ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects Cincoo ransomware.
Yara rule that detects FarAttack ransomware.
This rule detects the Venom ransomware by identifying specific bytecode patterns associated with its environment setup, file discovery, and encryption routines. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
This YARA rule detects the Nokoyawa ransomware by identifying specific byte patterns related to its functionality. The rule looks for patterns associated with enumerating shares, finding files, and encrypting files, which are common behaviors of ransomware. The rule requires all three sets of patterns ($enum_shares, $find_files_p*, and $encrypt_files) to be present, along with the MZ header (uint16(0) == 0x5A4D), indicating an executable file.
Yara rule that detects Venom ransomware.
Yara rule that detects Nokoyawa ransomware.
This YARA rule detects the NB65 ransomware by identifying specific byte sequences associated with its file encryption, file discovery, and process enumeration functionalities. The rule looks for distinct patterns in the binary that indicate the presence of these malicious behaviors, which are characteristic of ransomware operations.
This rule detects the Pandora ransomware based on specific byte patterns found within the executable. It looks for patterns related to file enumeration, key generation, and the dropping of a ransom note, combined with the MZ header indicating a Windows executable.
Yara rule that detects NB65 ransomware.
Yara rule that detects Pandora ransomware.
Page 14 of 62