ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
This rule detects the ChiChi ransomware by identifying specific byte patterns (YARA signatures) associated with its key generation, file encryption, and file discovery routines. The rule looks for a combination of these patterns within executable files (identified by the MZ header).
Yara rule that detects BlackCat ransomware.
Yara rule that detects ChiChi ransomware.
This YARA rule detects the HarpoonLocker ransomware by identifying specific bytecode patterns related to file encryption, file discovery, and boot modification. The rule looks for distinct sequences of opcodes and operands that are characteristic of how HarpoonLocker encrypts files, finds target files on a system, and attempts to alter boot configurations for persistence or impact.
This YARA rule detects the Khonsari ransomware by identifying specific bytecode patterns related to file enumeration, key retrieval, and file encryption operations. The rule looks for distinct sequences of instructions that are characteristic of how Khonsari ransomware operates, ensuring that all three critical stages (finding files, obtaining an encryption key, and encrypting files) are present within the analyzed binary.
Yara rule that detects HarpoonLocker ransomware.
Yara rule that detects Khonsari ransomware.
This rule detects the Redeemer ransomware by identifying specific byte patterns associated with its file discovery, encryption routines, and process modification activities. The rule looks for a combination of these patterns within a PE file to confirm the presence of Redeemer ransomware.
This YARA rule detects the Rook ransomware by identifying specific byte patterns associated with its file enumeration, process enumeration, network share enumeration, and file encryption functionalities. The rule looks for distinct sequences of bytes ($find_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3, $enum_procs, $enum_shares) that are characteristic of Rook ransomware's operations. The presence of these combined patterns indicates a high probability of Rook ransomware infection.
Page 17 of 62