ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This Yara rule detects the Plague17 ransomware by identifying specific byte sequences associated with its file finding, file encryption, and remote connection functionalities. The rule looks for distinct patterns in the malware's code related to these core ransomware behaviors.
Yara rule that detects Plague17 ransomware.
This YARA rule detects the InfoDot ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for distinct sequences of bytes ($find_files_p1, $find_files_p2, $find_files_p3, $find_files_p4) that are indicative of the ransomware's file enumeration logic, and another sequence ($encrypt_files) that signifies its encryption functionality. The rule requires all file finding patterns and the encryption pattern to be present within a Portable Executable (MZ header) to trigger, ensuring a high confidence detection of the InfoDot ransomware.
Yara rule that detects InfoDot ransomware.
This rule detects the ShadowCryptor ransomware based on specific byte patterns indicative of its file finding, file encryption, and antivirus termination routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.
This YARA rule detects the WinWord64 ransomware by identifying specific byte patterns related to remote connections, file encryption routines, and file discovery mechanisms. The rule looks for a combination of these patterns within a PE file (indicated by 'uint16(0) == 0x5A4D' for 'MZ' header). The 'remote_connection_p*' strings suggest network communication capabilities, while 'encrypt_files_p*' strings indicate file encryption functionality, and 'find_files' points to file enumeration or discovery.
Yara rule that detects ShadowCryptor ransomware.
Yara rule that detects WinWord64 ransomware.
This Yara rule detects the Babuk ransomware by identifying specific byte sequences related to its file enumeration, file encryption, and resource enumeration functionalities. The rule looks for distinct patterns in the malware's code that are characteristic of Babuk's operations.
This YARA rule detects the 'Major' ransomware by identifying specific byte patterns related to file enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a Windows executable (MZ header).
Page 30 of 62