(YARA) YARA_QEMU_REGISTRY

Download Raw

rule Qemu_Detection
{
	meta:
		Author = "Thomas Roccia - @fr0gger_ - Unprotect Project"
		Description = "Checks for QEMU Registry Key"
	strings:
		$desc1 = "HARDWARE\\Description\\System" nocase wide ascii
		$desc2 = "SystemBiosVersion" nocase wide ascii
		$desc3 = "QEMU" wide nocase ascii

		$dev1 = "HARDWARE\\DEVICEMAP\\Scsi\\Scsi Port 0\\Scsi Bus 0\\Target Id 0\\Logical Unit Id 0" nocase wide ascii
		$dev2 = "Identifier" nocase wide ascii
		$dev3 = "QEMU" wide nocase ascii
	condition:
		any of ($desc*) or any of ($dev*)
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
Detecting Virtual Environment Artefacts U1332

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
2e496717b85edc1f47dececadbf2...edc432bef640f7ff7616e528.elf 1 2025-10-05 1 day, 16 hours ago
000.exe 7 2025-10-06 1 day, 19 hours ago
ri_setup_full4134_UjiwJcEu.exe 7 2025-10-02 5 days, 13 hours ago
mirroringApp-car-v1.0.2310071810 (1).apk 3 2024-11-14 1 week ago
program.elf 1 2025-09-26 1 week, 4 days ago
chrome_pwa_launcher.exe 5 2025-09-24 1 week, 6 days ago
botnpwds.exe 10 2025-09-24 1 week, 6 days ago
rlm1611_http.dll 6 2025-09-22 2 weeks, 1 day ago
hid-tools.dll 13 2025-09-22 2 weeks, 1 day ago
Yandex.exe 8 2025-09-20 2 weeks, 3 days ago
View All

Created

June 20, 2022

Last Revised

June 20, 2022