize) == "d87d0b01d95acc936b7dc47b8f41937a"
            or hash.md5(0, filesize) == "34a7f28e0bb69b0d49bacc88bdf20ac1"
            or hash.md5(0, filesize) == "5d62c1349b8981c396c9a23f4f8f053c"
            or hash.md5(0, filesize) == "a8842616c9057d5cf6e1fe1fa8c3c160"
            or hash.md5(0, filesize) == "34b8828635f88078735799a3c1ac8e28"
            or hash.md5(0, filesize) == "d3e06eb34d8eee7ef92cac3ad0a20ff5"
            or hash.md5(0, filesize) == "c68b6862725777651085650db34947fc"
            or hash.md5(0, filesize) == "9cd514ff2809ce0b993e3b8649e82a94"
            or hash.md5(0, filesize) == "824ca1e906cc073ee5b0f3519df69a8f"
            or hash.md5(0, filesize) == "25480dad40152ef3d0c6d38eecc9bd9b"
            or hash.md5(0, filesize) == "7dad78584795aa5c160520cc6accf260"
            or hash.md5(0, filesize) == "18f61c6d686cffd131c9fd3f3437064b"
            or hash.md5(0, filesize) == "9969a8221312dba70dd5cbddf83a146c"
            or hash.md5(0, filesize) == "f7b9e36e94163a9a303160945f99267a"
            or hash.md5(0, filesize) == "b893eafed0659f70d4ac250f09073723"
            or hash.md5(0, filesize) == "d661cf666b9acbab7cfeae1127a261a9"
            or hash.md5(0, filesize) == "3a4479b51890373bfc4a011ef41fe376"
            or hash.md5(0, filesize) == "58c0dda52b8f069660166d61fd74f911"
        )
}

private rule GenieLocker_Known_Linux_ESXi_MD5 {
    condition:
        filesize > 0 and filesize <= 100MB and
        hash.md5(0, filesize) == "9201e35e2993612612919a3c71302cab"
}

/* EXACT IOC RULES */
rule GenieLocker_Known_Windows_Sample : ransomware genielocker windows exact_ioc {
    meta:
        author = "Calogero Scarnà"
        created = "2026-08-01"
        modified = "2026-08-01"
        description = "Detects published GenieLocker Windows samples by exact MD5"
        family = "GenieLocker"
        threat_actor = "Toy Ghouls"
        platform = "Windows"
        severity = "critical"
        confidence = "high"
        response_mode = "user_managed"
        recommendation = "Review alert and block or quarantine if the hash match is confirmed"
        source = "Kaspersky Securelist, 2026-07-30"
        reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"

    condition:
        GenieLocker_Known_Windows_MD5
}

rule GenieLocker_Known_Linux_ESXi_Sample : ransomware genielocker linux esxi exact_ioc {
    meta:
        author = "Calogero Scarnà"
        created = "2026-08-01"
        modified = "2026-08-01"
        description = "Detects the published GenieLocker Linux and VMware ESXi sample by exact MD5"
        family = "GenieLocker"
        threat_actor = "Toy Ghouls"
        platform = "Linux/VMware ESXi"
        severity = "critical"
        confidence = "high"
        response_mode = "user_managed"
        recommendation = "Review alert and block or quarantine if the hash match is confirmed"
        source = "Kaspersky Securelist, 2026-07-30"
        reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"

    condition:
        GenieLocker_Known_Linux_ESXi_MD5
}

/* WINDOWS PE HEURISTIC
   PE file combined with GenieLocker journal / extension indicators,
   exclusion/termination lists, CLI options and APIs.
*/
rule GenieLocker_Windows_PE_Heuristic : ransomware genielocker windows heuristic {
    meta:
        author = "Calogero Scarnà"
        created = "2026-08-01"
        modified = "2026-08-01"
        description = "Detects probable GenieLocker Windows PE variants using high-specificity static indicators"
        family = "GenieLocker"
        threat_actor = "Toy Ghouls"
        platform = "Windows"
        severity = "high"
        confidence = "medium-high"
        response_mode = "user_managed"
        recommendation = "Inspect path, signer, parent process, hash, and matched strings before quarantine"
        source = "Kaspersky Securelist technical analysis, 2026-07-30"
        reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"

    strings:
        /* File-encryption artifacts */
        $journal_magic = "VCJOURN" ascii wide
        $sample_extension = ".03ffc1c4a3da0f02" ascii wide

        /* Highly characteristic exclusion and target lists */
        $folder_exclusions_1 = "$recycle.bin;config.msi;$windows.~bt;$windows.~ws;windows;boot;program files;program files (x86);programdata" ascii wide nocase
        $folder_exclusions_2 = "system volume information;tor browser;windows.old;intel;msocache;perflogs;x64dbg;public;all users;default;microsoft;appdata" ascii wide nocase
        $file_exclusions = "autorun.inf;boot.ini;bootfont.bin;bootsect.bak;desktop.ini;iconcache.db;ntldr;ntuser.dat" ascii wide nocase
        $process_targets_1 = "sql;oracle;ocssd;dbsnmp;synctime;agntsvc;isqlplussvc;xfssvccon;mydesktopservice" ascii wide nocase
        $process_targets_2 = "excel;infopath;msaccess;mspub;onenote;outlook;powerpnt;steam;thebat;thunderbird;visio;winword" ascii wide nocase
        $process_targets_3 = "vmwp;vmms;vmcompute;mssqlserver" ascii wide nocase
        $service_targets_1 = "vss;sql;svc$;memtas;mepocs;msexchange;sophos;veeam;backup" ascii wide nocase
        $service_targets_2 = "GxVss;GxBlr;GxFWD;GxCVD;GxCIMgr" ascii wide nocase
        $service_targets_3 = "agent_ovpnconnect" ascii wide nocase

        /* Command-line interface */
        $option_percent_long = "--percent" ascii wide
        $option_recursive_long = "--recursive" ascii wide
        $option_log_long = "--log" ascii wide
        $option_percent_short = "-p" ascii wide fullword
        $option_recursive_short = "-r" ascii wide fullword
        $option_log_short = "-l" ascii wide fullword

        /* Anti-analysis and process/service manipulation APIs */
        $api_debug_local = "IsDebuggerPresent" ascii
        $api_debug_remote = "CheckRemoteDebuggerPresent" ascii
        $api_hostname = "GetComputerNameA" ascii
        $api_terminate = "TerminateProcess" ascii
        $api_control_service = "ControlService" ascii
        $api_current_pid = "GetCurrentProcessId" ascii

    condition:
        uint16(0) == 0x5A4D and
        filesize >= 20KB and filesize <= 100MB and (
            /* Strongest known combination */
            ($journal_magic and $sample_extension and 2 of ($api_*))
            or
            /* Multiple unique lists plus behavior APIs */
            (3 of ($folder_exclusions_*, $file_exclusions, $process_targets_*, $service_targets_*)
             and 3 of ($api_*) and 1 of ($option_*))
            or
            /* Journal marker, target lists, and CLI together */
            ($journal_magic and 2 of ($process_targets_*, $service_targets_*)
             and 2 of ($option_*) and 2 of ($api_*))
        )
}

/* LINUX / VMWARE ESXi ELF HEURISTIC
   ELF file combined with ESXi paths, CLI help, journal data and libsodium symbols.
*/
rule GenieLocker_Linux_ESXi_ELF_Heuristic : ransomware genielocker linux esxi heuristic {
    meta:
        author = "Calogero Scarnà"
        created = "2026-08-01"
        modified = "2026-08-01"
        description = "Detects probable GenieLocker Linux or VMware ESXi ELF variants"
        family = "GenieLocker"
        threat_actor = "Toy Ghouls"
        platform = "Linux/VMware ESXi"
        severity = "high"
        confidence = "medium-high"
        response_mode = "user_managed"
        recommendation = "Inspect execution context, target path, hash, and matched strings before quarantine"
        source = "Kaspersky Securelist technical analysis, 2026-07-30"
        reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"

    strings:
        /* ESXi-specific paths */
        $esxi_volume_path = "/vmfs/volumes" ascii
        $esxi_welcome_path = "/etc/vmware/welcome" ascii

        /* File-encryption artifact */
        $journal_magic = "VCJOURN" ascii

        /* Help/argument strings reported for the ELF build */
        $help_percent = "-p <perc>" ascii
        $help_workers = "-j <workers>" ascii
        $help_recursive = "-r <dir>" ascii
        $help_delay = "-w <sec>" ascii
        $help_daemon = "-d" ascii fullword
        $help_log = "-l <logfile>" ascii

        /* Common argument descriptions; useful when symbols are stripped */
        $text_percentage = "Percentage of file content to encrypt" ascii nocase
        $text_workers = "Number of encryption threads" ascii nocase
        $text_delay = "Delay before start" ascii nocase
        $text_logfile = "Path to log file" ascii nocase

        /* Potentially retained static libsodium symbol names */
        $sodium_xchacha_encrypt = "crypto_aead_xchacha20poly1305_ietf_encrypt" ascii
        $sodium_xchacha_decrypt = "crypto_aead_xchacha20poly1305_ietf_decrypt" ascii
        $sodium_box_easy = "crypto_box_easy" ascii
        $sodium_box_seal = "crypto_box_seal" ascii
        $sodium_init = "sodium_init" ascii

    condition:
        uint32(0) == 0x464C457F and
        filesize >= 20KB and filesize <= 100MB and (
            /* ESXi paths and multiple specific CLI strings */
            ($esxi_volume_path and $esxi_welcome_path and 3 of ($help_*))
            or
            /* ESXi target path plus journal and CLI */
            ($esxi_volume_path and $journal_magic and 3 of ($help_*))
            or
            /* ESXi paths plus cryptographic implementation evidence */
            ($esxi_volume_path and $esxi_welcome_path and 2 of ($sodium_*))
            or
            /* Tolerates modified help formatting */
            ($esxi_volume_path and 3 of ($text_*) and 2 of ($help_*, $sodium_*))
        )
}

/* POST-IMPACT JOURNAL ARTIFACT
   GenieLocker creates a small auxiliary journal with the "VCJOURN" magic.
   This may identify an encryption artifact rather than the executable.
*/
rule GenieLocker_VCJOURN_Artifact : ransomware genielocker artifact journal {
    meta:
        author = "Calogero Scarnà"
        created = "2026-08-01"
        modified = "2026-08-01"
        description = "Detects a probable GenieLocker VCJOURN auxiliary encryption journal"
        family = "GenieLocker"
        platform = "Windows/Linux/VMware ESXi"
        severity = "critical"
        confidence = "high"
        response_mode = "user_managed"
        recommendation = "Treat as possible active encryption; inspect nearby files and running processes immediately"
        source = "Kaspersky Securelist technical analysis, 2026-07-30"
        reference = "securelist.com/genielocker-ransomware-for-windows-linux-and-esxi/120843/"

    strings:
        $journal_magic = "VCJOURN" ascii

    condition:
        filesize >= 16 and filesize <= 1MB and $journal_magic at 0
}

Manual YARA Validation

Compile the rule when

yarac

is available: 

yarac GenieLocker_BastionGuard.yara GenieLocker_BastionGuard.yarc

Scan a single file: 

yara GenieLocker_BastionGuard.yara /path/to/file

Scan a directory recursively: 

yara -r GenieLocker_BastionGuard.yara /path/to/directory

Warning: Do not test with live ransomware on a production system. Use an isolated analysis environment or safe test artifacts. Heuristic matches can generate false positives.

References

Author: Calogero Scarnà

0

Sign in to reply