win_amadey

YARA detection rule by Johannes Bader @viql · MIT

matches unpacked Amadey samples

rule win_amadey {

    meta:
        author          = "Johannes Bader @viql"
        version         = "v1.0"
        tlp             = "TLP:WHITE"
        date            = "2022-11-17"
        description     = "matches unpacked Amadey samples"
        malpedia_family = "win.amadey"
        hash_md5        = "25cfcfdb6d73d9cfd88a5247d4038727"
        hash_sha1       = "912d1ef61750bc622ee069cdeed2adbfe208c54d"
        hash_sha256     = "03effd3f94517b08061db014de12f8bf01166a04e93adc2f240a6616bb3bd29a"

    strings:
        $pdb  = "\\Amadey\\Release\\Amadey.pdb" 
        
        $keys = /stoi argument out of range\x00\x00[a-f0-9]{32}\x00{1,16}[a-f0-9]{32}\x00{1,4}[a-f0-9]{6}\x00{1,4}[a-f0-9]{32}\x00/

    condition:
        uint16(0) == 0x5A4D and 
        (
            $pdb or $keys
        )
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

388f0eb6-7b6e-4f39-9f41-e5b7e17de121

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion