ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Win32 PUA Domaiq
YARA
Yara rule that detects Domaiq potentially unwanted application.
Yara rule that detects Alcatraz ransomware.
This rule detects the dlMarlboro downloader based on specific byte patterns found within the executable. The patterns '$ping_apnic', '$download_bin_1', and '$download_bin_2' are indicative of the malware's code for network communication (pinging apnic) and downloading additional binaries.
This YARA rule detects the Marlboro ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with network communication (pinging APNIC, remote server connections) and file encryption routines. The presence of these combined patterns indicates the likely presence of the Marlboro ransomware.
Yara rule that detects dlMarlboro downloader.
Yara rule that detects Marlboro ransomware.
This rule detects files that exploit CVE-2020-0601, a spoofing vulnerability in Windows CryptoAPI (Crypt32.dll). The rule specifically looks for the presence of a particular Object Identifier (OID) for prime explicit curve parameters and a set of known Elliptic Curve Cryptography (ECC) public keys within a Portable Executable (PE) file that also has a digital signature. This combination of indicators is characteristic of the 'CurveBall' exploit, which leverages the vulnerability to spoof code-signing certificates.
This rule detects the MultigrainPOS infostealer by identifying specific byte patterns associated with its data exfiltration, memory scraping (likely for credentials), process searching, and service creation functionalities. It includes two versions of these patterns (v10_1 and v11_1) to cover different variants of the malware. The rule specifically targets executable files (MZ header check).
This YARA rule detects the ProjectHookPOS infostealer by identifying specific byte sequences (hex patterns) within executable files. The patterns correspond to functions related to calculating Luhn algorithm checksums (often used for credit card validation), reversing track data (common in POS malware for magnetic stripe data), checking validity, encoding and sending stolen data, and creating forms (potentially for data input or exfiltration). The rule requires all seven defined byte sequences to be present in a file that starts with the standard DOS executable magic number (0x5A4D) to trigger a detection.
This YARA rule detects the KillDisk ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and its capability to subvert GRUB (Grand Unified Bootloader). The rule looks for a combination of these patterns within a file, indicating the presence of KillDisk ransomware, which is known for its data wiping and encryption capabilities, often rendering systems unbootable.
Page 37 of 62