(YARA) YARA_QEMU_REGISTRY
rule Qemu_Detection
{
meta:
Author = "Thomas Roccia - @fr0gger_ - Unprotect Project"
Description = "Checks for QEMU Registry Key"
strings:
$desc1 = "HARDWARE\\Description\\System" nocase wide ascii
$desc2 = "SystemBiosVersion" nocase wide ascii
$desc3 = "QEMU" wide nocase ascii
$dev1 = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
$dev2 = "Identifier" nocase wide ascii
$dev3 = "QEMU" wide nocase ascii
condition:
any of ($desc*) or any of ($dev*)
}
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
Detecting Virtual Environment Artefacts | U1332 |
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
2e496717b85edc1f47dececadbf2...edc432bef640f7ff7616e528.elf | 1 | 2025-10-05 | 1 day, 16 hours ago |
000.exe | 7 | 2025-10-06 | 1 day, 19 hours ago |
ri_setup_full4134_UjiwJcEu.exe | 7 | 2025-10-02 | 5 days, 13 hours ago |
mirroringApp-car-v1.0.2310071810 (1).apk | 3 | 2024-11-14 | 1 week ago |
program.elf | 1 | 2025-09-26 | 1 week, 4 days ago |
chrome_pwa_launcher.exe | 5 | 2025-09-24 | 1 week, 6 days ago |
botnpwds.exe | 10 | 2025-09-24 | 1 week, 6 days ago |
rlm1611_http.dll | 6 | 2025-09-22 | 2 weeks, 1 day ago |
hid-tools.dll | 13 | 2025-09-22 | 2 weeks, 1 day ago |
Yandex.exe | 8 | 2025-09-20 | 2 weeks, 3 days ago |
Created
June 20, 2022
Last Revised
June 20, 2022