100daysofyara 2025
@100daysyara20250 followers637 downloads15 copies0 likes1,392 views
46 detections
Filters
Last updated
All Time
Detection languages
46
Categories
24
12
5
5
4
Platforms
28
10
7
5
1
Products / Services
4
3
3
3
3
MITRE Techniques
18
10
10
7
5
CVEs
2
2
INFO 3AM ransom
YARA
This YARA rule detects files containing specific strings and patterns associated with the 3AM ransomware, such as the group's name, their onion URL format, and common ransomware-related terminology. It is designed to identify ransom notes left behind on compromised systems.
These YARA rules detect indicators of compromise (IOCs) associated with a campaign where malicious actors compromised developer accounts to distribute malicious Google Chrome extensions. The rules search for a specific set of C2 IP addresses, domains, extension names, and unique extension IDs known to be part of this supply chain attack.
This rule detects obfuscation of the Windows Registry Run key paths (SOFTWARE\Microsoft\Windows\CurrentVersion\Run) through the insertion of arbitrary non-alphanumeric characters. This is a common evasion technique used to bypass simple string-based detections for persistent autostart registry entries.
These YARA rules detect encrypted ZIP archive files that contain exactly one file. Specific variations are provided for ZIP files containing a single .vbs or .msc file. This pattern is commonly used in malware distribution via email to bypass static security controls, requiring user interaction to decrypt and execute the payload.
This YARA rule detects the SugarWraith loader, a malware component identified by the presence of specific diagnostic strings, system enumeration artifacts, and indicators of persistence or configuration related to tunnel bypass tools like ngrok. It specifically targets Windows-based binaries that exhibit characteristics associated with the UNK_SweetSpector threat activity.
ROOT SUTERUSU
YARA
This YARA rule detects the presence of Suterusu rootkit source code artifacts, specifically targeting header files, function names, and print strings used for rootkit operations such as process/file/port hiding and module loading manipulation.
ROOT GET PSHELL
YARA
No description available.
This YARA rule detects a specific Base64 decoding routine and associated hardcoded string patterns used by the Coyote Banking Trojan. The rule scans for bytecode sequences corresponding to .NET methods such as System.Text.Encoding::get_UTF8 and System.Convert::FromBase64String, which the malware uses to deobfuscate its malicious payloads or configuration components.
This YARA rule suite is designed to detect the Qbit Stealer malware and associated development artifacts. It uses specific string matches indicative of the stealer's configuration, logging, and functionality (such as file archiving and exfiltration) alongside development indicators like developer contact information and project metadata.
day0 ToxicEyeRAT
YARA
These YARA rules detect the ToxicEye Remote Access Trojan (RAT), a malicious tool written in C# that leverages the Telegram Bot API for command and control. The rules identify specific hardcoded configuration settings (Telegram bot tokens, addresses for crypto wallets, persistence settings, and file grabber configurations), unique project strings (author attribution, warning messages), and debug logs associated with the malware's functional modules such as keylogging, credential stealing, file exfiltration, and system destructive capabilities like boot sector overwriting.
Page 2 of 5