ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects Skuld infostealer.
Yara rule that detects VanHelsing ransomware.
This YARA rule detects the Linux AutoColor backdoor by identifying specific byte patterns related to its core functionalities. These functionalities include installing library implants, self-deletion mechanisms, executing local files, and network proxy communication. The rule specifically targets ELF (Executable and Linkable Format) files, indicating it's designed for Linux executables.
This YARA rule detects the BackConnect backdoor by identifying specific byte patterns related to its network communication, system information gathering, DNS server enumeration, and network interface enumeration functionalities. The rule looks for distinct code sequences that are characteristic of how this malware operates.
This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.
Yara rule that detects AutoColor backdoor.
Yara rule that detects BackConnect backdoor.
This rule detects the Linux GobRAT backdoor by identifying specific byte patterns associated with its functions for getting local IP addresses, MAC addresses, handling TCP network communication, and managing telnet tasks. The rule specifically targets ELF executable files.
This rule detects the wmRAT backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include connecting to a command and control (C2) server, finding and exfiltrating files, receiving data and writing it to files, and gathering system information. The rule looks for a combination of these distinct byte patterns to minimize false positives.
This rule detects the Linux_Backdoor_WolfsBane malware based on specific byte patterns found in its code. The patterns correspond to functions for loading embedded libraries, decrypting embedded libraries, and removing the backdoor. The rule specifically targets ELF executables.
Page 3 of 62