ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects EggStremeFuel backdoor.
Yara rule that detects WeaselStore infostealer.
This YARA rule detects the BPFDoor backdoor, a sophisticated Linux-based malware. It identifies specific byte patterns (strings) associated with different versions of BPFDoor's packet loop, reverse shell functionality, and process name manipulation. The rule looks for two main versions of these components, ensuring a comprehensive detection of the malware's core functionalities.
This YARA rule detects the Veaty backdoor by identifying specific bytecode patterns related to fetching commands, reading mailbox folders, and adding inbox rules. The rule looks for a combination of these patterns within a file that also has a valid MS-DOS executable header (MZ header).
Yara rule that detects BPFDoor backdoor.
Yara rule that detects Veaty backdoor.
This rule detects the Warlock ransomware by identifying specific byte patterns associated with its core functionalities. These patterns include code responsible for encrypting files, killing processes, stopping services, and discovering drives, which are common behaviors of ransomware.
This rule detects the Linux_Backdoor_PondRAT malware by identifying specific byte patterns associated with its 'connect_proxy', 'send_payload', and 'execute_shell_command' functions. The rule targets ELF executables.
Yara rule that detects Warlock ransomware.
Yara rule that detects PondRAT backdoor.
Page 1 of 62