CryptHunter_devobjDLL_VMprotect

YARA detection rule by JPCERT/CC Incident Response Group · NOASSERTION

Hunt devobjDLL

rule CryptHunter_devobjDLL_VMprotect {
    meta:
      description = "Hunt devobjDLL"
      author = "JPCERT/CC Incident Response Group"
      hash = "1599F7365DB421E4FE07A169309624E7E25D4F28CD1B101D340D54D66B6EB921"
    
    strings:
        
        $func0 = { D0 E5 50 48 0D 66 DD D2 68 66 0F BA F9 0F 0F 98 C5 48 0F AB F8 48 89 D9 66 0F B6 C1 48 D3 D8 48 83 EC 20 66 0F B6 C3 0F 96 C0 }

        
        $func1 = { 57 48 83 EC 10 33 C0 33 C9 0F A2 44 8B C1 45 33 DB 44 8B D2 41 81 F0 6E 74 65 6C 41 81 F2 69 6E 65 49 44 8B CB 8B F0 33 C9 }

        
        $func2 = { 33 C9 3B D0 0F 92 C1 33 C0 45 3B F1 44 8B F2 0F 97 C0 0B C8 C1 E1 02 83 C9 08 0B F9 49 FF C0 }

        
        $func3 = { 8B C8 83 E1 3F 48 33 C2 48 D3 C8 49 BA 70 28 D9 78 45 2E 01 99 45 33 C0 33 D2 33 C9 }

        
        $func4 = { 4C 8B C1 B8 20 00 00 00 41 83 E0 1F 49 2B C0 49 F7 D8 4D 1B D2 4C 23 D0 49 8B C1 49 3B D2 4C 0F 42 D2 49 03 CA 4C 3B C9 }

        
        $func5 = { 41 55 41 56 41 57 48 83 EC 30 33 C0 49 63 E8 45 85 C0 45 8A E9 4C 8B FA 48 8B F9 0F 4F C5 83 C0 09 48 98 48 3B D0 }

        
        $func6 = { 44 8B D0 44 8B C8 41 C1 E9 03 41 83 E1 10 44 8B C0 41 BE 00 02 00 00 41 8B D1 83 CA 08 45 23 C6 41 0F 44 D1 8B CA 83 C9 04 25 00 04 00 00 0F 44 CA 41 8B C2 41 B9 00 08 00 00 8B D1 83 CA 02 41 23 C1 0F 44 D1 41 8B C2 41 BB 00 10 00 00 8B CA 83 C9 01 41 23 C3 0F 44 CA 41 8B C2 BE 00 01 00 00 8B D1 0F BA EA 13 23 C6 0F 44 D1 41 8B C2 41 BF 00 60 00 00 41 23 C7 }

        
        $func7 = { 83 E2 3F 44 8B C2 8B C2 83 E0 10 41 C1 E8 02 41 83 E0 08 8B CA 44 0B C0 83 E1 02 41 C1 E8 02 8B C2 83 E0 08 C1 E1 03 44 0B C0 8B C2 83 E0 04 41 D1 E8 0B C8 83 E2 01 03 C9 C1 E2 04 44 0B C1 44 0B C2 41 8B C0 C1 E0 18 41 0B C0 C3 }

    condition:
        (uint16(0) == 0x5A4D)
        and (filesize < 1MB)
        and (filesize > 100KB)
        and ( 8 of ($func*) )
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

686e9771-9a14-4439-bc87-03ddd9c5f56c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion