Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks
donex.yar/*
Donex ransomware (DarkRace rebranding)
*/
rule Donex_Ransomnote
{
meta:
author = "ransomware.live"
family = "ransomware.donex"
description = "Detects Donex ransomware ransom note"
date = "2026-05-04"
severity = 7
score = 70
strings:
$s1 = "Donex" ascii nocase
$s2 = "DONEX" ascii
$s3 = "donex.onion" ascii nocase
$s4 = "!DONEX-README.txt" ascii nocase
condition:
any of them
}