LegionLoader_dropper

YARA detection rule by RussianPanda

Detects malicious LegionLoader DLL dropper

rule LegionLoader_dropper {

    meta:
        description = "Detects malicious LegionLoader DLL dropper"
        author = "RussianPanda"
        date = "2024-09-23"
        reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.satacom"
        hash = "ef5b961ebc6167e728f9bf40e726ac71"

    strings:
        $s1 = {48 03 CA [0-50] 33 D2 33 C9 FF 15 ?? ?? ?? ?? 33 D2 33 C9 FF 15}
        $s2 = {44 30 3B 48 FF C3}
        $s3 = {8B ?? 8B ?? 83 ?? 01 D1 ?? F7 ?? 81 ?? 20 83 B8 ED 8B}

    condition:
        uint16(0) == 0x5A4D and all of them and filesize < 1MB
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

52756b9a-721a-4578-a159-eb6c5ee89b3e

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion