ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the CryptoFortress ransomware by identifying specific byte patterns (hexadecimal sequences) within executable files. The rule looks for code sections related to enumerating drives and shared resources, finding files, encrypting files, reading configuration files, and specific encryption routines. The conditions ensure that the detected patterns are present in a PE file (MZ header) and that either a combination of configuration/encryption routines or drive/file enumeration and encryption functions are found.
This Yara rule detects the CryptoJoker ransomware based on specific byte sequences found within the malware's code. The rule looks for patterns related to encryption calls, file encryption routines, process initiation, message box timers, and unpacking/assembly resolution, indicating the presence of CryptoJoker.
This YARA rule detects the CryptoLocker ransomware by identifying specific byte sequences (strings) associated with its file looping, data encryption, and data decryption routines. The rule looks for combinations of these patterns within executable files (identified by the 'MZ' header) to increase accuracy.
This YARA rule detects various versions of the CryptoWall ransomware based on specific byte patterns found at the entry point and within API loading, hash calculation, file finding, and file encryption routines. It targets both version 2.0 and 3.0 variants of the ransomware by looking for distinct code sequences indicative of their malicious functionality.
This YARA rule detects the Crysis ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code related to remote connections, file enumeration, resource enumeration, and file encryption, which are characteristic behaviors of ransomware.
This rule detects the Cuba ransomware based on specific byte patterns found within the executable. The patterns are associated with functions for enumerating resources, finding files, and encrypting files, which are characteristic behaviors of ransomware.
This YARA rule detects various versions of the DMALocker ransomware. It identifies specific byte patterns associated with file encryption routines, enumeration of shares and logical disks, and remote server communication, indicating the presence and activity of DMALocker.
This YARA rule detects the DMR ransomware by identifying specific byte patterns associated with its file discovery and encryption routines. The rule looks for distinct code segments that are characteristic of how this ransomware locates files on a system and subsequently encrypts them.
This rule detects the Defray ransomware by identifying specific byte patterns related to its file finding, special folder enumeration, file encryption routines, and remote connection capabilities. The rule looks for a combination of these patterns within a PE file to indicate the presence of Defray ransomware.
This YARA rule detects the Delphimorix ransomware by identifying specific byte sequences (patterns) associated with its file encryption and file finding routines. The rule looks for a combination of these patterns within a file, along with the MZ header (0x5A4D) indicating a Windows executable.
Page 40 of 62