win_ceeloader_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com

Detects win.ceeloader.

rule win_ceeloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.ceeloader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ceeloader"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    


    strings:
        $sequence_0 = { 898424380b0000 8b8424e40a0000 0b8424080a0000 8984243c0a0000 8b8424f0050000 0b842470080000 89842430070000 }
                                                                                                
        $sequence_1 = { 0fbe05???????? 83f042 88c1 888c241d010000 0fbe05???????? 83f069 88c1 }
                                                                                                
        $sequence_2 = { 33f5 0bda 8bde 0bd3 3bce 8bf5 }
                                                                                    
        $sequence_3 = { c784249002000075380000 c784248c020000c5360000 c78424880200005a380000 c7842484020000ff6f0000 c7842480020000123e0000 c784247c02000043360000 c78424780200001f220000 }
                                                                                                
        $sequence_4 = { 668b9c2406120000 6681f3ffff 66899c2404120000 6623bc2404120000 6689bc2402120000 668bbc2402120000 6689d3 }
                                                                                                
        $sequence_5 = { 2500feffff 898424b80b0000 8b8424b80b0000 05ffffffff 898424b40b0000 8b8424b40b0000 83e000 }
                                                                                                
        $sequence_6 = { 6b94242801000005 89942424010000 8b942424010000 83e280 89942420010000 8b942420010000 3b15???????? }
                                                                                                
        $sequence_7 = { 48c784242802000000000000 4c8b842428020000 668b942430020000 668b8c2432020000 ff15???????? 89842424020000 8b8424600c0000 }
                                                                                                
        $sequence_8 = { 488981f0000000 488b05???????? 488b80f0000000 4c8b442448 8b542444 488b4c2438 ffd0 }
                                                                                                
        $sequence_9 = { 8b8424c00c0000 c1e808 898424bc0c0000 8b8424bc0c0000 c1e002 898424b80c0000 8b8424b80c0000 }
                                                                                                
    condition:
        7 of them and filesize < 2321408
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e054360b-055d-47a7-a4f7-6a31c1f1e4f9

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion