(YARA) YARA_QEMU_REGISTRY
rule Qemu_Detection
{
meta:
Author = "Thomas Roccia - @fr0gger_ - Unprotect Project"
Description = "Checks for QEMU Registry Key"
strings:
$desc1 = "HARDWARE\\Description\\System" nocase wide ascii
$desc2 = "SystemBiosVersion" nocase wide ascii
$desc3 = "QEMU" wide nocase ascii
$dev1 = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
$dev2 = "Identifier" nocase wide ascii
$dev3 = "QEMU" wide nocase ascii
condition:
any of ($desc*) or any of ($dev*)
}
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
Detecting Virtual Environment Artefacts | U1332 |
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
VNC-Viewer-7.15.0-Windows-64bit.exe | 5 | 2025-09-04 | 6 days, 21 hours ago |
Apple Music Installer.exe | 4 | 2025-08-27 | 2 weeks ago |
LINTools.exe | 4 | 2025-08-26 | 2 weeks, 1 day ago |
AdbRunningAppsViewer.exe | 4 | 2025-08-24 | 2 weeks, 3 days ago |
presenter_lib.dll | 5 | 2025-08-16 | 3 weeks, 5 days ago |
x360ce.exe | 4 | 2025-08-13 | 4 weeks ago |
Krbtool.exe | 8 | 2025-08-11 | 4 weeks, 2 days ago |
fw-backup-4M.bin | 3 | 2025-08-09 | 1 month ago |
reshacker_setup.exe | 4 | 2025-08-09 | 1 month ago |
miniMax.exe | 3 | 2025-07-14 | 1 month, 3 weeks ago |
Created
June 20, 2022
Last Revised
June 20, 2022