ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects Gomer ransomware.
Yara rule that detects Sifreli ransomware.
This YARA rule detects the Balaclava ransomware based on specific byte patterns found in its executable. The patterns are associated with functions responsible for finding files, encrypting files, and identifying volumes, which are core functionalities of ransomware.
This YARA rule detects the Horsedeal ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for code segments responsible for enumerating system resources, searching for processes, discovering files on the system, and performing file encryption. The presence of all these patterns, along with a valid Windows executable header, indicates the presence of the Horsedeal ransomware.
Yara rule that detects Balaclava ransomware.
Yara rule that detects Horsedeal ransomware.
This YARA rule detects the AwesomeScott ransomware by identifying specific byte patterns associated with its file encryption and file finding routines. The rule looks for a combination of three distinct byte sequences related to file encryption ($encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3) and one byte sequence related to file discovery ($find_files). All identified patterns must be present for a match, along with the standard Windows executable MZ header (uint16(0) == 0x5A4D).
This YARA rule detects the Dridex banking Trojan by identifying specific byte patterns (API wrapper functions and file search snippets) commonly found in its executables. The rule requires the file to be a Windows executable (MZ header) and contain at least one of the defined API wrapper patterns and one of the file search patterns.
Yara rule that detects AwesomeScott ransomware.
Yara rule that detects Dridex trojan.
Page 35 of 62