ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects PygmyGoat backdoor.
Yara rule that detects Helldown ransomware.
This rule detects the GomorrahStealer infostealer by identifying specific bytecode patterns associated with its capabilities. These capabilities include extracting browser autofill data, browser cookies, taking screenshots, gathering antivirus information, and collecting browser history. The rule looks for the presence of all these distinct bytecode signatures within a file to confirm the presence of GomorrahStealer.
This Yara rule detects the CyberVolk ransomware by identifying specific byte patterns within its 'manage_gui', 'find_files', and 'encrypt_files' functions. The rule looks for two distinct versions of the 'find_files' and 'encrypt_files' functions, indicating variations in the ransomware's implementation. The presence of these patterns suggests the file is a CyberVolk ransomware executable.
Yara rule that detects CyberVolk ransomware.
Yara rule that detects GomorrahStealer infostealer.
This rule detects the Voldemort backdoor by identifying specific byte patterns related to its configuration decryption, general decryption algorithm, access token request mechanism, network communication routines, and data download functions from its command and control (C2) server. The rule looks for a combination of these distinct code segments within a Windows executable (MZ header).
This YARA rule detects the Cicada3301 ransomware by identifying specific byte patterns (signatures) within executable files. The rule looks for distinct code sequences related to enumerating valid drives, recursively collecting files, and encrypting files. It includes multiple parts for file collection and two versions of file encryption routines, indicating a robust detection mechanism for different variants or stages of the ransomware's operation. The presence of these patterns strongly suggests the file is a Cicada3301 ransomware sample.
Yara rule that detects Cicada3301 ransomware.
Yara rule that detects Voldemort backdoor.
Page 5 of 62