ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the Linux-based LuckyJoe ransomware by identifying specific byte patterns within its main call functions and encryption routines. The rule looks for distinct sequences of assembly instructions related to the ransomware's core operations, including file encryption and internal message handling. The condition requires all parts of these identified patterns to be present, along with the ELF magic number, to ensure high fidelity detection of the LuckyJoe executable.
This rule detects the 5ss5c ransomware based on specific byte patterns found in its code. The patterns indicate functionality related to finding files, encrypting files, and establishing remote connections, which are characteristic behaviors of ransomware.
This YARA rule detects the ASN1Encoder ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of patterns indicative of ransomware behavior, including functions for finding files, encrypting them, and establishing remote connections, all within a Windows executable (MZ header check).
This rule detects the Ako ransomware by identifying specific byte patterns associated with its functionality. The patterns cover functions related to encrypting network shares, finding files, and encrypting files on a Windows system. The rule requires all three sets of patterns to be present, indicating a high confidence match for the Ako ransomware.
This rule detects the Afrodita ransomware by identifying specific byte patterns associated with its core functionalities. These patterns include code for finding files, encrypting them, and dropping ransom notes, with or without directory exclusion logic. The rule specifically targets Windows Portable Executable (PE) files.
This YARA rule detects the Armage ransomware by identifying specific byte patterns associated with its file encryption, file finding, and resource enumeration functionalities. The rule looks for distinct sequences of bytes within the executable, specifically in functions related to encrypting files, finding files to encrypt, and enumerating system resources, which are characteristic behaviors of ransomware.
This rule detects the Archiveus ransomware by identifying specific byte sequences ($entry_point, $dump_instruction, $extension_rule) within the Portable Executable (PE) file, combined with the presence of the string "INSTRUCTIONS HOW TO GET YOUR FILES BACK.txt". The rule checks for the MZ header (0x5A4D) and verifies that the $entry_point pattern is found at the PE entry point.
This YARA rule detects the Atlas ransomware by identifying specific byte patterns related to file encryption routines and network communication patterns, including sending POST and GET requests to remote servers. The rule looks for a combination of these patterns to minimize false positives.
This rule detects the BKRansomware ransomware based on specific byte patterns found within the executable. It looks for a combination of patterns related to file searching and encryption routines, indicating the presence of this particular ransomware strain.
This YARA rule detects the BadBlock ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for three distinct sets of byte sequences: one related to encrypting files, another for searching files, and a third for establishing remote connections. All three patterns must be present in a file, along with the MZ header (0x5A4D), for a detection to occur.
Page 38 of 62