ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the Retis ransomware by identifying specific byte sequences related to its file searching, drive enumeration, and file encryption functionalities. The rule looks for three distinct patterns: one associated with searching files, another with enumerating drives, and a third with the encryption process. All three patterns must be present for a detection to occur, along with the standard PE file magic number (MZ header).
This YARA rule detects the Pacman ransomware by identifying specific byte code patterns within executable files. The rule looks for distinct sequences of bytes associated with the ransomware's file encryption and file finding functionalities, indicating the presence of Pacman ransomware.
This Yara rule detects the Povlsomware ransomware. It identifies specific bytecode patterns associated with the ransomware's setup, file discovery, and encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file (indicated by the 'MZ' header).
This rule detects the Thanos ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines, and remote connection capabilities. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Thanos ransomware's operational logic.
This rule detects the WildFire ransomware by identifying specific bytecode patterns associated with its file encryption routines, drive enumeration, file searching, and remote server communication. The rule looks for a combination of these patterns within a file, indicating the presence of the WildFire ransomware.
This YARA rule detects the WormLocker ransomware by identifying specific bytecode patterns related to setting environment variables, finding files, and encrypting files. The rule looks for distinct sequences of bytecode instructions that are characteristic of WormLocker's operational logic.
This rule detects the ZeroLocker ransomware by identifying specific bytecode patterns within executable files. The rule looks for three distinct encryption routine patterns ($encrypt_routine_1, $encrypt_routine_2, and $encrypt_routine_3) in files that start with the 'MZ' header (indicating a Windows executable). The presence of all three patterns strongly suggests the file is ZeroLocker ransomware.
This YARA rule detects the CobraLocker ransomware by identifying specific bytecode patterns associated with its file encryption and file discovery routines. The rule looks for a combination of patterns in the `encrypt_files` and `find_files` sections, along with checking for the MZ header (uint16(0) == 0x5A4D) to ensure it's an executable.
Yara rule that detects Cring ransomware.
Yara rule that detects Dusk ransomware.
Page 23 of 62