ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
Yara rule that detects ChinaZ trojan.
Yara rule that detects NjRAT backdoor.
This rule detects the AsyncRAT backdoor by identifying specific bytecode patterns related to its server communication, data handling, URL opening, and monitoring functionalities. The rule uses two main sets of string conditions, both of which are indicative of AsyncRAT's operational mechanisms. The first set ($read_server_data_v1, $send_v1, and $read_packet_v1_p*) focuses on its core communication and data processing. The second set ($send_v2, $open_url_v2, and $monitoring_v2) targets more advanced features like URL manipulation and system monitoring. The rule also checks for the MZ header (uint16(0) == 0x5A4D) to ensure the scanned file is a Windows executable.
This rule detects the Linodas backdoor on Linux systems by identifying specific byte patterns related to its persistence mechanisms for Ubuntu and RedHat distributions, network communication functions, and machine ID generation routines. The rule looks for a combination of these patterns to ensure high fidelity detection of the malware.
This rule detects the Linux_Trojan_AcidRain malware by identifying specific byte patterns associated with its destructive capabilities. The rule looks for functions related to destroying files using ioctls, overwriting files, and redundant reboot attempts, indicating the presence of the AcidRain wiper malware.
This rule detects the Menorah backdoor by identifying specific bytecode patterns related to its functionality. The patterns indicate capabilities such as sending system fingerprints to a command and control (C2) server, enumerating files and directories, and uploading files to the C2 server. The rule specifically targets .NET bytecode (MSIL) and requires all three sets of patterns to be present for a match, reducing false positives.
Yara rule that detects AsyncRAT backdoor.
Yara rule that detects Linodas backdoor.
Yara rule that detects Menorah backdoor.
Yara rule that detects AcidRain trojan.
Page 7 of 62