ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This rule detects the DearCry ransomware based on specific byte patterns found within its executable code. The patterns are associated with the ransomware's functionality for dropping ransom notes and finding files to encrypt.
This YARA rule detects the Vovalex ransomware by identifying specific byte patterns associated with its file encryption and file discovery routines. The rule looks for a combination of patterns related to how the ransomware encrypts files and how it finds files on the system, ensuring a high confidence detection of the Vovalex malware.
Yara rule that detects DearCry ransomware.
Yara rule that detects Vovalex ransomware.
This YARA rule detects the AnteFrigus ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files on the system, encrypting files, and establishing remote connections, likely for command and control or data exfiltration. The rule also checks for the standard Windows executable 'MZ' header.
This rule detects the HentaiOniichan ransomware based on specific byte patterns found in its executable code. The patterns indicate functionalities related to finding files, injecting code into processes, encrypting files, and establishing remote connections. The rule specifically looks for the MZ header (0x5A4D) to confirm it's a Windows executable and then matches against all defined string patterns for high confidence detection.
Yara rule that detects AnteFrigus ransomware.
Yara rule that detects Hentai Oniichan ransomware.
This YARA rule detects the FuxSocy ransomware by identifying specific byte patterns associated with its file encryption and file discovery functionalities. The rule targets Windows executable files (indicated by the 'MZ' header) and looks for distinct code sequences that perform actions typical of ransomware, such as locating files on the system and subsequently encrypting them.
Yara rule that detects FuxSocy ransomware.
Page 29 of 62