ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This rule detects the Eternity ransomware by identifying specific bytecode patterns related to file enumeration, encryption routines (including AES), and password handling. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header (uint16(0) == 0x5A4D). The presence of all four string patterns ($find_files, $encrypt_files, $aes_encrypt, $encrypt_pass) strongly suggests the presence of Eternity ransomware.
This rule detects the EAF ransomware by identifying specific bytecode patterns associated with its file encryption, file finding, and file destruction functionalities. The rule looks for a combination of patterns related to encrypting files, locating files on the system, and destroying executable files, indicating the presence and activity of the EAF ransomware.
Yara rule that detects EAF ransomware.
Yara rule that detects Eternity ransomware.
This rule detects the GoodWill ransomware by identifying specific bytecode patterns related to file encryption, AES encryption routines, file system enumeration, and remote connection activities. The rule looks for a combination of these patterns within a file, indicating the presence of the ransomware.
This rule detects the WaspLocker ransomware based on specific byte patterns associated with its functionality. The patterns indicate code responsible for finding files to encrypt, dropping auxiliary files, and creating ransomware notes.
Yara rule that detects GoodWill ransomware.
Yara rule that detects WaspLocker ransomware.
This YARA rule detects the Cincoo ransomware by identifying specific byte patterns associated with its file finding, file encryption, and ransom note dropping functionalities. The rule requires all three sets of patterns to be present in a file to trigger a detection, reducing false positives.
This Yara rule detects the FarAttack ransomware. It identifies specific byte patterns related to file searching, key creation, and file encryption routines commonly found in this ransomware variant. The rule looks for a combination of these patterns within a PE file to confirm the presence of FarAttack.
Page 13 of 62