ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects BlackBasta ransomware.
Yara rule that detects BlackBasta ransomware.
This YARA rule detects the Lorenz ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, scheduled task creation for persistence, and remote connection functionalities. The rule includes two main versions of the ransomware's code, covering different implementations of these malicious activities.
This YARA rule detects the Meow ransomware based on specific byte patterns found in its executable code. The rule looks for patterns associated with file encryption routines, the dropping of a ransom note, and functions used to find files on the system. The condition requires the presence of the MZ header (indicating a Windows executable) and all defined string patterns to match, ensuring a high-fidelity detection of the Meow ransomware.
Yara rule that detects Lorenz ransomware.
Yara rule that detects Meow ransomware.
This rule detects the Moisha ransomware by identifying specific bytecode patterns related to file enumeration, private key importation, and file encryption routines. The rule looks for distinct sequences of MSIL (Microsoft Intermediate Language) instructions that are characteristic of Moisha's operational methodology.
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
Yara rule that detects Moisha ransomware.
Yara rule that detects GwisinLocker ransomware.
Page 11 of 62