ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This rule detects the CaddyWiper trojan, a destructive data wiper, by identifying specific byte patterns within executable files. The patterns correspond to functions involved in destroying data if the system is not a controller, erasing drive data, and recursively erasing drives.
Yara rule that detects CaddyWiper trojan.
This YARA rule detects the IsaacWiper trojan by identifying specific byte patterns related to its functionality. The rule looks for two distinct code sections: one responsible for enumerating physical drives and another for corrupting drive data. The presence of both patterns indicates the likely presence of the IsaacWiper malware, which is known for its destructive disk wiping capabilities.
Yara rule that detects IsaacWiper trojan.
This YARA rule detects the HermeticWiper malware based on a specific byte sequence ($corrupt_physical_drive) that is characteristic of its functionality to corrupt physical drives. The rule also checks for the standard PE file magic number (MZ header) to ensure it's applied to executable files.
Yara rule that detects HermeticWiper trojan.
This rule detects the TimeTime ransomware by identifying specific bytecode patterns associated with its file enumeration, encryption, and renaming activities. The rule looks for distinct sequences of operations related to finding files, encrypting files, encrypting folders, and renaming files, which are characteristic behaviors of ransomware.
This YARA rule detects the MRAC ransomware by identifying specific byte patterns associated with its file encryption routines, key import mechanisms, and file discovery functions. The rule looks for a combination of these patterns within a file, ensuring a higher confidence in detection.
Yara rule that detects TimeTime ransomware.
Yara rule that detects MRAC ransomware.
Page 16 of 62