ailock

Para detección/bloqueo en tu EDR/SIEM. Fuente: ransomware.live.

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

rule CyberCrime_AiLock_AiLockRansomware {
    meta:
        description = "Detection rule for AiLock Ransomware"
        author = "gmrdkd@s2w.inc"
        created_at = "2025-04-03"
        version = "v1.0"
        reference = "-"

        threat_actor = "AiLock"
        category = "Malware"
        malware_name = "AiLock Ransomware"
        severity = "High"

        hash1 = "2a728d98ae8280efeaa674783181f3fa"

    strings:
        $string1 = ".AiLock" ascii wide nocase
        $string2 = "Start Log:%d Network:%d Selfdelete:%d Path=%s" ascii wide nocase
        $string3 = "Total time of encryption: %llu seconds" ascii wide nocase
        $string4 = "read=%u kbytes, write=%u kbytes, opened=%u, encPS=%u, totalFound=%u, TotalEncrypted=%u" ascii wide nocase
        $string5 = "Single instance only Exit" ascii wide nocase

        $marker1 = {BE BA AD AB}
        $marker2 = {B5 00 6B B1}
        $marker3 = {00 B5 B1 6B}
        $marker4 = {DE AD BA BE}
        $marker5 = {BA BE DE AD}

    condition:
        uint16(0) == 0x5A4D
        and all of ($marker*)
        and 2 of ($string*)
}

Hello,
The key data points of your network has been compromised, and all of your company's critical data has been transferred to our secure systems.
Positive News:
- We are capable of fully restoring your systems and data.
- If we come to an agreement, this incident will remain confidential between your organization and our team.
- Our motivation is purely financial, and we do not align with any specific country or political ideology
Terms and Conditions:
1) You must contact us within 72 hours; otherwise, we will publish an announcement  about the leak of your data.
2) You have 5 days to reach an agreement; If you fail to do so, your data will be published and the recovery tool destroyed.
To initiate the negotiation process, please proceed with the following steps:
1) Download the Tor Browser from it's official website: [redactado]
2) Use the provided credentials to log into the Chat for text-based negotiations: [redactado]
We all understand what happened and what consequences await you.
All countries have their own PDPL (Personal Data Protection Law) regulations.
In the event that you do not agree with us, information pertaining to your companies and the data of your company's customers will be published on the internet, and the respective country's personal data usage authority will be informed.
Moreover, confidential data related to your company will be shared with potential competitors through email and social media.
You can be sure that you will incur damages far exceeding the amount we are requesting from you should you decide not to agree with us.
What we offer in exchange for your payment:
  - Full decryption and restoration of systems and data following an incident, completed within 24 hours.
  - We guarantee that all recovered data will remain confidential and that all of your leaked data will be securely deleted from our servers after resolving the incident. We will provide a full deletion log.
  - Expert advice tailored to strengthen your company's IT infrastructure against future threats.
Useful tips that will help you :
	1) Do not try to recover files yourself.
	2) Do not modify encrypted files.
	3) Do not use third party software to restore your data.

• https://www.ransomware.live/group/ailock

• Technology
  2
• Not Found
  2
• Business Services
  2
• Construction
  2
• Manufacturing