{
  "Event": {
    "uuid": "1c4057d8-6ee8-5c89-b45d-adc83d437048",
    "info": "Arsenal-237 New Files: full_test_enc.exe (Advanced Rust Ransomware)",
    "date": "2026-01-15",
    "threat_level_id": 1,
    "analysis": 2,
    "timestamp": 1791727759,
    "publish_timestamp": 1791727759,
    "published": true,
    "Orgc": {
      "name": "The Hunters Ledger",
      "uuid": "8bc8284b-deb5-546c-a233-57ea34b2ea0d"
    },
    "Tag": [
      {
        "name": "tlp:clear",
        "colour": "#ffffff"
      },
      {
        "name": "hunters-ledger:topic=\"Ransomware\"",
        "colour": "#58a6ff"
      },
      {
        "name": "hunters-ledger:topic=\"Rust\"",
        "colour": "#58a6ff"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Network Share Discovery - T1135\"",
        "colour": "#0088cc"
      },
      {
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Encrypted for Impact - T1486\"",
        "colour": "#0088cc"
      }
    ],
    "Attribute": [
      {
        "uuid": "175b5434-c2ed-58cb-acab-b89905ac21ef",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/",
        "to_ids": false,
        "comment": "Detection rules, The Hunters Ledger",
        "timestamp": 1791727759
      },
      {
        "uuid": "25bf3d6a-9fa1-5c15-a625-4fa0982cd8a2",
        "type": "link",
        "category": "External analysis",
        "value": "https://the-hunters-ledger.com/ioc-feeds/arsenal-237-full_test_enc-exe.json",
        "to_ids": false,
        "comment": "IOC feed (JSON), The Hunters Ledger",
        "timestamp": 1791727759
      },
      {
        "uuid": "f2bbab94-d203-5caf-93cc-d2dc0ed87848",
        "type": "sigma",
        "category": "Payload installation",
        "value": "title: Non-Standard-Path Net Use Execution (Base Rule)\nid: 3f8a1c2d-6b4e-4a91-9c73-1d5e8f2a6b90\nname: arsenal237_netuse_nonstandard_exec\nstatus: experimental\ndescription: >-\n  Base rule (not alerting on its own): execution of a process outside standard\n  install directories with a command line containing \"net use\" -- network\n  share discovery/mapping behavior. Paired with the .lockbox file-creation base\n  rule below via the correlation rule, which flags co-occurrence of both\n  Arsenal-237 ransomware-chain artifacts on the same host.\nreferences:\n  - https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/\nauthor: The Hunters Ledger\ndate: '2026-01-27'\ntags:\n  - attack.discovery\n  - attack.t1135\n  - detection.emerging-threats\nlogsource:\n  category: process_creation\n  product: windows\ndetection:\n  selection:\n    CommandLine|contains: 'net use'\n  filter_main_paths:\n    Image|startswith:\n      - 'C:\\Windows\\'\n      - 'C:\\Program Files'\n  filter_admin:\n    User|contains: 'SYSTEM'\n    ParentImage|endswith:\n      - 'svchost.exe'\n      - 'lsass.exe'\n  condition: selection and not 1 of filter_*\nfalsepositives:\n  - >-\n    Administrative tools and batch scripts routinely invoke net use for\n    legitimate drive-mapping. Not alerting on its own -- reviewed only in\n    combination with the paired .lockbox file-creation base rule.\nlevel: informational\n---\ntitle: .lockbox File Creation (Base Rule)\nid: 7e2b9d4f-1a83-46c5-b2e9-4f7c1a9d3e58\nname: arsenal237_lockbox_file_creation\nstatus: experimental\ndescription: >-\n  Base rule (not alerting on its own): creation of a file with the .lockbox\n  extension used by Arsenal-237 to mark ransomware-encrypted output. Paired\n  with the net use execution base rule above via the correlation rule below.\nreferences:\n  - https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/\nauthor: The Hunters Ledger\ndate: '2026-01-27'\ntags:\n  - attack.impact\n  - attack.t1486\n  - detection.emerging-threats\nlogsource:\n  category: file_event\n  product: windows\ndetection:\n  selection:\n    TargetFilename|endswith: '.lockbox'\n  filter:\n    Image|contains:\n      - 'C:\\Program Files'\n      - 'C:\\Program Files (x86)'\n      - 'C:\\Windows\\System32'\n      - 'C:\\Windows\\SysWOW64'\n  condition: selection and not filter\nfalsepositives:\n  - >-\n    Legitimate backup software or database processes choosing a custom\n    .lockbox extension is not expected but cannot be fully ruled out. Not\n    alerting on its own -- reviewed only in combination with the paired net\n    use base rule.\nlevel: informational\n---\ntitle: 'Arsenal-237 Ransomware Chain: Net Use Execution + .lockbox Creation on Same Host'\nid: 9c4d7e2a-5f13-48b6-a1d9-2e6b8c4f0a73\nstatus: experimental\ndescription: >-\n  Fires when both non-standard-path net use execution and .lockbox file\n  creation are observed on the same host within a short window. Neither base\n  signal alone is reliable -- net use is a legitimate Windows command\n  routinely used by administrative tooling, and a bare file-extension match is\n  trivially evaded by an operator renaming the extension in a future build --\n  but the combination of a network-share-discovery command followed by\n  appearance of a distinctively-extensioned encrypted-file marker on the same\n  host is a behavioral sequence not expected from unrelated benign activity.\nreferences:\n  - https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/\nauthor: The Hunters Ledger\ndate: '2026-01-27'\ntags:\n  - attack.discovery\n  - attack.impact\n  - attack.t1135\n  - attack.t1486\n  - detection.emerging-threats\ncorrelation:\n  type: temporal\n  rules:\n    - arsenal237_netuse_nonstandard_exec\n    - arsenal237_lockbox_file_creation\n  group-by:\n    - host.name\n  timespan: 15m\nfalsepositives:\n  - >-\n    An administrator legitimately running net use for drive-mapping on a host\n    that, coincidentally and within the same 15-minute window, also receives\n    an unrelated file ending in .lockbox from unrelated legitimate software\n    using that extension.\nlevel: medium",
        "to_ids": false,
        "comment": "Arsenal-237 Ransomware Chain: Net Use Execution + .lockbox Creation (Correlation) | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1135, T1486 | rule hash ba34d7c6 | https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/",
        "timestamp": 1791727759,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "ae6c8cb7-3543-56ef-b745-def452aee293",
        "type": "yara",
        "category": "Payload installation",
        "value": "/*\n   Yara Rule Set\n   Identifier: Arsenal-237-Lockbox-Ransomware\n   Author: The Hunters Ledger\n   Source: https://the-hunters-ledger.com/\n   License: CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\n*/\n\nrule TOOLKIT_Arsenal237_Ransom_Note_And_Lockbox_Extension {\n   meta:\n      description = \"Detects the Arsenal-237 ransomware's ransom-note banner and Ransom ID victim-identifier label together with the .lockbox encrypted-file extension, or (an alternate path specific to this non-stripped build) its three operational logging strings.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/\"\n      date = \"2026-01-27\"\n      family = \"Arsenal-237\"\n      malware_type = \"Ransomware\"\n      campaign = \"Arsenal-237-Lockbox-Ransomware\"\n      id = \"b4c73e5f-4092-4da3-9f28-6ea3d71a2c04\"\n      hash1 = \"4d1fe7b54a0ce9ce2082c167b662ec138b890e3f305e67bdc13a5e9a24708518\"\n   strings:\n      $ransom1 = \"YOUR FILES HAVE BEEN ENCRYPTED!\" ascii wide\n      $ransom2 = \"Ransom ID:\" ascii wide\n      $lockbox = \".lockbox\" ascii wide\n\n      $log1 = \"[*] Encryptor starting...\" ascii\n      $log2 = \"[*] Encrypting all drives...\" ascii\n      $log3 = \"[+] Encryption complete!\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize > 10MB and filesize < 20MB and\n      (\n         ($ransom1 and $ransom2 and $lockbox) or\n         (all of ($log*))\n      )\n}",
        "to_ids": true,
        "comment": "Ransom Note, Ransom ID Label, and .lockbox Extension | TIER: Detection | robustness 2 | confidence HIGH | ATT&CK T1486 | rule hash 81224bba | https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/",
        "timestamp": 1791727759,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "f037d7d6-3ce6-5220-8403-5900273c0e9e",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule TOOLKIT_Arsenal237_Custom_Crypto_Error_Strings {\n   meta:\n      description = \"Detects at least two of three bespoke error-handling strings the Arsenal-237 ransomware's ChaCha20/RSA encryption engine emits on operation failure. Salvaged from a broader original rule that also combined generic Rust crate paths (rayon, walkdir, sysinfo) and bare, unqualified VMware/VirtualBox string matches -- both dropped for lacking malware-specific discriminating power.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/\"\n      date = \"2026-01-27\"\n      family = \"Arsenal-237\"\n      malware_type = \"Ransomware\"\n      campaign = \"Arsenal-237-Lockbox-Ransomware\"\n      id = \"c5d84f60-5103-4eb4-a039-7fb4e82b3d15\"\n      hash1 = \"4d1fe7b54a0ce9ce2082c167b662ec138b890e3f305e67bdc13a5e9a24708518\"\n   strings:\n      $encrypt_error1 = \"Failed to encrypt nonce\" ascii\n      $encrypt_error2 = \"Failed to encrypt key\" ascii\n      $encrypt_error3 = \"Block encryption failed\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize > 10MB and\n      2 of them\n}",
        "to_ids": false,
        "comment": "Custom Crypto-Engine Error Strings | TIER: Hunting | robustness 2 | confidence LOW | ATT&CK T1486 | rule hash a6a4412d | https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/",
        "timestamp": 1791727759,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "45278518-cf7a-5b78-a6b5-bd242e8b7cdd",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule TOOLKIT_Arsenal237_NetUse_Execution_Error_String {\n   meta:\n      description = \"Detects the bespoke 'Failed to execute net use' error string the Arsenal-237 ransomware's network-share-enumeration routine emits when its net use invocation fails. Salvaged from a broader original rule that also mandated a bare 3-byte 'SMB' substring and offered a 2-byte UNC-backslash pattern as an alternate anchor, plus generic path/flag strings -- all dropped for falling under the project's 4-byte specificity floor or being common to unrelated software.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/\"\n      date = \"2026-01-27\"\n      family = \"Arsenal-237\"\n      malware_type = \"Ransomware\"\n      campaign = \"Arsenal-237-Lockbox-Ransomware\"\n      id = \"d6e95071-6214-4fc5-b14a-80c5f93c4e26\"\n      hash1 = \"4d1fe7b54a0ce9ce2082c167b662ec138b890e3f305e67bdc13a5e9a24708518\"\n   strings:\n      $netuse_error = \"Failed to execute net use\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize > 10MB and\n      $netuse_error\n}",
        "to_ids": false,
        "comment": "net use Execution Error String | TIER: Hunting | robustness 1 | confidence LOW | ATT&CK T1135 | rule hash 7b1ff3e7 | https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/",
        "timestamp": 1791727759,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "edf77613-0483-5fcd-b46a-4b3d00467b92",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule TOOLKIT_Arsenal237_Ransomware_Comprehensive_Indicators {\n   meta:\n      description = \"Detects Arsenal-237 ransomware samples via a mandatory combination of the ransom-note banner plus ChaCha20/RSA crypto crate-path evidence, corroborated by parallel-processing/system-enumeration crate evidence and by the .lockbox extension, net use string, or Ransom ID label.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/\"\n      date = \"2026-01-27\"\n      family = \"Arsenal-237\"\n      malware_type = \"Ransomware\"\n      campaign = \"Arsenal-237-Lockbox-Ransomware\"\n      id = \"e7fa6182-7325-40d6-825b-91d6a04d5f37\"\n      hash1 = \"4d1fe7b54a0ce9ce2082c167b662ec138b890e3f305e67bdc13a5e9a24708518\"\n   strings:\n      $chacha = \"/chacha20-\" ascii\n      $rsa_lib = \"/rsa-\" ascii\n\n      $ransom = \"YOUR FILES HAVE BEEN ENCRYPTED!\" ascii wide\n      $ransom_id = \"Ransom ID\" ascii\n\n      $rayon = \"/rayon-\" ascii\n      $walkdir = \"/walkdir-\" ascii\n      $sysinfo = \"/sysinfo-\" ascii\n\n      $lockbox = \".lockbox\" ascii\n      $netuse = \"net use\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize > 10MB and filesize < 20MB and\n      $chacha and $rsa_lib and $ransom and\n      (1 of ($rayon, $walkdir, $sysinfo)) and\n      ($lockbox or $netuse or $ransom_id)\n}",
        "to_ids": true,
        "comment": "Comprehensive Ransomware Indicator Combination | TIER: Detection | robustness 3 | confidence HIGH | ATT&CK T1486, T1135 | rule hash 20aa408d | https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/",
        "timestamp": 1791727759,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Detection\"",
            "colour": "#4ade80"
          }
        ]
      },
      {
        "uuid": "ffb18736-d7ed-5173-8d46-25943f8c9328",
        "type": "yara",
        "category": "Payload installation",
        "value": "rule TOOLKIT_Arsenal237_RustCrypto_ChaCha20_RSA_Combination {\n   meta:\n      description = \"Detects Rust binaries embedding the versioned RustCrypto chacha20 and rsa crate-path strings plus at least one of four others (aead, cipher, digest, rand) observed in the Arsenal-237 ransomware's crypto stack. The RustCrypto crate family is also used by unrelated legitimate Rust encryption software; not goodware-validated.\"\n      license = \"CC BY 4.0 - https://creativecommons.org/licenses/by/4.0/\"\n      author = \"The Hunters Ledger\"\n      reference = \"https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/\"\n      date = \"2026-01-27\"\n      modified = \"2026-10-10\"\n      family = \"Arsenal-237\"\n      malware_type = \"Ransomware\"\n      campaign = \"Arsenal-237-Lockbox-Ransomware\"\n      id = \"a1b62d4e-3f81-4c92-8e17-5d9a2c60f1b3\"\n      hash1 = \"4d1fe7b54a0ce9ce2082c167b662ec138b890e3f305e67bdc13a5e9a24708518\"\n   strings:\n      $chacha20 = \"/chacha20-0.9.1/src/lib.rs\" ascii\n      $rsa = \"/rsa-0.9.9/src/algorithms/\" ascii\n      $aead = \"/aead-0.5.2/src/lib.rs\" ascii\n      $cipher = \"/cipher-0.4.4/\" ascii\n      $digest = \"/digest-0.10.7/\" ascii\n      $rand = \"/rand-0.8.5/\" ascii\n   condition:\n      uint16(0) == 0x5A4D and\n      filesize > 10MB and\n      $chacha20 and $rsa and\n      1 of ($aead, $cipher, $digest, $rand)\n}",
        "to_ids": false,
        "comment": "RustCrypto ChaCha20 + RSA Crate Combination | TIER: Hunting | robustness 2 | confidence MODERATE | ATT&CK T1486 | rule hash 1549ecce | https://the-hunters-ledger.com/hunting-detections/arsenal-237-full_test_enc-exe-detections/",
        "timestamp": 1791727759,
        "Tag": [
          {
            "name": "hunters-ledger:tier=\"Hunting\"",
            "colour": "#4ade80"
          }
        ]
      }
    ],
    "Object": []
  }
}