ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects Babuk ransomware.
Yara rule that detects Major ransomware.
This YARA rule detects the Conti ransomware by identifying specific byte patterns ($find_files, $encrypt_files_p1, $encrypt_files_p2) within executable files. These patterns are associated with the ransomware's file enumeration and encryption routines. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, aiming to minimize false positives.
This rule detects the Teslarvng ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and network share enumeration capabilities. The rule looks for distinct sequences of bytes that indicate the presence of the ransomware's core functionalities.
Yara rule that detects Conti ransomware.
Yara rule that detects Teslarvng ransomware.
This rule detects the Oni ransomware based on specific byte patterns ($find_files, $encrypt_files, $search_processes) found within executable files. The patterns indicate functionality related to searching for files, encrypting them, and potentially enumerating processes, which are characteristic behaviors of ransomware.
This YARA rule detects the WastedLocker ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for two distinct sets of byte sequences, '$find_files_p*' and '$encrypt_files_p*', which are indicative of the ransomware's operational code. The presence of all these patterns, combined with the standard PE file magic number (0x5A4D), suggests the presence of the WastedLocker malware.
Yara rule that detects Oni ransomware.
Yara rule that detects WastedLocker ransomware.
Page 31 of 62