win_sphijacker_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.sphijacker.

rule win_sphijacker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.sphijacker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sphijacker"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { 488d4518 41b93f000f00 4533c0 4889442420 488d1573de0100 }
                                                                        
        $sequence_1 = { 488d1d9f250200 488d3d98250200 eb12 488b03 }
                                                            
        $sequence_2 = { 488d054a9f0100 483947f0 741a 488b0f 4885c9 7412 }
                                                                                    
        $sequence_3 = { 488d4510 c744242804000000 488d1539e30100 41b904000000 4889442420 4533c0 c7451088888888 }
                                                                                                
        $sequence_4 = { 488d1c8d00000000 8d040e 4c8bc3 488d8d34030000 898530030000 e8???????? 488d0daae7feff }
                                                                                                
        $sequence_5 = { 488d3d51c90100 eb07 488d3d30c90100 4883a4248000000000 4584f6 740b }
                                                                                    
        $sequence_6 = { c3 836a1001 0f88b65e0000 488b02 8808 48ff02 }
                                                                                    
        $sequence_7 = { 4c8d0d9de80000 33c9 4c8d0590e80000 488d1591e80000 e8???????? }
                                                                        
        $sequence_8 = { 4863c9 4c8d05c4ad0100 488bc1 83e13f }
                                                            
        $sequence_9 = { c744242804000000 488d15f7de0100 41b904000000 4889442420 4533c0 }
                                                                        
    condition:
        7 of them and filesize < 808960
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f03fb4cf-8ee6-4db9-9e6b-4668e8c123d4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion