ReversingLabs Yara
@ReversingLabsYara3 followers8,019 downloads10 copies0 likes9,026 views
616 detections
Filters
Last updated
All Time
Detection languages
616
Categories
614
418
80
63
18
Platforms
571
45
3
2
Products / Services
34
22
7
2
2
MITRE Techniques
410
399
196
178
140
CVEs
2
This YARA rule detects the Konni backdoor by identifying specific byte patterns related to its network communication, C2 command handling, CAB file creation and upload, and payload expansion functionalities. The rule looks for a combination of these distinct code segments within a file, indicating the presence of the Konni malware.
This rule detects the Konni backdoor, a remote access tool. It identifies specific byte patterns associated with the malware's network communication, handling of C2 commands, creation and uploading of CAB files, and payload expansion. The rule is designed to catch the presence of this specific malware family.
This rule detects the LumarStealer infostealer malware based on specific byte patterns (YARA signatures) associated with its core functionalities. These functionalities include collecting operating system information, sending data to a command and control (C2) server, finding files of interest, and specifically identifying cryptocurrency wallets. The rule requires all these distinct patterns to be present in a file, indicating a high confidence detection of LumarStealer.
Yara rule that detects AgentRacoon backdoor.
Yara rule that detects Cactus ransomware.
Yara rule that detects Konni backdoor.
Yara rule that detects Konni backdoor.
Yara rule that detects LumarStealer infostealer.
This YARA rule detects the BiBiWiper trojan by identifying specific byte sequences associated with its shadow copy deletion and file destruction functionalities. The rule looks for two distinct patterns, '$delete_shadow_copies_p*' and '$destroy_files_p*', which are indicative of the malware's destructive behavior. The presence of both sets of patterns within a file, combined with the MZ header (0x5A4D), triggers the detection.
This rule detects the Linux BiBiWiper trojan by identifying specific byte patterns associated with its file destruction routines. The rule looks for three distinct sequences of bytes (destroy_files_p1, destroy_files_p2, destroy_files_p3) within a file that is identified as an ELF executable (Linux executable format). The presence of all three byte patterns indicates the malicious wiper functionality of the BiBiWiper trojan.
Page 9 of 62