ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the Monalisa ransomware by identifying specific byte sequences (strings) associated with its core functionalities. These functionalities include finding files for encryption, writing to process memory (potentially for injection or other malicious operations), generating encryption keys, and encrypting files. The rule also checks for the standard Windows PE header (MZ) to ensure it's analyzing an executable.
This YARA rule detects the HermeticRansom ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to dropping a ransom note, encrypting files, and finding files to encrypt. The presence of these combined patterns indicates the presence of the HermeticRansom malware.
Yara rule that detects Monalisa ransomware.
Yara rule that detects HermeticRansom ransomware.
This YARA rule detects the Koxic ransomware by identifying specific byte patterns related to its core functionalities. These patterns include code for enumerating network shares, finding files on the system, and encrypting files. The rule combines these patterns to increase confidence in detecting Koxic ransomware executables.
This rule detects the AntiWar ransomware based on specific byte patterns indicative of its file enumeration, share enumeration, and file encryption routines. The rule looks for a combination of these patterns within a PE file (identified by the 'MZ' header).
Yara rule that detects Koxic ransomware.
Yara rule that detects AntiWar ransomware.
This YARA rule detects LockBit ransomware by identifying specific byte patterns (signatures) within executable files. It contains two main sets of conditions, likely corresponding to different versions or major functional blocks of the ransomware. The first set looks for patterns related to enumerating resources, finding files, and encrypting files. The second set looks for patterns related to checking blacklisted languages (anti-analysis/anti-geofencing), FNV1a hashing, creating network host traversal threads, decrypting configuration, and encrypting files. The rule requires the file to be a Windows executable (MZ header).
Yara rule that detects LockBit ransomware.
Page 15 of 62