ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the DogeCrypt ransomware by identifying specific byte patterns associated with its file encryption, file finding, and decryption key container functions. The rule looks for a combination of these patterns within a PE file (indicated by the 'MZ' header).
This YARA rule detects the Zhen ransomware by identifying specific byte patterns associated with its file finding, file encryption, and network scanning functionalities. The rule looks for distinct sequences of instructions that are characteristic of how Zhen ransomware operates, including patterns related to locating files, encrypting them, and scanning the network for additional targets. The rule requires all three sets of patterns (find_files, encrypt_files, and scan_network) to be present within a PE file (indicated by the 'MZ' header) to trigger a detection.
Yara rule that detects DogeCrypt ransomware.
Yara rule that detects Zhen ransomware.
This rule detects the Curator ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file, indicating the presence of the ransomware.
Yara rule that detects Curator ransomware.
This YARA rule detects the Flamingo ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for a combination of byte sequences indicative of the ransomware's operational logic, specifically related to locating files for encryption and the encryption process itself. The rule requires both the 'find_files' and 'encrypt_files' patterns to be present within a PE (Portable Executable) file to trigger, ensuring a higher confidence detection of the Flamingo ransomware.
This YARA rule detects the Pay2Key ransomware based on specific byte patterns found in its code. The patterns indicate functionality related to finding files, encrypting files, and establishing remote connections, which are characteristic behaviors of ransomware.
Yara rule that detects Flamingo ransomware.
Yara rule that detects Pay2Key ransomware.
Page 27 of 62