ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the GPGQwerty ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for two distinct sets of byte sequences related to file enumeration (find_files_p1 and find_files_p2) and a third set related to file encryption (encrypt_files). All identified patterns must be present in a file that starts with the 'MZ' header (uint16(0) == 0x5A4D) to trigger a detection.
This YARA rule detects various versions of the GandCrab ransomware family by identifying specific byte patterns associated with its core functionalities. These functionalities include establishing remote connections, encrypting files, searching for files to encrypt, and enumerating antivirus processes to evade detection. The rule uses multiple sets of signatures to cover different versions and obfuscation techniques of GandCrab, ensuring a broad detection capability. The presence of these combined byte patterns within a Windows executable (MZ header check) indicates a high probability of GandCrab ransomware infection.
This YARA rule detects the GarrantyDecrypt ransomware by identifying specific byte patterns associated with its file encryption and file finding functionalities. The rule looks for a valid PE header (MZ magic bytes) and then checks for the presence of three distinct byte sequences: one related to finding files and two related to encrypting files. These patterns are indicative of the ransomware's core operations.
This YARA rule detects the Gibon ransomware by identifying specific byte patterns related to remote server connections and encryption loops within executable files. The rule requires the presence of a standard Windows PE header (MZ) and a combination of byte sequences indicative of Gibon's network communication and file encryption routines.
This YARA rule detects the GlobeImposter ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and process termination functions. The rule looks for combinations of these patterns within executable files to increase detection accuracy.
This YARA rule detects the GPCode ransomware by identifying specific byte sequences related to its core functionalities. These include patterns for iterating through drives, the encryption routine itself, setting a ransomware wallpaper, and reading configuration files. The rule requires all four byte patterns to be present within a file that starts with the MZ header (indicating a Windows executable) to trigger a detection.
This rule detects the 'Good' ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the 'MZ' header).
This YARA rule detects the HDDCryptor ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include deploying components, gathering share information, encrypting disks, creating a DiskCryptor service, extracting DiskCryptor from resources, encrypting files, and initiating a system reboot. The rule looks for combinations of these patterns to ensure high confidence in detection.
This YARA rule detects the HDMR ransomware by identifying specific byte patterns associated with its file finding, encryption, and backup targeting functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the HDMR ransomware's code for locating files, encrypting them, and specifically targeting Microsoft Exchange backups.
This YARA rule detects the Hermes ransomware by identifying specific byte patterns associated with its file finding, encryption, and resource enumeration routines. The rule includes patterns for two different versions of Hermes ransomware, ensuring detection across variations of the malware. It specifically looks for the presence of a Windows executable (MZ header) and then checks for the unique byte sequences related to Hermes's operational functions.
Page 42 of 62