ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This rule detects the Ghostbin ransomware by identifying specific bytecode patterns related to environment setup, file enumeration, and file encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the magic number 0x5A4D at the beginning of the file.
This rule detects the TaRRaK ransomware based on specific bytecode patterns. The patterns indicate functionality related to finding and encrypting files, changing the desktop background, and dropping a ransom note. The rule specifically targets MSIL (Microsoft Intermediate Language) bytecode, suggesting it's designed for .NET executables.
Yara rule that detects Ghostbin ransomware.
Yara rule that detects TaRRaK ransomware.
This YARA rule detects the Cring ransomware based on specific bytecode patterns. The rule looks for distinct sequences of bytes related to file finding and encryption operations, which are characteristic of the Cring ransomware family. The presence of these patterns indicates that a file is likely a Cring ransomware executable.
This rule detects the Dusk ransomware by identifying specific bytecode patterns associated with its file encryption routines, file finding mechanisms, and self-deletion functionality. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header.
This YARA rule detects the Fantom ransomware by identifying specific byte sequences associated with its file encryption routines, lock file creation, directory locking mechanisms, and key sending functions. The rule looks for a combination of these patterns within a file to confirm the presence of Fantom ransomware.
This rule detects the GhosTEncryptor ransomware by identifying specific byte patterns related to its folder enumeration and encryption routines. The rule looks for a combination of patterns that indicate the ransomware's logic for enumerating folders and encrypting files within those folders, as well as deep search functionalities. The presence of these specific byte sequences, along with the MZ header, strongly suggests the presence of GhosTEncryptor.
This rule detects the Namaste ransomware by identifying specific bytecode patterns associated with its file discovery and encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of how Namaste ransomware locates files on a system and subsequently encrypts them. The `find_files_p*` strings target patterns related to file system enumeration, while the `encrypt_files_p*` strings target patterns involved in the encryption process itself. The rule also checks for the standard PE file magic number (0x5A4D) to ensure it's analyzing an executable.
This rule detects the Oct ransomware based on specific bytecode patterns associated with its file encryption, file finding, and environment collection routines. The rule looks for a combination of three distinct byte sequences within a PE file, indicating the presence of Oct ransomware functionality.
Page 22 of 62