(YARA) YARA_QEMU_REGISTRY
rule Qemu_Detection
{
meta:
Author = "Thomas Roccia - @fr0gger_ - Unprotect Project"
Description = "Checks for QEMU Registry Key"
strings:
$desc1 = "HARDWARE\\Description\\System" nocase wide ascii
$desc2 = "SystemBiosVersion" nocase wide ascii
$desc3 = "QEMU" wide nocase ascii
$dev1 = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
$dev2 = "Identifier" nocase wide ascii
$dev3 = "QEMU" wide nocase ascii
condition:
any of ($desc*) or any of ($dev*)
}
Associated Techniques
| Technique Name | Technique ID's | Snippet(s) | OS |
|---|---|---|---|
| Detecting Virtual Environment Artefacts | U1332 |
Matching Samples 10 most recent
| Sample Name | Matching Techniques | First Seen | Last Seen |
|---|---|---|---|
| frostygoop.exe | 7 | 2025-10-24 | 1 day, 5 hours ago |
| MBSetup (3).exe | 6 | 2025-10-18 | 1 week ago |
| Jigar-Jitendrabhai-Vadher-CP...urity-Certifications (1).pdf | 3 | 2025-10-18 | 1 week ago |
| 2e496717b85edc1f47dececadbf2...edc432bef640f7ff7616e528.elf | 1 | 2025-10-05 | 1 week, 6 days ago |
| 000.exe | 7 | 2025-10-06 | 2 weeks, 5 days ago |
| ri_setup_full4134_UjiwJcEu.exe | 7 | 2025-10-02 | 3 weeks, 2 days ago |
| mirroringApp-car-v1.0.2310071810 (1).apk | 3 | 2024-11-14 | 3 weeks, 4 days ago |
| program.elf | 1 | 2025-09-26 | 4 weeks ago |
| chrome_pwa_launcher.exe | 5 | 2025-09-24 | 1 month ago |
| botnpwds.exe | 10 | 2025-09-24 | 1 month ago |
Created
June 20, 2022
Last Revised
June 20, 2022