ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects BiBiWiper trojan.
Yara rule that detects BiBiWiper trojan.
This rule detects the Linux Vit virus by identifying a specific byte sequence at the entry point of an ELF executable and the presence of the string "vi324.tmp" within the file. The rule specifically targets ELF files, indicating its focus on Linux executables.
Linux Virus Vit
YARA
Yara rule that detects Vit virus.
This rule detects the Minodo backdoor by identifying a combination of specific byte patterns (YARA signatures) within executable files. These patterns correspond to functions responsible for generating system IDs, encrypting and sending data, gathering system information, copying payloads into memory, and executing payloads from temporary locations. The presence of all these patterns indicates the likely presence of the Minodo backdoor.
This rule detects the StealC infostealer malware by identifying specific byte patterns within the executable. These patterns correspond to functions for resolving Windows APIs, loading SQLite3 functions (often used by infostealers to extract data from browsers and other applications), and checking license expiration dates, which are characteristic of this particular malware family. The rule requires all three patterns to be present in a PE file (identified by the 'MZ' header) to trigger, reducing false positives.
Yara rule that detects Minodo backdoor.
Yara rule that detects StealC infostealer.
This YARA rule detects various components and behaviors associated with the BlackBasta ransomware. It identifies specific byte patterns related to file discovery, encryption routines (multiple versions), command prompt execution, LDAP connection attempts, dropping of ransom notes, and exclusion logic for files/volumes from encryption. The rule is designed to catch the ransomware executable itself based on these unique code signatures.
This YARA rule detects the BlackBasta ransomware by identifying specific byte patterns within executable files. The patterns correspond to various functionalities commonly found in ransomware, such as enumerating files, interacting with system volumes, dropping ransom notes, excluding certain files from encryption, and the encryption routines themselves. The rule looks for two main variants of these functionalities, indicating different versions or implementations of BlackBasta.
Page 10 of 62