win_gotohttp_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.gotohttp.

rule win_gotohttp_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.gotohttp."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gotohttp"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { ffc6 c6041800 4863c6 ffc6 c604180a 4863c6 ffc6 }
                                                                                                
        $sequence_1 = { e8???????? 85c0 0f8541050000 48837f3800 740d 418bc7 f0410fc18424b8030000 }
                                                                                                
        $sequence_2 = { f30f7f08 660f6fd1 660f61c8 660f69d0 66410f7ec8 43ff0482 660f73d904 }
                                                                                                
        $sequence_3 = { ff10 48ffc3 483b5f20 72e0 488b4f10 4885c9 7405 }
                                                                                                
        $sequence_4 = { eb0b 488b4360 48898780000000 488b4b60 488b02 488901 4c8922 }
                                                                                                
        $sequence_5 = { ffc1 48f7e2 48c1ea03 4885d2 75ef 4c63c9 4288540c40 }
                                                                                                
        $sequence_6 = { e8???????? 85c0 742c 8b5308 8b4b0c 488d4204 483bc1 }
                                                                                                
        $sequence_7 = { eb07 453bc6 450f4cc6 664689040f 4983c102 4883eb01 0f8579ffffff }
                                                                                                
        $sequence_8 = { e8???????? f6436001 7408 488bcb e8???????? 488b9f80000000 4885db }
                                                                                                
        $sequence_9 = { e8???????? 488bf8 4885c0 0f849f010000 33d2 c7400c17000000 895810 }
                                                                                                
    condition:
        7 of them and filesize < 6266704
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1619dd9e-319b-48ea-8279-3ab0b1f5d734

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion