(YARA) YARA_QEMU_REGISTRY

Download Raw

rule Qemu_Detection
{
	meta:
		Author = "Thomas Roccia - @fr0gger_ - Unprotect Project"
		Description = "Checks for QEMU Registry Key"
	strings:
		$desc1 = "HARDWARE\\Description\\System" nocase wide ascii
		$desc2 = "SystemBiosVersion" nocase wide ascii
		$desc3 = "QEMU" wide nocase ascii

		$dev1 = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
		$dev2 = "Identifier" nocase wide ascii
		$dev3 = "QEMU" wide nocase ascii
	condition:
		any of ($desc*) or any of ($dev*)
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
Detecting Virtual Environment Artefacts U1332

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
VNC-Viewer-7.15.0-Windows-64bit.exe 5 2025-09-04 6 days, 21 hours ago
Apple Music Installer.exe 4 2025-08-27 2 weeks ago
LINTools.exe 4 2025-08-26 2 weeks, 1 day ago
AdbRunningAppsViewer.exe 4 2025-08-24 2 weeks, 3 days ago
presenter_lib.dll 5 2025-08-16 3 weeks, 5 days ago
x360ce.exe 4 2025-08-13 4 weeks ago
Krbtool.exe 8 2025-08-11 4 weeks, 2 days ago
fw-backup-4M.bin 3 2025-08-09 1 month ago
reshacker_setup.exe 4 2025-08-09 1 month ago
miniMax.exe 3 2025-07-14 1 month, 3 weeks ago
View All

Created

June 20, 2022

Last Revised

June 20, 2022