EE_Dropper

YARA detection rule by @bartblaze · MIT

Identifies dropper, EXE dropping and loading 3 CAB files, as seen in Earth Estries campaign.

import "pe"
rule EE_Dropper
{
    meta:
        id = "25d2Jqee4Uip3sr0muPuRO"
        fingerprint = "v1_sha256_8c095876a8282857f9434e97fce844d79e4dd8994a9dc61d2be3fce8f6dcb6d1"
        version = "1.0"
        date = "2025-10-27"
        modified = "2025-10-27"
        status = "RELEASED"
        sharing = "TLP:CLEAR"
        source = "BARTBLAZE"
        author = "@bartblaze"
        description = "Identifies dropper, EXE dropping and loading 3 CAB files, as seen in Earth Estries campaign."
        category = "MALWARE"
        reference = "https://bartblaze.blogspot.com/2025/10/earth-estries-alive-and-kicking.html"
        hash = "3822207529127eb7bdf2abc41073f6bbe4cd6e9b95d78b6d7dd04f42d643d2c3"

	strings:
		$cab = {4D 53 43 46} 
	condition:
		uint16(0) == 0x5A4D and
		#cab == 3 and
		(
			for any i in (0 .. pe.number_of_resources - 1): (
				pe.resources[i].type_string == "T\x00E\x00S\x00T\x00"
			)
		)
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0e1d4d4a-14bb-4eed-9dab-77eaece9d5d6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion