ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This rule detects the Apis ransomware by identifying specific bytecode patterns related to its core functionalities: finding files, encrypting files, and setting up its environment. The rule looks for a combination of these distinct bytecode sequences within a file, indicating the presence of the ransomware.
This YARA rule detects the HotCoffee ransomware. It identifies specific byte patterns related to the ransomware's functionality, including enumerating drives, finding files, encrypting files, and dropping a ransom note. The rule looks for a combination of these patterns to ensure high confidence in detection.
Yara rule that detects Apis ransomware.
Yara rule that detects HotCoffee ransomware.
This YARA rule detects various versions of the Emotet trojan by identifying specific byte patterns (hexadecimal sequences) associated with its resource decryption and filename generation routines, as well as its use of the liblzf decompression algorithm and state machine snippets. The rule looks for combinations of these patterns within executable files (indicated by the 'MZ' header).
Yara rule that detects Emotet trojan.
This YARA rule detects the Invert ransomware by identifying specific byte sequences related to its file encryption, file finding, and file listing functionalities. The rule looks for distinct patterns in the compiled bytecode that are characteristic of the Invert ransomware's operations.
This rule detects the Sanwai ransomware based on specific byte patterns found within its executable code. The patterns '$find_files', '$import_key', and '$encrypt_files' are indicative of the ransomware's file searching, key importing, and file encryption functionalities. The rule also checks for the standard Windows executable magic number (MZ header).
Yara rule that detects Invert ransomware.
Yara rule that detects Sanwai ransomware.
Page 19 of 62