ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,096 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the Ragnarok ransomware by identifying specific byte patterns associated with its functionality. The rule looks for code sections responsible for finding files, encrypting files, disabling the firewall, and deleting shadow volumes, which are common behaviors of ransomware.
This Yara rule detects the Ransoc ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include scanning for services, establishing remote connections, finding files to encrypt, and performing file encryption. The rule looks for distinct sequences of assembly instructions that are characteristic of Ransoc's operational methods.
This YARA rule detects the RagnarLocker ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for distinct sequences of bytes within executable files that are characteristic of RagnarLocker's operational code.
This YARA rule detects the RansomPlus ransomware by identifying specific byte sequences ($find_files_1_0, $find_files_1_1, $find_files_1_2, $encrypt_files) within executable files. The rule specifically looks for the MZ header (uint16(0) == 0x5A4D) to ensure it's analyzing a Windows executable, and then matches the defined byte patterns which are indicative of RansomPlus ransomware's file finding and encryption routines.
This rule detects the Reveton ransomware based on specific byte patterns found within the executable. The patterns indicate functionalities related to HTTP and raw socket connections, as well as file search operations, which are characteristic behaviors of this ransomware.
This YARA rule detects the RetMyData ransomware by identifying specific byte sequences ($find_files, $enum_resources, $encrypt_files) within executable files. These sequences are indicative of the ransomware's functionality related to finding files, enumerating resources, and encrypting files. The rule requires all three byte sequences to be present in a PE (Portable Executable) file to trigger a detection.
This YARA rule detects the Revil ransomware by identifying specific byte patterns associated with its file searching, encryption, remote connection, and resource enumeration functionalities. The rule looks for distinct sequences of bytes within executable files that are characteristic of Revil's operations, including functions for searching files to encrypt, performing the encryption itself, establishing remote connections (likely for command and control or data exfiltration), and enumerating system resources.
This YARA rule detects the Rokku ransomware by identifying specific byte patterns associated with its file encryption, file finding, and folder finding functionalities. The rule looks for distinct sequences of bytes (opcodes and operands) that are characteristic of the Rokku ransomware's code for these operations. The condition requires the presence of the standard Windows executable MZ header (0x5A4D) and all defined byte patterns for finding folders, finding files, and encrypting files.
This YARA rule detects the Ryuk ransomware by identifying specific byte patterns related to its file encryption routines, file discovery mechanisms, and remote connection capabilities. The rule looks for distinct sequences of bytes ($encrypt_files_p*, $find_files_p*, $remote_connection) that are characteristic of Ryuk's malicious operations. The rule requires all parts of the encryption and file finding patterns, as well as the remote connection pattern, to be present for a match.
This rule detects the Sage ransomware by identifying specific byte patterns associated with its core functionalities: establishing remote connections, encrypting files, and finding files to encrypt. The rule requires all three patterns to be present within a file to trigger, reducing false positives.
Page 46 of 62