ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the Zoldon ransomware by identifying specific byte patterns associated with its core functionalities. These patterns include sequences related to the main encryption function, the creation of a specific registry key (likely for persistence or configuration), and functions involved in finding files to encrypt. The rule looks for these distinct code segments within executable files.
This rule detects the Ako ransomware by identifying specific byte patterns (YARA signatures) associated with its file encryption routines, including those targeting local files and network shares. The rule looks for distinct code sequences related to file enumeration and encryption activities, indicating the presence and execution of the Ako ransomware.
This YARA rule detects the SeedLocker ransomware by identifying specific byte sequences ($search_files, $encrypt_files_p1, $encrypt_files_p2, $encrypt_files_p3) within executable files. These sequences are indicative of the ransomware's file searching and encryption routines. The rule requires the presence of a valid MZ header (uint16(0) == 0x5A4D) and all defined string patterns to trigger, ensuring high confidence in detection.
This YARA rule detects the TrickBot trojan by identifying specific byte sequences ($entry_setup, $decrypt_function_snippet, $decrypt_function_snippet_wrapper) commonly found in its executable code. The rule requires the presence of the standard Windows PE magic number (0x5A4D) at the beginning of the file, along with the $entry_setup pattern, and at least one of the decryption function snippets.
This rule detects the Win32_Virus_Awfull malware by identifying a specific byte pattern within the Portable Executable (PE) file's entry point. The rule checks for the presence of the 'MZ' magic bytes (0x5A4D) at the beginning of the file, confirming it's a PE file, and then scans for a unique sequence of bytes ($awfull_body) at the entry point, which is characteristic of the Awfull virus.
This YARA rule detects the Cmay virus by looking for specific byte sequences within the Portable Executable (PE) file. It checks for two distinct bodies of code, '$cmay_body_1' and '$cmay_body_2', with '$cmay_body_1' specifically required to be present at the entry point of the PE file. The rule also verifies that the file starts with the 'MZ' magic bytes (0x5A4D), indicating a valid Windows executable.
This rule detects the 'DeadCode' virus by looking for specific byte sequences at the entry point of a PE file and a unique marker within the file. It checks for four distinct patterns: three at the entry point combined with a marker at offset 0x40, or two specific byte sequences in the body of the file. The rule uses the 'pe' YARA module to identify Portable Executable files and their entry points.
This YARA rule detects the Elerad virus by searching for a specific byte sequence (signature) within the Portable Executable (PE) file, specifically at its entry point. The rule first checks if the file is a valid PE file by verifying the 'MZ' header (0x5A4D at offset 0). If it is a PE file, it then looks for the '$elerad_body' byte pattern at the file's entry point, indicating the presence of the Elerad malware.
This YARA rule detects the Greenp virus by looking for specific byte sequences within the Portable Executable (PE) file. It checks for two distinct bodies of code ($greenp_body_1 and $greenp_body_2) and requires that $greenp_body_1 is present at the entry point of the PE file. The rule also verifies that the file starts with the MZ header (0x5A4D), indicating a valid Windows executable.
This rule detects the Win32_Virus_Negt malware based on specific byte patterns found within the Portable Executable (PE) file. It checks for these patterns either at the entry point of the PE file or across multiple sections of the file, indicating the presence of the Negt virus body and its infector components.
Page 49 of 62