ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This rule detects the LeChiffre ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule requires all identified patterns to be present in a file to trigger, indicating a high confidence detection for this specific ransomware.
This rule detects the LooCipher ransomware by identifying specific byte patterns associated with its functionality. The patterns include code related to establishing remote connections, encrypting files, and finding files on the system. The rule requires all three patterns to be present in an executable file (MZ header) to trigger, aiming to reduce false positives.
This rule detects the MZP ransomware based on a combination of unique byte patterns found within its executable code. Specifically, it looks for patterns related to showing a ransom note, searching for configuration files, tracking mouse events (potentially for entropy generation or anti-analysis), finding files to encrypt, and the encryption routines themselves. The rule requires all these distinct code segments to be present, indicating a high confidence detection for MZP ransomware.
This Yara rule detects the Mafia ransomware by identifying specific byte patterns related to its file discovery, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of the Mafia ransomware.
This Yara rule detects the Magniber ransomware by identifying specific byte patterns related to its remote connection capabilities, file encryption routines, and file search mechanisms. The rule looks for a combination of these patterns to ensure high confidence in detection.
This rule detects the Maktub ransomware based on specific byte patterns found within the executable. It looks for distinct sequences of bytes associated with file encryption and file searching functionalities characteristic of Maktub ransomware.
This YARA rule detects the Matsnu ransomware based on specific byte sequences indicative of its functionality. The rule looks for patterns related to remote connections, file encryption routines, and file enumeration, suggesting the presence of the Matsnu ransomware.
This YARA rule detects the MarsJoke ransomware by identifying specific byte patterns related to its file search and encryption routines, as well as patterns associated with its remote connection capabilities. The rule combines three distinct byte signatures to increase accuracy.
This rule detects the MedusaLocker ransomware based on specific byte patterns found in its executable code. These patterns are associated with functions responsible for encrypting files, searching for files to encrypt, enumerating resources, and killing processes to facilitate encryption. The rule requires the presence of a valid PE header (MZ) and multiple distinct code sections related to these ransomware activities.
This rule detects the Montserrat ransomware based on specific byte patterns associated with its file finding, encryption, and service shutdown routines. The rule looks for a combination of these patterns within a PE file to identify the ransomware.
Page 44 of 62