ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects Badbeeteam ransomware.
Yara rule that detects Thanatos ransomware.
This YARA rule detects the BlackMoon ransomware by identifying specific byte patterns related to file enumeration and encryption routines. The rule looks for a combination of a standard PE file header (MZ header) and distinct byte sequences associated with how BlackMoon ransomware finds and encrypts files.
This YARA rule detects the HakunaMatata ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for multiple combinations of these patterns to increase accuracy and reduce false positives. It also includes patterns related to service installation, which is a common persistence mechanism for ransomware.
Yara rule that detects BlackMoon ransomware.
Yara rule that detects HakunaMatata ransomware.
This YARA rule detects the Dragon ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with remote connections, file discovery, file encryption routines, and a unique characteristic of skipping Hong Kong, China, and Taiwan in its operations. The presence of these combined patterns indicates the likely presence of the Dragon ransomware.
This Yara rule detects the Makop ransomware by identifying specific byte patterns associated with its file enumeration, network resource enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE executable (indicated by the 'MZ' header).
Yara rule that detects Dragon ransomware.
Yara rule that detects Makop ransomware.
Page 33 of 62