win_soul_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.soul.

rule win_soul_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.soul."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.soul"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { d3e2 8515???????? 7405 e8???????? }
                                                            
        $sequence_1 = { 40 803800 75f8 c745fc00000000 90 56 ff15???????? }
                                                                                                
        $sequence_2 = { 57 8bf8 be???????? 743a 8da42400000000 }
                                                                        
        $sequence_3 = { ff25???????? 48895c2408 4889742410 57 4883ec30 }
                                                                        
        $sequence_4 = { 7cde c745fc00000000 8da42400000000 8b4df8 51 57 }
                                                                                    
        $sequence_5 = { 741f 8da42400000000 8b03 57 50 }
                                                                        
        $sequence_6 = { 85f6 0f84a4000000 803f00 8bc7 }
                                                            
        $sequence_7 = { 85f6 7506 837dfc04 7cda }
                                                            
        $sequence_8 = { 7409 90 fe08 40 803800 }
                                                                        
        $sequence_9 = { 83c404 33f6 897304 8b4304 }
                                                            
        $sequence_10 = { eb22 e8???????? 488b4c2420 ffd0 90 48837c245008 }
                                                                                    
        $sequence_11 = { c744243a66003600 66448974243e 488d1d4ad10100 488bc3 488d7c2448 482bfb 0fb710 }
                                                                                                
        $sequence_12 = { ffc7 4883c202 413bf8 72db 8bce 85f6 743c }
                                                                                                
        $sequence_13 = { 7507 c743089a020000 85c0 0f84be010000 83f802 0f84b5010000 83f801 }
                                                                                                
        $sequence_14 = { 741a 488d05f9ef0000 483bf8 740e 833f00 }
                                                                        
        $sequence_15 = { 4c8bf1 b801000000 85ff 7404 8932 eb06 8bf8 }
                                                                                                
        $sequence_16 = { c745c047006c00 c745c662006100 c745ca6c005c00 668945ec c745ce43006100 c745d468006500 }
                                                                                    
        $sequence_17 = { 442bda 4183fb0f 731e 0fb606 418bcb 4883c602 }
                                                                                    
        $sequence_18 = { e8???????? 41894620 458bef 418bff 41c74608373f0000 eb05 }
                                                                                    
        $sequence_19 = { 488b4593 89442448 8bc8 e8???????? 488bf0 33c0 8945c7 }
                                                                                                
        $sequence_20 = { 4883eb02 4983c9ff ebae 488d45ef 4c8b4507 4983f808 490f43c4 }
                                                                                                
        $sequence_21 = { eb2e 4c8b542418 33ed 0f1f840000000000 420fb60411 48ffc1 }
                                                                                    
        $sequence_22 = { 488d1dc7850000 488d3de0850000 eb0e 488b03 4885c0 7402 }
                                                                                    
    condition:
        7 of them and filesize < 1400832
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e292f646-a3bb-4b19-8f5c-2b532499c994

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion