ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the Albabat ransomware by identifying specific byte patterns associated with its core functionalities. The rule looks for patterns related to file encryption, dropping a ransom note, changing the desktop wallpaper, and finding files to encrypt. The presence of these combined patterns indicates the likely presence of the Albabat ransomware.
This YARA rule detects the SideTwist backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include anti-sandbox detection, collection of host information, communication with a command and control (C2) server, parsing C2 responses, downloading files from the C2, and replying to the C2 server. The rule requires all these distinct patterns to be present within a PE file (identified by the 'MZ' header) to trigger a detection, aiming to minimize false positives.
This rule detects the LimeRAT backdoor by identifying specific byte patterns associated with its persistence mechanism, cryptocurrency mining capabilities, downloader functionality, and network communication routines. The rule looks for a combination of these distinct patterns within a file to confirm the presence of LimeRAT.
This rule detects the Linux_Backdoor_Krasue malware. It identifies specific byte patterns within the executable that correspond to functions for switching servers, getting hostname information, starting server processes, sending encrypted data, and notifying the server. The rule also checks for the ELF magic number to ensure it's a Linux executable.
Yara rule that detects SideTwist backdoor.
Yara rule that detects Albabat ransomware.
Yara rule that detects LimeRAT backdoor.
Yara rule that detects Krasue backdoor.
This Yara rule detects the AgentRacoon backdoor, which is identified by specific bytecode patterns related to unpacking responses, file uploads, performing requests, retrieving DNS TXT records, and its main operational loop. The rule targets .NET (MSIL) executables, indicated by the 'uint16(0) == 0x5A4D' condition for MZ header and the nature of the bytecode patterns.
This Yara rule detects the presence of Cactus ransomware by identifying specific byte patterns associated with its file encryption, file discovery, process checking, and process killing functionalities. The rule looks for distinct sequences of bytes within executable files, indicating the presence of Cactus ransomware components.
Page 8 of 62