win_ralord_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.ralord.

rule win_ralord_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.ralord."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ralord"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { 488d45d8 488908 488d0d12bc0100 48894808 488d4dff 48894810 4c8d45f0 }
                                                                                                
        $sequence_1 = { 4883ec38 488daa80000000 80bd6f02000000 7419 41b801000000 488b8d58020000 488b9550020000 }
                                                                                                
        $sequence_2 = { 84c0 0f845bfeffff 4c896de8 8b45fc 8845f0 488d05085c0000 4889442420 }
                                                                                                
        $sequence_3 = { 488901 4889c8 e9???????? 4c8d0534e30300 ba00001000 4c89f1 e8???????? }
                                                                                                
        $sequence_4 = { 4a8d1438 4983f80f 7733 4d39fc 0f840d010000 31c9 0f1f840000000000 }
                                                                                                
        $sequence_5 = { 488b8538010000 4885c0 7412 f048ff08 750c 488d8d38010000 e8???????? }
                                                                                                
        $sequence_6 = { e9???????? 4983f904 0f83c4000000 31d2 4531d2 e9???????? 31c0 }
                                                                                                
        $sequence_7 = { 48894dc0 48c744242006000000 4c8d0d33610100 488d4dd8 e8???????? f645d801 7457 }
                                                                                                
        $sequence_8 = { 48c7454801000000 488d7d10 488d5530 4889f9 e8???????? 488b55e0 }
                                                                                    
        $sequence_9 = { eb0b 488b4578 488985e8000000 4c8d057ce20300 4c89f9 488b95e8000000 e8???????? }
                                                                                                
    condition:
        7 of them and filesize < 798720
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d9e34067-d7e3-43a4-bb51-3bc6cc56b3a1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion