win_rm3_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.rm3.

rule win_rm3_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.rm3."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rm3"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { 03c2 394508 7303 8975f8 }
                                                            
        $sequence_1 = { 8b7938 8b4608 8b513c 8b5e10 }
                                                            
        $sequence_2 = { 8b5608 8d5410ff 48 f7d0 23d0 8b460c 03c2 }
                                                                                                
        $sequence_3 = { 8b7004 897104 8b4808 ff7004 034c240c 8b00 51 }
                                                                                                
        $sequence_4 = { 3bf8 7609 8b413c 8d5418ff }
                                                            
        $sequence_5 = { 56 57 8d740818 8b4508 3b460c 7247 8b7938 }
                                                                                                
        $sequence_6 = { 0fb74106 8365f800 53 8945fc 0fb74114 56 }
                                                                                    
        $sequence_7 = { 23c7 8d7c13ff 4a f7d2 23fa 3bf8 }
                                                                                    
        $sequence_8 = { 8d9568ffffff 8bc6 e8???????? ebd2 }
                                                            
        $sequence_9 = { 6a07 33d2 59 f7f1 8bf2 83c603 }
                                                                                    
        $sequence_10 = { 8d4d0c 51 8d4d08 51 ff7508 }
                                                                        
        $sequence_11 = { 56 ff7510 8d8df4feffff 51 ff7508 }
                                                                        
        $sequence_12 = { 50 e8???????? ff7518 8d85f0feffff ff750c 8d8d6cfeffff 50 }
                                                                                                
        $sequence_13 = { 56 57 8bf0 6a08 8d7e10 }
                                                                        
        $sequence_14 = { eb03 6a08 5e 8bc6 5e 5b }
                                                                                    
        $sequence_15 = { ff7508 33f6 ff15???????? 6a01 ff750c 8d4d0c 51 }
                                                                                                
        $sequence_16 = { 4c8b05???????? 498bf9 4d8b80c8000000 488bea 4c8d48d8 ba000000c0 }
                                                                                    
        $sequence_17 = { 4833ca 488d542440 488bc1 48c1e019 }
                                                            
        $sequence_18 = { 8b05???????? 498b0c24 4c8d842480000000 4869c080969800 33d2 4889842480000000 e8???????? }
                                                                                                
        $sequence_19 = { 488d8c2480000000 41b901000000 4533c0 488bd6 8bf8 }
                                                                        
        $sequence_20 = { 7794 448d4501 498bd4 498bcd e8???????? 488b5c2440 488b6c2448 }
                                                                                                
        $sequence_21 = { 483bc3 488bf0 0f842e010000 8b8c2480000000 488bd0 }
                                                                        
        $sequence_22 = { 4885f6 49895d00 41892c24 7422 }
                                                            
        $sequence_23 = { 4438642431 8bf8 7636 488d742438 448b0e ba4a000000 }
                                                                                    
        $sequence_24 = { 894de8 8b45e8 8b0c8504302500 8b55f0 39d1 8945e4 }
                                                                                    
        $sequence_25 = { 894dec 8955e8 8975e4 8945e0 0f84f2000000 8b45f0 }
                                                                                    
        $sequence_26 = { 89c7 01f7 83c6c0 81fec00f0000 8945f4 894df0 }
                                                                                    
        $sequence_27 = { 8b85d4fbffff 50 e8???????? 83c404 8b0d???????? 50 8b85d4fbffff }
                                                                                                
        $sequence_28 = { 8b8dd0fdffff 890c24 8985c0fdffff e8???????? b901000000 8985bcfdffff 898dccfdffff }
                                                                                                
        $sequence_29 = { 89758c 897d88 e8???????? 8b45b4 8b483c }
                                                                        
        $sequence_30 = { 8bbd6cffffff 57 898564ffffff 898d60ffffff 89955cffffff ffd6 }
                                                                                    
        $sequence_31 = { 80fa00 8945f4 894df0 742f 8b45f4 8b4df0 8945ec }
                                                                                                
        $sequence_32 = { 8b85d4fbffff 50 6a17 68???????? }
                                                            
        $sequence_33 = { 8b8d60ffffff 83c101 8b954cffffff 83c228 8b75ac }
                                                                        
        $sequence_34 = { 891c24 89442404 c744240800000000 8954240c 8b4590 894d80 }
                                                                                    
        $sequence_35 = { e8???????? 8b4df0 894130 8b4154 890424 894c2404 }
                                                                                    
        $sequence_36 = { 51 8bb5e0fbffff 56 8985c0fbffff ffd2 83f800 }
                                                                                    
        $sequence_37 = { 31d2 8b75f0 89461c 890c24 }
                                                            
        $sequence_38 = { 57 56 81ecbc000000 8b4508 b904000000 8d55d8 89d6 }
                                                                                                
        $sequence_39 = { 803d????????00 898574ffffff 0f84b9000000 31c0 8d8d78ffffff 89c2 899570ffffff }
                                                                                                
    condition:
        7 of them and filesize < 221184
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d2830edc-2b0a-4662-8aeb-a25a3b2d0ede

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion