Eimeria_MultiStage_Loader

YARA detection rule by derp.ca · Unknown

Eimeria case rule targeting the malicious zlibwapi.dll AES loader and recovered AutoIt RunPE loader with process-hollowing imports.

import "pe"
rule Eimeria_MultiStage_Loader
{
    meta:
        id = "4KwQv5HVdzRxtlSq39Hu2t"
        fingerprint = "a6b4c8d2e0f1a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c2d3e4f5a6"
        version = "2.1"
        date = "2026-05-18"
        modified = "2026-05-19"
        status = "RELEASED"
        sharing = "TLP:CLEAR"
        source = "https://github.com/kirkderp/yara"
        author = "derp.ca"
        description = "Eimeria case rule targeting the malicious zlibwapi.dll AES loader and recovered AutoIt RunPE loader with process-hollowing imports."
        category = "MALWARE"
        malware = "EIMERIA"
        malware_type = "RAT"
        mitre_att = "T1055.012"
        reference = "https://github.com/kirkderp/yara"
        triage_score = 10
        triage_description = "Eimeria multi-stage loader chain with zlibwapi.dll AES loader and AutoIt RunPE process-hollowing evidence."
        yarahub_uuid = "41ee8f0e-3835-46fd-b5c6-6321117ba729"
        yarahub_license = "CC0 1.0"
        yarahub_rule_matching_tlp = "TLP:WHITE"
        yarahub_rule_sharing_tlp = "TLP:WHITE"
        yarahub_reference_md5 = "f8a9f400ee56eb3bb2d539fa662b60da"

    strings:
                $aes_sbox = {63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76}
        $rcon = {01 02 04 08 10 20 40 80 1b 36}
        $bcrypt_dll = "bcrypt.dll" ascii

                $autoit_runtime = "AUTOIT CONSULTING LTD" ascii
        $autoit_eula = "It is a violation of the AutoIt EULA" ascii

                $api_createproc = "CreateProcess" ascii
        $api_valloc = "VirtualAllocEx" ascii
        $api_writeproc = "WriteProcessMemory" ascii
        $api_resume = "ResumeThread" ascii
        $api_readproc = "ReadProcessMemory" ascii

    condition:
        uint16(0) == 0x5A4D
        and (
                        (
                pe.is_dll() and
                pe.machine == pe.MACHINE_I386 and
                filesize > 80KB and filesize < 140KB and
                pe.imports("bcrypt.dll", "BCryptGenRandom") and
                pe.imports("KERNEL32.dll", "CreateProcessA") and
                pe.exports("inflate") and pe.exports("deflate") and
                $aes_sbox and $rcon and $bcrypt_dll
            )
            or
                        (
                pe.machine == pe.MACHINE_AMD64 and
                filesize > 900KB and filesize < 1400KB and
                pe.imports("KERNEL32.dll", "VirtualAllocEx") and
                pe.imports("KERNEL32.dll", "WriteProcessMemory") and
                pe.imports("KERNEL32.dll", "ReadProcessMemory") and
                pe.imports("KERNEL32.dll", "ResumeThread") and
                pe.imports("KERNEL32.dll", "CreateProcessW") and
                $autoit_runtime and $autoit_eula and
                3 of ($api_createproc, $api_valloc, $api_writeproc, $api_resume, $api_readproc)
            )
        )
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

63d9779b-63c5-4056-b614-7d49c54f1d93

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion