ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the RedAlert ransomware by identifying specific byte patterns within the executable. The patterns correspond to functions involved in setting up the environment, finding files to encrypt, encrypting files, and making configuration changes, which are characteristic behaviors of the RedAlert ransomware.
Yara rule that detects RedAlert ransomware.
This YARA rule detects the Acepy ransomware by identifying specific byte patterns associated with its core functionalities: finding files to encrypt, performing the encryption process, and dropping a ransom note. The rule requires all three patterns to be present within a Windows executable file (indicated by the MZ header) to trigger a detection.
This rule detects the BlueLocker ransomware by identifying specific byte patterns related to its file encryption and file finding routines, as well as its cryptographic context creation. The rule looks for three distinct parts of the encryption process ($encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3), two parts of the file finding process ($find_files_p1, $find_files_p2), and a pattern for creating the cryptographic context ($create_crypt_context). All these patterns must be present for a detection to occur, indicating the presence of the BlueLocker ransomware.
Yara rule that detects Acepy ransomware.
Yara rule that detects BlueLocker ransomware.
This Yara rule detects the PoliceRecords ransomware. It identifies specific byte sequences related to file encryption, file discovery, desktop manipulation (likely for displaying a ransom note or changing wallpaper), and the dropping of a ransom note. The rule looks for these distinct patterns within executable files (identified by the 'MZ' header).
This YARA rule detects the WsIR ransomware based on specific byte sequences found in its code. The rule looks for patterns associated with file enumeration ($find_files), file encryption ($encrypt_files), and process execution ($exec_proc). The presence of all three patterns indicates the likely presence of the WsIR ransomware.
Yara rule that detects PoliceRecords ransomware.
Yara rule that detects WsIR ransomware.
Page 12 of 62