ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This rule detects the NanoLocker ransomware based on specific byte patterns found within its executable code. The patterns are associated with functions responsible for file encryption, communication with remote servers, and enumeration of shares for encryption. The rule requires all five defined byte patterns to be present in a PE file (identified by the 'MZ' header) to trigger, aiming to reduce false positives.
This YARA rule detects the Nefilim ransomware by identifying specific byte patterns related to its encryption routines. The rule looks for patterns associated with creating encryption keys, encrypting encryption keys, and multiple parts of the file encryption process, as well as patterns for finding files to encrypt. The rule also checks for the standard Windows PE header (MZ).
This YARA rule detects the Nemty ransomware by identifying specific byte patterns (hexadecimal sequences) within executable files. The patterns are associated with Nemty's functionalities, including remote connection capabilities, enumeration of resources, file finding operations, and file encryption routines. The rule requires all defined string patterns to be present in a file that starts with the 'MZ' magic bytes (0x5A4D) to trigger a detection.
This YARA rule detects the NotPetya ransomware by identifying specific byte sequences (patterns) associated with its file encryption routine, main execution logic, encryption loop, and system shutdown/reboot mechanisms. The rule requires all four distinct byte patterns to be present within a file, along with the standard Windows PE header (MZ magic bytes), to trigger a detection. This combination of patterns aims to specifically identify NotPetya samples.
This YARA rule detects the OphionLocker ransomware based on specific byte patterns found within its executable code. The rule looks for distinct sequences of bytes related to file type handling and ECIES (Elliptic Curve Integrated Encryption Scheme) key operations, which are characteristic of this particular ransomware.
This rule detects the Ouroboros ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for a combination of these patterns within executable files, indicating the presence of the ransomware.
This YARA rule detects the PXJ ransomware based on specific byte patterns associated with its file finding, file encryption, and volume snapshot deletion functionalities. The rule looks for distinct sequences of bytes that are characteristic of the PXJ ransomware's code, indicating its presence in a binary.
This rule detects the Paradise ransomware by identifying specific byte patterns associated with its file searching, encryption routines, and HTTP remote connection capabilities. The rule requires the presence of a PE header (MZ signature) and all specified string patterns to trigger, indicating a high confidence detection of the Paradise ransomware executable.
This rule detects the Petya ransomware by identifying specific byte patterns within the executable. It looks for a combination of patterns related to the entry point, shutdown routines, a unique section name (sectionxxxx), and cryptographic generation functions. The rule also verifies that the file is a Windows executable by checking for the 'MZ' header.
This YARA rule detects the PrincessLocker ransomware by identifying specific byte sequences associated with its file encryption routines and remote connection functionalities. The rule looks for three distinct patterns: one related to file encryption operations and two related to establishing remote connections. All three patterns must be present in a file that also starts with the MZ header (0x5A4D) to trigger a detection.
Page 45 of 62