ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the TeleCrypt ransomware by identifying specific byte patterns related to its file encryption routines, server communication mechanisms, payload execution, and payload copying functions. The rule looks for a combination of these patterns to ensure high confidence in detection. Specifically, it checks for patterns associated with generating strings for encryption, the encryption process itself, communication with a command and control server, executing the ransomware payload, and copying the payload.
This YARA rule detects various versions of the Teslacrypt ransomware based on specific byte patterns found within the executable files. The rule is composed of multiple logical blocks, each targeting different versions or components of Teslacrypt, including file search, encryption routines, and server communication modules. The presence of these byte sequences indicates that a file is likely a Teslacrypt ransomware variant.
This YARA rule detects the TorrentLocker ransomware by identifying specific byte sequences (signatures) associated with its executable code. These signatures include patterns related to its entry point, functions for contacting command and control servers, retrieving server data, removing shadow copies to prevent recovery, and finding files for encryption. The rule requires a combination of these patterns to trigger, ensuring a higher confidence in detection.
This YARA rule detects the VHDLocker ransomware by identifying specific byte patterns (strings) associated with its file encryption routines, logical drive enumeration, and file finding mechanisms. The rule requires all three sets of patterns to be present in a file to trigger, indicating a high confidence detection for the VHDLocker malware.
This YARA rule detects the VegaLocker ransomware by identifying specific byte patterns associated with its file finding and encryption routines. The rule looks for a combination of byte sequences that are characteristic of how VegaLocker operates, specifically in functions related to locating files and encrypting them. The presence of these patterns indicates the likely presence of the VegaLocker ransomware.
This YARA rule detects the Velso ransomware by identifying specific byte sequences (patterns) associated with its file enumeration, resource enumeration, and file encryption routines. The rule looks for distinct code blocks within the malware that are characteristic of how Velso operates to find files, enumerate system resources, and encrypt data.
This rule detects the WannaCry ransomware based on specific byte patterns found within the executable. It checks for a valid PE header and then matches a combination of byte sequences at the entry point and various other locations within the binary, indicative of WannaCry's code.
This YARA rule detects the Xorist ransomware family by identifying specific byte patterns associated with its file search, encryption routines, and resource extraction mechanisms. The rule includes two distinct versions of these patterns to cover variations of the malware.
This YARA rule detects the Zeppelin ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include searching for files to encrypt, enumerating network shares, killing processes that might interfere with encryption, and performing the file encryption itself. The rule requires the presence of all these distinct code sections to trigger, reducing false positives.
This YARA rule detects the ZeroCrypt ransomware by identifying specific byte sequences (strings) within executable files. The rule looks for three distinct patterns, `$encrypt_file_1`, `$encrypt_file_2`, and `$encrypt_file_3`, which are characteristic of the ZeroCrypt ransomware's encryption routines. Additionally, it verifies that the file is a Windows executable by checking for the 'MZ' magic bytes (uint16(0) == 0x5A4D).
Page 48 of 62