ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects Sshdinjector backdoor.
Yara rule that detects GobRAT backdoor.
Yara rule that detects WolfsBane backdoor.
Yara rule that detects wmRAT backdoor.
This YARA rule detects the MiyaRAT backdoor by identifying specific byte patterns associated with its functionalities. The rule looks for distinct code sequences related to obtaining disk information, gathering operating system details, and taking screenshots. The presence of all these patterns within a single executable indicates the presence of MiyaRAT.
This YARA rule detects the Elpaco ransomware by identifying specific byte patterns within the executable. The patterns are associated with functions for finding files, writing console logs, getting system information, setting up an 'everything' library (likely for file enumeration), and deleting shadow copies. The rule requires all these sets of patterns to be present, indicating a high confidence detection of the Elpaco ransomware.
Yara rule that detects Elpaco ransomware.
Yara rule that detects MiyaRAT backdoor.
This rule detects the Helldown ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files for encryption, the encryption process itself, dropping a ransom note, and attempting to kill virtual machines. The rule specifically targets ELF executables, indicating it's designed for Linux systems.
This rule detects the PygmyGoat backdoor on Linux systems by identifying specific byte patterns associated with its functionality. The patterns include code for creating backdoor sockets, forwarding data, the main constructor, and hooking the accept function, indicating the presence and activity of the PygmyGoat malware.
Page 4 of 62