ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This rule detects the Solaso ransomware by identifying specific byte patterns related to its file finding and encryption routines. The rule looks for distinct sequences of bytes within the executable, indicating the presence of Solaso ransomware.
This rule detects the Wintenzz ransomware by identifying specific byte patterns related to its file finding, encryption, and ransom note dropping functionalities. The rule looks for a combination of these patterns within a PE file (indicated by the MZ header).
Yara rule that detects Solaso ransomware.
Yara rule that detects Wintenzz ransomware.
This YARA rule detects the AvosLocker ransomware by identifying specific byte sequences (strings) within executable files. The rule looks for patterns associated with file enumeration ($find_files), resource enumeration ($enum_resources), key import operations ($import_key), and file encryption routines ($encrypt_files). All four string patterns must be present in a file, and the file must start with the MZ header (0x5A4D) to be considered a match.
This YARA rule detects the Jormungand ransomware by identifying specific byte patterns related to its core functionalities. These functionalities include dropping a ransom note, encrypting files using AES and RSA algorithms, finding files to encrypt, and establishing remote connections. The rule specifically looks for these patterns within executable files (indicated by `uint16(0) == 0x5A4D` for MZ header).
Yara rule that detects AvosLocker ransomware.
Yara rule that detects Jormungand ransomware.
This rule detects the ChupaCabra ransomware by identifying specific bytecode patterns associated with its file encryption routines, file discovery mechanisms, and the dropping of a ransom note. The rule looks for distinct sequences of operations related to encrypting files, finding files on the system, and creating the ransom note, indicating the presence and activity of this particular ransomware.
This rule detects the Hog ransomware by identifying specific bytecode patterns associated with key generation, file enumeration, and file encryption routines. The rule looks for a combination of these patterns within a Portable Executable (PE) file, indicated by the 'MZ' header (uint16(0) == 0x5A4D). The patterns '$generate_key', '$find_files', and '$encrypt_files_p1' and '$encrypt_files_p2' must all be present for a detection.
Page 20 of 62