ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the HydraCrypt ransomware by identifying specific byte patterns associated with its file encryption routines and remote connection capabilities. The rule looks for two distinct sets of patterns, each combining multiple encryption-related and remote connection-related byte sequences, indicating the presence of the ransomware.
This YARA rule detects the IFN643 ransomware by identifying specific byte patterns associated with its code. The rule looks for a Windows executable (MZ header) and then matches three distinct byte sequences, likely corresponding to its file searching and encryption functionalities. The rule's primary purpose is to identify the presence of this specific ransomware variant on a system.
This YARA rule detects the JSWorm ransomware by identifying specific byte patterns associated with its file finding, drive enumeration, and file encryption routines. The rule looks for a combination of these patterns within executable files (MZ header check).
This YARA rule detects the Jamper ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, and resource enumeration functions. The rule looks for a combination of these patterns within executable files to identify potential Jamper ransomware samples.
This YARA rule detects the Jemd ransomware based on specific byte patterns found in its executable code. The rule looks for distinct sequences of bytes associated with file finding routines, file encryption routines (split into two parts), and a main routine, indicating the presence of the Jemd ransomware.
This YARA rule detects the Kangaroo ransomware by identifying specific byte patterns associated with its file encryption, file finding, and resource enumeration functionalities. The rule looks for distinct sequences of bytes (hex patterns) that are characteristic of the Kangaroo ransomware's code for encrypting files, locating files on the system, and enumerating resources.
This YARA rule detects the KillDisk ransomware based on specific byte patterns found in its executable code. It looks for patterns related to file encryption routines and application whitelisting mechanisms, which are characteristic of KillDisk variants. The rule requires all three defined string patterns to be present in a PE file (indicated by the 'MZ' header) for a match.
This YARA rule detects the Kovter ransomware based on specific byte sequences found within the malware's executable. It looks for patterns related to remote connection functionalities, file enumeration, and payload decryption scripts, which are characteristic of Kovter's operation. The rule requires all identified string patterns to be present, along with a check for the MZ header (uint16(0) == 0x5A4D), indicating a Windows executable.
This YARA rule detects the Kraken ransomware by identifying specific byte patterns associated with its functionality. The rule looks for sequences related to enumerating volumes, enumerating network shares, finding files, and encrypting files. The presence of these combined patterns indicates the likely presence of Kraken ransomware.
This YARA rule detects the Ladon ransomware by identifying specific byte patterns associated with its file finding, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of Ladon ransomware.
Page 43 of 62