The sandrorat YARA rule detects potential malicious activity associated with a known ransomware variant, indicating possible lateral movement or data exfiltration. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate early-stage ransomware threats before significant damage occurs.
YARA Rule
rule sandrorat: amtrckr
{
meta:
family = "sandrorat"
condition:
androguard.url(/tak\.no-ip\.info/) or
androguard.url(/maskaralama\.ddns\.net/) or
androguard.url(/sondres1\.ddns\.net/) or
androguard.url(/toyman6699\.no-ip\.info/) or
androguard.url(/appmarket\.servehttp\.com/) or
androguard.url(/31\.210\.117\.132/) or
androguard.url(/freeann\.sytes\.net/) or
androguard.url(/changyu231\.ddns\.net/) or
androguard.url(/mohammed22468\.no-ip\.biz/) or
androguard.url(/oneriakosa\.ddns\.net/) or
androguard.url(/46\.186\.155\.219/) or
androguard.url(/jockerhackerxnxx\.ddns\.net/) or
androguard.url(/41\.251\.251\.7/) or
androguard.url(/megalol\.chickenkiller\.com/) or
androguard.url(/188\.166\.76\.144/) or
androguard.url(/injectman\.no-ip\.info/) or
androguard.url(/aasxzxdsc12324\.no-ip\.biz/) or
androguard.url(/magemankoktelam\.ddns\.net/) or
androguard.url(/alfazaai99\.ddns\.net/) or
androguard.url(/dantehack\.zapto\.org/) or
androguard.url(/droidjack1\.sytes\.net/) or
androguard.url(/th3expert\.3utilities\.com/) or
androguard.url(/mohamed46565656\.no-ip\.biz/) or
androguard.url(/chrisfo\.no-ip\.org/) or
androguard.url(/hazhar77\.no-ip\.biz/) or
androguard.url(/31\.146\.202\.169/) or
androguard.url(/njesra\.ddns\.net/) or
androguard.url(/yorkiepet\.ddns\.net/) or
androguard.url(/mrgnet\.ddns\.net/) or
androguard.url(/droy\.zapto\.org/) or
androguard.url(/93\.104\.213\.217/) or
androguard.url(/amarok58\.no-ip\.biz/) or
androguard.url(/server4update\.serveftp\.com/) or
androguard.url(/zaliminxx\.duckdns\.org/) or
androguard.url(/anonymo9s\.ddns\.net/) or
androguard.url(/htmp\.sytes\.net/) or
androguard.url(/khalid-2016\.noip\.me/) or
androguard.url(/mahasiswa\.no-ip\.biz/) or
androguard.url(/mamal9921\.ddns\.net/) or
androguard.url(/kaddress\.ddns\.net/) or
androguard.url(/sharmayash\.no-ip\.biz/) or
androguard.url(/RATForAndroid\.ddns\.net/) or
androguard.url(/shabbushah\.duckdns\.org/) or
androguard.url(/osammer0asmam3a\.ddns\.net/) or
androguard.url(/themayhen23\.no-ip\.org/) or
androguard.url(/wxf2009817\.f3322\.net/) or
androguard.url(/miioolinase\.ddns\.net/) or
androguard.url(/motoshi\.zapto\.org/) or
androguard.url(/88\.150\.149\.91/) or
androguard.url(/info\.bounceme\.net/) or
androguard.url(/samira\.no-ip\.biz/) or
androguard.url(/31\.210\.69\.156/) or
androguard.url(/93\.79\.212\.194/) or
androguard.url(/futurasky\.no-ip\.biz/) or
androguard.url(/rat\.capsulelab\.us/) or
androguard.url(/fruby\.zapto\.org/) or
androguard.url(/iraqn6777\.ddns\.net/) or
androguard.url(/samsung\.apps\.linkpc\.net/) or
androguard.url(/eldiablo\.no-ip\.biz/) or
androguard.url(/system32\.com/) or
androguard.url(/haker33sadekgafer\.no-ip\.biz/) or
androguard.url(/droidjack258\.bounceme\.net/) or
androguard.url(/cardangi\.no-ip\.org/) or
androguard.url(/fazoro66\.ddns\.net/) or
androguard.url(/androidalbums\.ddns\.net/) or
androguard.url(/tedy1993\.ddns\.net/) or
androguard.url(/109\.73\.68\.114/) or
androguard.url(/alaa-1982\.no-ip\.biz/) or
androguard.url(/facrbook\.redirectme\.net/) or
androguard.url(/androidan\.ddns\.net/) or
androguard.url(/learnxea\.duckdns\.org/) or
androguard.url(/audreysaradin\.no-ip\.org/) or
androguard.url(/178\.124\.182\.38/) or
androguard.url(/mobiles0ft\.no-ip\.org/) or
androguard.url(/cybercrysis\.ddns\.net/) or
androguard.url(/playstore\.ddns\.net/) or
androguard.url(/blind1234\.ddns\.net/) or
androguard.url(/chanks\.no-ip\.biz/) or
androguard.url(/lomo\.com/) or
androguard.url(/ayadd19\.no-ip\.org/) or
androguard.url(/bitoandroid\.no-ip\.info/) or
androguard.url(/androidtool\.ddns\.net/) or
androguard.url(/authd\.ddns\.net/) or
androguard.url(/carapuce-2015\.no-ip\.biz/) or
androguard.url(/aliyusef6\.no-ip\.biz/) or
androguard.url(/bannding\.ddns\.net/) or
androguard.url(/momen-swesi\.no-ip\.biz/) or
androguard.url(/wogusnb\.no-ip\.info/) or
androguard.url(/noussa\.no-ip\.biz/) or
androguard.url(/droidjackv5\.ddns\.net/) or
androguard.url(/alanbkey\.no-ip\.org/) or
androguard.url(/androidrat21\.ddns\.net/) or
androguard.url(/diceedicee\.ddns\.net/) or
androguard.url(/178\.20\.230\.44/) or
androguard.url(/strateg\.ddns\.net/) or
androguard.url(/hasn9999\.ddns\.net/) or
androguard.url(/anonymousip\.no-ip\.org/) or
androguard.url(/fucks\.ddns\.net/) or
androguard.url(/shahidsajan\.no-ip\.biz/) or
androguard.url(/spicymemes\.duckdns\.org/) or
androguard.url(/hackermoqtada\.no-ip\.biz/) or
androguard.url(/andro\.no-ip\.biz/) or
androguard.url(/goggle\.sytes\.net/) or
androguard.url(/anonymous666\.zapto\.org/) or
androguard.url(/dnsdynamic\.org/) or
androguard.url(/jomo\.zapto\.org/) or
androguard.url(/adobflash\.hopto\.org/) or
androguard.url(/iqram85spy\.ddns\.net/) or
androguard.url(/moussa-hak\.no-ip\.biz/) or
androguard.url(/williettinger\.cc/) or
androguard.url(/usa2222\.ddns\.net/) or
androguard.url(/22134520\.ddns\.net/) or
androguard.url(/android1\.ddns\.net/) or
androguard.url(/109\.122\.41\.237/) or
androguard.url(/droidjack\.hopto\.org/) or
androguard.url(/randsnaira\.dnsdynamic\.com/) or
androguard.url(/egytiger\.myftp\.org/) or
androguard.url(/hehe\.duckdns\.org/) or
androguard.url(/seven1\.ddns\.net/) or
androguard.url(/younix\.ddns\.net/) or
androguard.url(/huntergold\.no-ip\.biz/) or
androguard.url(/151\.246\.230\.21/) or
androguard.url(/xos1982\.ddns\.net/) or
androguard.url(/85\.136\.243\.80/) or
androguard.url(/yelp01\.f3322\.org/) or
androguard.url(/teolandia\.no-ip\.biz/) or
androguard.url(/jokerbabel\.no-ip\.biz/) or
androguard.url(/cccamd\.myftp\.biz/) or
androguard.url(/109\.165\.69\.25/) or
androguard.url(/googles\.servemp3\.com/) or
androguard.url(/vb\.blogsyte\.com/) or
androguard.url(/karrarhuseein82\.ddns\.net/) or
androguard.url(/applecenikosmos\.hldns\.ru/) or
androguard.url(/dadadadadaprivet\.ddns\.net/) or
androguard.url(/1349874791\.gnway\.cc/) or
androguard.url(/bapforall\.ddns\.net/) or
androguard.url(/mahamadmahmod\.ddns\.net/) or
androguard.url(/nademhack\.no-ip\.org/) or
androguard.url(/42\.236\.159\.93/) or
androguard.url(/myaw\.no-ip\.biz/) or
androguard.url(/msn-web\.ddnsking\.com/) or
androguard.url(/draagon\.ddns\.net/) or
androguard.url(/winlogen\.duckdns\.org/) or
androguard.url(/albash2222\.ddns\.net/) or
androguard.url(/82\.223\.31\.121/) or
androguard.url(/ahmed2012\.dynu\.com/) or
androguard.url(/188\.3\.13\.98/) or
androguard.url(/hardik\.no-ip\.info/) or
androguard.url(/asdqqq\.bounceme\.net/) or
androguard.url(/test\.no-ip\.org/) or
androguard.url(/housam\.linkpc\.net/) or
androguard.url(/evilcasper\.ddns\.net/) or
androguard.url(/kilasx\.ddns\.net/) or
androguard.url(/pars\.ddns\.net/) or
androguard.url(/noiphackk\.ddns\.net/) or
androguard.url(/hack1111\.noip\.me/) or
androguard.url(/hackhack2016\.no-ip\.info/) or
androguard.url(/haxor\.hopto\.org/) or
androguard.url(/zokor-zokor\.ddns\.net/) or
androguard.url(/xzoro2016\.no-ip\.info/) or
androguard.url(/81\.177\.33\.218/) or
androguard.url(/momo2015\.duckdns\.org/) or
androguard.url(/pimpdaddy\.myq-see\.com/) or
androguard.url(/scropion20078\.no-ip\.biz/) or
androguard.url(/106\.51\.163\.232/) or
androguard.url(/fuckyou\.duckdns\.org/) or
androguard.url(/zakifr\.no-ip\.biz/) or
androguard.url(/microsoft-office\.ddns\.net/) or
androguard.url(/2\.25\.171\.244/) or
androguard.url(/85\.202\.29\.79/) or
androguard.url(/mariorossi2013\.homepc\.it/) or
androguard.url(/hackcam\.zapto\.org/) or
androguard.url(/mokhter222029\.ddns\.net/) or
androguard.url(/win32\.ddns\.net/) or
androguard.url(/ggwasgeht\.ddns\.net/) or
androguard.url(/dexonic\.duckdns\.org/) or
androguard.url(/coxiamigo\.myq-see\.com/) or
androguard.url(/hamidoranis\.no-ip\.biz/) or
androguard.url(/ospr\.publicvm\.com/) or
androguard.url(/karasqlee9\.no-ip\.org/) or
androguard.url(/hax\.no-ip\.info/) or
androguard.url(/haa7aah\.no-ip\.biz/) or
androguard.url(/omar\.no-ip\.biz/) or
androguard.url(/yuosaf1993\.ddns\.net/) or
androguard.url(/88\.164\.37\.97/) or
androguard.url(/88\.247\.226\.120/) or
androguard.url(/indusv00\.duckdns\.org/) or
androguard.url(/andver18\.no-ip\.biz/) or
androguard.url(/unknownuser\.no-ip\.biz/) or
androguard.url(/nassahsliman\.ddns\.net/) or
androguard.url(/gcafegood\.noip\.me/) or
androguard.url(/rockrock\.ddns\.net/) or
androguard.url(/188\.24\.119\.27/) or
androguard.url(/93\.157\.235\.248/) or
androguard.url(/komplevit-rat\.ddns\.net/) or
androguard.url(/pianotiles2\.ddns\.net/) or
androguard.url(/tobytori18\.myftp\.org/) or
androguard.url(/105\.106\.49\.154/) or
androguard.url(/moonmar10\.no-ip\.biz/) or
androguard.url(/100009755836320\.no-ip\.biz/) or
androguard.url(/villevalo\.chickenkiller\.com/) or
androguard.url(/samoomalik\.no-ip\.biz/) or
androguard.url(/foxfeline\.no-ip\.org/) or
androguard.url(/kskdt\.ddns\.net/) or
androguard.url(/fati43030\.no-ip\.biz/) or
androguard.url(/shop10\.ddns\.net/) or
androguard.url(/fairylow\.no-ip\.biz/) or
androguard.url(/a\.tomx\.xyz/) or
androguard.url(/r90\.no-ip\.biz/) or
androguard.url(/46\.45\.207\.81/) or
androguard.url(/warrirrs\.no-ip\.org/) or
androguard.url(/azert123\.ddns\.net/) or
androguard.url(/soso\.noip\.us/) or
androguard.url(/sniperyakub\.ddns\.net/) or
androguard.url(/baby\.webhop\.me/) or
androguard.url(/zero228\.ddns\.net/) or
androguard.url(/reddemon\.ddns\.net/) or
androguard.url(/viagra\.jumpingcrab\.com/) or
androguard.url(/domira\.ddns\.net/) or
androguard.url(/alkingahmed555\.ddns\.net/) or
androguard.url(/mahdi3141\.ddns\.net/) or
androguard.url(/somenormalguy\.duckdns\.org/) or
androguard.url(/shoo2018\.no-ip\.org/) or
androguard.url(/goldeneagle1112\.ddns\.net/) or
androguard.url(/hardstyleraver\.no-ip\.org/) or
androguard.url(/79\.141\.163\.20/) or
androguard.url(/mezoo32\.no-ip\.biz/) or
androguard.url(/islam2020libya\.no-ip\.biz/) or
androguard.url(/kingdom\.no-ip\.biz/) or
androguard.url(/x300x300xx\.no-ip\.org/) or
androguard.url(/puplicdsl\.ddns\.net/) or
androguard.url(/teda11\.zapto\.org/) or
androguard.url(/testsss\.ddns\.net/) or
androguard.url(/185\.32\.221\.23/) or
androguard.url(/topmax\.myq-see\.com/) or
androguard.url(/sarasisi\.no-ip\.org/) or
androguard.url(/dodee97dodee\.ddns\.net/) or
androguard.url(/kararkarar0780\.ddns\.net/) or
androguard.url(/darweshfis\.no-ip\.org/) or
androguard.url(/jastn\.ddns\.net/) or
androguard.url(/flashplayerxx\.no-ip\.org/) or
androguard.url(/thaer\.no-ip\.biz/) or
androguard.url(/elisou19\.ddns\.net/) or
androguard.url(/dkms\.ddns\.net/) or
androguard.url(/aaaa\.com/) or
androguard.url(/liquidixen\.ddns\.net/) or
androguard.url(/moep004\.no-ip\.org/) or
androguard.url(/aaaaaaaaaabbbbb\.hopto\.org/) or
androguard.url(/rok13198666\.no-ip\.biz/) or
androguard.url(/1337ace\.ddns\.net/) or
androguard.url(/droidjack33\.no-ip\.biz/) or
androguard.url(/abdouoahmed\.ddns\.net/) or
androguard.url(/bambi\.no-ip\.biz/) or
androguard.url(/e777kx47\.ddns\.net/) or
androguard.url(/shanks\.no-ip\.biz/) or
androguard.url(/black1990\.ddns\.net/) or
androguard.url(/brave-hacker\.no-ip\.org/) or
androguard.url(/ala6a\.no-ip\.biz/) or
androguard.url(/sarahwygan\.no-ip\.biz/) or
androguard.url(/khantac\.ddns\.net/) or
androguard.url(/107\.151\.193\.126/) or
androguard.url(/madov-matrix25\.no-ip\.org/) or
androguard.url(/93\.185\.151\.217/) or
androguard.url(/203\.189\.232\.237/) or
androguard.url(/zxczxczxc\.ddns\.net/) or
androguard.url(/07726657423zaion\.no-ip\.biz/) or
androguard.url(/amran-pc\.no-ip\.biz/) or
androguard.url(/myfrenid2x\.zapto\.org/) or
androguard.url(/winserver\.dlinkddns\.com/) or
androguard.url(/mzgerges\.no-ip\.biz/) or
androguard.url(/cjbks0u0\.no-ip\.org/) or
androguard.url(/silenthunter3021\.no-ip\.org/) or
androguard.url(/engrid\.no-ip\.biz/) or
androguard.url(/137\.0\.0\.1/) or
androguard.url(/snopi\.no-ip\.biz/) or
androguard.url(/hhamokcha\.ddns\.net/) or
androguard.url(/clashdroid\.no-ip\.biz/) or
androguard.url(/jkgytgasjg12\.serveftp\.com/) or
androguard.url(/owsen\.ddns\.net/) or
androguard.url(/thegangsterrap\.noip\.me/) or
androguard.url(/81\.4\.104\.129/) or
androguard.url(/droid\.deutsche-db-bank\.ru/) or
androguard.url(/gold5000\.ddns\.net/) or
androguard.url(/hassanabd1233\.ddns\.net/) or
androguard.url(/love2014\.ddns\.net/) or
androguard.url(/bassamzeyad\.ddns\.net/) or
androguard.url(/denishul\.hldns\.ru/) or
androguard.url(/hacker-81\.no-ip\.biz/) or
androguard.url(/noipjajaja\.ddns\.net/) or
androguard.url(/41\.38\.56\.81/) or
androguard.url(/tataline\.hopto\.org/) or
androguard.url(/abedjaradat1177\.no-ip\.org/) or
androguard.url(/voda\.no-ip\.org/) or
androguard.url(/mohamednjrat111\.no-ip\.biz/) or
androguard.url(/hakeerali2\.ddns\.net/) or
androguard.url(/5\.189\.137\.186/) or
androguard.url(/79\.137\.223\.139/) or
androguard.url(/makarand\.no-ip\.org/) or
androguard.url(/mehost\.ddns\.net/) or
androguard.url(/xmohcine\.ddns\.net/) or
androguard.url(/alabama192837\.no-ip\.org/)
}This YARA rule can be deployed in the following contexts:
Scenario: Scheduled System Maintenance Task
Description: A legitimate system maintenance task, such as a Windows Task Scheduler job that runs a script or executable, may trigger the rule due to similar file signatures.
Filter/Exclusion: Check for ProcessName containing schtasks.exe or Task Scheduler in the event log, or filter by ProcessCommandLine containing /create or /run.
Scenario: Antivirus Quarantine Process
Description: An antivirus tool like Bitdefender or Kaspersky may temporarily move files to quarantine, which could match the YARA signature of the sandrorat malware.
Filter/Exclusion: Filter by ProcessName containing bitdefender or kaspersky, or check for ParentProcessName related to the antivirus service.
Scenario: Legitimate Software Update Job
Description: A scheduled job running a legitimate software update (e.g., Microsoft Update or a vendor-specific patching tool) may trigger the rule if the update package matches the YARA signature.
Filter/Exclusion: Filter by ProcessName containing wusa.exe or msiexec.exe, or check for CommandLine arguments related to updates or patches.
Scenario: Admin-Initiated File Copy or Move
Description: An administrator may manually copy or move files using tools like robocopy, xcopy, or copy, which could trigger the rule if the file matches the YARA signature.
Filter/Exclusion: Filter by ProcessName containing robocopy.exe or xcopy.exe, or check for User field indicating an admin account.
Scenario: Log File Parsing or Analysis Tool
Description: Tools like Splunk, ELK Stack, or Graylog may process log files and generate temporary