ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This rule detects the BananaCrypt ransomware based on specific byte patterns found in its 'encrypt_files' and 'find_files' functions. The rule looks for a combination of these patterns within a PE (Portable Executable) file, indicated by the 'MZ' header.
Yara rule that detects BananaCrypt ransomware.
This YARA rule detects the Termite ransomware by identifying specific byte sequences (patterns) associated with its file finding and encryption routines. The rule looks for distinct code blocks that are characteristic of how Termite ransomware operates to locate files and then encrypt them. The rule requires all parts of the 'find_files' patterns and all parts of the 'encrypt_files' patterns to be present, along with the MZ header (0x5A4D) indicating a Windows executable, to minimize false positives.
Yara rule that detects Termite ransomware.
This YARA rule detects the JuicyLemon ransomware by identifying specific byte sequences related to remote connections and file encryption routines. The rule looks for three distinct patterns: two associated with remote connection functionalities and one with the core logic for finding and encrypting files. All three patterns must be present, along with the standard Windows PE magic number (0x5A4D), to trigger a detection.
This YARA rule detects the KawaiiLocker ransomware based on specific byte patterns found in its executable code. The rule looks for distinct sequences related to file searching, remote connections, and file encryption routines, indicating the presence and functionality of the KawaiiLocker ransomware.
Yara rule that detects JuicyLemon ransomware.
Yara rule that detects KawaiiLocker ransomware.
This rule detects the Domaiq Potentially Unwanted Application (PUA) by identifying a specific payload string and a combination of code patterns. These patterns include checks for NSIS (Nullsoft Scriptable Install System) integrity, UPX (Ultimate Packer for eXecutables) decompression and encryption, various dumping functions, and exception handling routines. The presence of these combined signatures indicates the likely presence of the Domaiq PUA.
This YARA rule detects the Alcatraz ransomware by identifying specific byte patterns associated with its file encryption routines and its communication with remote servers. The rule looks for three distinct byte sequences: one related to file encryption logic ($encrypt_files) and two others related to remote server communication ($remote_server and $remote_server_2). All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
Page 36 of 62