ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the BandarChor ransomware based on specific byte patterns found within the executable. The rule looks for multiple sequences of bytes ($file_extensions_1 through $file_extensions_5) which likely correspond to code sections involved in file encryption or manipulation, and an additional pattern ($parse_server_commands) which might relate to command and control communication or internal logic for parsing commands. The rule requires all these byte patterns to be present, along with the MZ header (uint16(0) == 0x5A4D), indicating a Windows executable.
This YARA rule detects the BitCrypt ransomware based on specific byte patterns found within the executable. The rule looks for a combination of distinct code sequences related to BCDedit manipulation, drive enumeration (A-Z), file extension handling, and core ransomware logic. The detection is anchored to the entry point of a Portable Executable (PE) file, ensuring that the identified patterns are part of the executable's primary code flow.
This YARA rule detects the Blitzkrieg ransomware by identifying specific byte patterns associated with its core functionalities: file encryption, searching for files to encrypt, and disabling services. The rule looks for distinct sequences of bytes that indicate these malicious behaviors within a Windows executable file.
This YARA rule detects the BrainCrypt ransomware by identifying specific byte patterns (strings) associated with its 32-bit and 64-bit versions. The rule looks for functions related to enumerating files for encryption, encrypting files, and connecting to a command-and-control server. The presence of these specific byte sequences indicates the presence of BrainCrypt ransomware.
This YARA rule detects the Buran ransomware by identifying specific byte patterns related to file enumeration, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects the Clop ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and its capability to uninstall ESET antivirus software. The rule looks for distinct sequences of bytes that are characteristic of Clop's operational methods.
This YARA rule detects the Cryakl ransomware by identifying specific byte sequences associated with its file enumeration and encryption routines. The rule looks for two distinct patterns, `$enum_and_encrypt_files_1` and `$enum_and_encrypt_files_2`, within a file that also starts with the MZ header (0x5A4D). These patterns are indicative of the ransomware's core functionality related to finding and encrypting files on a system.
This rule detects the Crypmic ransomware based on specific byte patterns found within the executable. The patterns, named '$search_and_encrypt_1' and '$search_and_encrypt_2', likely correspond to code sections responsible for searching for and encrypting files, a core functionality of ransomware. The rule also checks for the standard Windows PE header (MZ header) to ensure it's analyzing a Windows executable.
This YARA rule detects the Crypren ransomware by identifying specific byte sequences associated with its functionality. The rule looks for patterns related to enumerating directories, enumerating drives, and encrypting files, which are core behaviors of ransomware.
This rule detects the CryptoBit ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
Page 39 of 62