DLL_BankingTrojan_Coyote_Feb2024

YARA detection rule by Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell · Unknown

Rule DLL_BankingTrojan_Coyote_Feb2024 (No description metadata provided).

import "pe"
rule DLL_BankingTrojan_Coyote_Feb2024 {
    meta:
        Description = "Detects Coyote malware samples based on the PE properties"
        author = "Yashraj Solanki - Cyber Threat Intelligence Analyst at Bridewell"
        Reference = "https://securelist.com/coyote-multi-stage-banking-trojan/111846/"
        Hash = "1bed3755276abd9b54db13882fcf29c543ebf604be3b7fcf060cbd6d68bcd23f"
        date = "2024-02-22"
        yarahub_author_twitter = "@RustyNoob619"
        yarahub_reference_md5 = "276f14d432601003b6bf0caa8cd82fec"
        yarahub_uuid = "7cab9244-f039-45c7-9aa4-b79e169fb82f"
        yarahub_license = "CC0 1.0"
        yarahub_rule_matching_tlp = "TLP:WHITE"
        yarahub_rule_sharing_tlp = "TLP:WHITE"
    
    condition:
       pe.dll_name == "chrome_elf.dll"
       and pe.number_of_exports > 25 
       and for 10 export in pe.export_details:
       (export.name == "DumpHungProcessWithPtype_ExportThunk"
       or export.name == "RequestSingleCrashUpload_ExportThunk"
       or export.name == "GetCrashpadDatabasePath_ExportThunk"
       or export.name == "InjectDumpForHungInput_ExportThunk"
       or export.name == "SetUploadConsent_ExportThunk"
       or export.name == "DrainLog"
       or export.name == "GetInstallDetailsPayload"
       or export.name == "GetUniqueBlockedModulesCount"
       or export.name == "IsExtensionPointDisableSet"
       or export.name == "IsBrowserProcess"
       or export.name == "SetUploadConsent_ExportThunk"
       or export.name == "SignalChromeElf")
       
 }

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

84d92b61-57d2-45ad-b203-0e1af122d3ea

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion