win_konni_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.konni.

rule win_konni_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.konni."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.konni"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { 8d55e8 52 8d45dc 50 6a00 68???????? }
                                                                                    
        $sequence_1 = { 4f 75ef 68???????? 56 e8???????? 56 e8???????? }
                                                                                                
        $sequence_2 = { 81ce00ffffff 46 8a9435f8feffff 88940df8feffff 41 889c35f8feffff 81f900010000 }
                                                                                                
        $sequence_3 = { 83e601 8970f0 d0f9 0fbef1 83e601 }
                                                                        
        $sequence_4 = { 3306 03c0 334604 03c0 334608 03c0 33460c }
                                                                                                
        $sequence_5 = { 52 68???????? 68???????? e8???????? 83c418 8b45e4 50 }
                                                                                                
        $sequence_6 = { 7908 49 81c900ffffff 41 8a8c0df8feffff 300c07 }
                                                                                    
        $sequence_7 = { 83c418 8b45e4 50 ff15???????? 8b4dfc 33cd e8???????? }
                                                                                                
        $sequence_8 = { 83f802 7508 890d???????? eb1e }
                                                            
        $sequence_9 = { 6a01 ff15???????? 50 a3???????? e8???????? }
                                                                        
        $sequence_10 = { 890d???????? eb1e 83f804 740f c705????????02000000 83f801 }
                                                                                    
        $sequence_11 = { 83f801 750a c705????????01000000 890d???????? }
                                                            
        $sequence_12 = { 68b6030000 6a0d 50 ff15???????? }
                                                            
        $sequence_13 = { eb02 33c9 e8???????? 8bf8 }
                                                            
        $sequence_14 = { e8???????? 83c408 85c0 7552 8b560c 68???????? 52 }
                                                                                                
        $sequence_15 = { 885a08 0fb641f0 3245f9 83c110 8801 0fb6460c 3245fa }
                                                                                                
        $sequence_16 = { 8d3c10 8b95f0feffff 8995e4feffff 8b95f8feffff }
                                                            
        $sequence_17 = { 56 57 50 e8???????? 83c40c 6820010000 e8???????? }
                                                                                                
        $sequence_18 = { ff15???????? 8d95f8feffff 52 ff15???????? 8b3d???????? }
                                                                        
        $sequence_19 = { 488d4ddf 418bd1 e8???????? 488d9600010000 488bce e8???????? 488b45df }
                                                                                                
        $sequence_20 = { 52 8d85f8feffff 50 ffd6 }
                                                            
        $sequence_21 = { 33d2 33c0 8db768020000 8916 56 e8???????? 8a8c30dec44600 }
                                                                                                
        $sequence_22 = { 8b4e08 33db 56 e8???????? 8a9c30c2c44600 }
                                                                        
        $sequence_23 = { 004044 40 00644440 0023 }
                                                            
        $sequence_24 = { 51 ffd6 8b35???????? 8d95f0faffff }
                                                            
        $sequence_25 = { 4032c7 32c3 49ffcd 41884424fe 0f8553ffffff }
                                                                        
        $sequence_26 = { 6a00 50 c685f4fdffff00 e8???????? 83c40c 6804010000 }
                                                                                    
        $sequence_27 = { 56 e8???????? 8a8c30dec44600 5e bb01000000 83c604 }
                                                                                    
        $sequence_28 = { 7524 a1???????? a3???????? a1???????? c705????????58214000 }
                                                                        
        $sequence_29 = { e8???????? 8a9435dec44600 5e 84c0 }
                                                            
        $sequence_30 = { 41b850000000 4533c9 488bd3 488bc8 }
                                                            
        $sequence_31 = { 8d95f8feffff 52 50 ff15???????? 8d85f8feffff 50 ff15???????? }
                                                                                                
        $sequence_32 = { e8???????? 8a9c30c2c44600 5e 83f908 7232 }
                                                                        
        $sequence_33 = { 7407 880f ffc6 48ffc7 }
                                                            
        $sequence_34 = { 6a00 6a00 8d8df8feffff 51 8d95f0fcffff 52 6a00 }
                                                                                                
        $sequence_35 = { bbedffffff 03dd 81eb00200200 83bd9404000000 }
                                                            
        $sequence_36 = { 4132d3 4532ca b01b 0fb6ca 02d2 }
                                                                        
        $sequence_37 = { 81eb00200200 83bd9404000000 899d94040000 0f85d7030000 8d85a0040000 50 ff95b50f0000 }
                                                                                                
        $sequence_38 = { 4c89742420 ff15???????? 488bd8 4885c0 744f }
                                                                        
        $sequence_39 = { 33c9 56 e8???????? 8a8c30a6c44600 5e }
                                                                        
        $sequence_40 = { 56 53 e8???????? 57 68???????? e8???????? }
                                                                                    
        $sequence_41 = { a3???????? 85c0 59 bf???????? }
                                                            
        $sequence_42 = { 8d0500a00010 83780800 753b b0ff 8bff }
                                                                        
        $sequence_43 = { e8???????? 59 3bc7 59 a3???????? 741e }
                                                                                    
        $sequence_44 = { 48899c2420010000 4889bc2430010000 4c89a42438010000 4533e4 0f1f00 }
                                                                        
        $sequence_45 = { 488d442440 488d1579180100 4533c0 4889442420 }
                                                            
        $sequence_46 = { e8???????? 488d8d60050000 33d2 41b800040000 c744244000040000 }
                                                                        
        $sequence_47 = { c1f905 83e01f 8b0c8de0a30010 8d04c0 8d0481 eb05 }
                                                                                    
        $sequence_48 = { e8???????? 4533f6 41b919000200 4c8be8 488d442448 4533c0 488bd3 }
                                                                                                
        $sequence_49 = { e8???????? 4c8d4d08 4c8d442448 488d156d140100 488d4c2448 }
                                                                        
        $sequence_50 = { 99 f7fd 4863c2 420fb60c20 4403d9 4403df }
                                                                                    
        $sequence_51 = { c1f905 8d04c0 be00800000 8b0c8de0a30010 8d548104 8a4c8104 }
                                                                                    
    condition:
        7 of them and filesize < 2361344
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

201227b3-510a-408e-9af9-3c6f7d3eddac

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion