ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the GusCrypter ransomware based on specific byte patterns found in its executable code. The patterns are categorized into sections for finding files, encrypting files, and miscellaneous checks, indicating the core functionalities of the ransomware.
This YARA rule detects the Ransomexx ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file to confirm the presence of Ransomexx.
Yara rule that detects GusCrypter ransomware.
Yara rule that detects Ransomexx ransomware.
This rule detects the Dualshot ransomware based on specific byte patterns found within the executable. The patterns are associated with the ransomware's file encryption and file finding functionalities, indicating the presence of the Dualshot malware.
This Yara rule detects the Skystars ransomware. It identifies specific byte patterns ($search_files_p1, $search_files_p2, $encrypt_files, $main_routine) within executable files that are characteristic of the Skystars ransomware's file searching, encryption, and main routine functionalities. The rule requires the presence of the MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, indicating a high confidence match for the malware.
Yara rule that detects Dualshot ransomware.
Yara rule that detects Skystars ransomware.
This YARA rule detects the Badbeeteam ransomware by identifying specific byte patterns associated with its file finding, file encryption, and HTA file dropping functionalities. The rule looks for distinct sequences of bytes in the executable to identify the presence of this particular ransomware.
This YARA rule detects the Thanatos ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule requires the presence of the standard Windows executable MZ header (0x5A4D at offset 0) and specific byte sequences related to file enumeration and encryption functions within the binary.
Page 32 of 62