win_matsnu_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.matsnu.

rule win_matsnu_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.matsnu."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matsnu"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { c745b800000000 c745bc41424344 c745c045464748 c745c4494a4b4c c745c84d4e4f50 c745cc51525354 }
                                                                                    
        $sequence_1 = { ff45c6 8b4dc2 b801000000 d3e0 }
                                                            
        $sequence_2 = { c1e004 8b7dfa 01c7 8b45de 8907 8b45e6 c1e004 }
                                                                                                
        $sequence_3 = { c745e800000000 c745ec00000000 c645f000 c645f100 }
                                                            
        $sequence_4 = { 2945ce ebd3 c745d600000000 c745da00010000 c745e200000000 8b7dfa 817de2ff000000 }
                                                                                                
        $sequence_5 = { e2fc 3945ca 7509 837dd20c }
                                                            
        $sequence_6 = { 817dd6000f0000 7303 ff45d6 8b45f2 c1e004 8b75fa 01c6 }
                                                                                                
        $sequence_7 = { 31c9 8a4e01 80e1f0 c0e904 08c8 }
                                                                        
        $sequence_8 = { 7201 c3 ff837d080074 06 837d0c00 7505 e9???????? }
                                                                                                
        $sequence_9 = { 837d1800 7405 8b7d18 8907 b820000000 eb02 }
                                                                                    
    condition:
        7 of them and filesize < 606992
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4cb40e6c-61b0-43a2-91c9-a778aaeeb475

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion