Trojan_Win64_Spyboy_AB_MTB

YARA detection rule by roadwy

Trojan:Win64/Spyboy.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,67 00 67 00 06 00 00

rule Trojan_Win64_Spyboy_AB_MTB{
	meta:
		description = "Trojan:Win64/Spyboy.AB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,67 00 67 00 06 00 00 "
		
	strings :
		$a_01_0 = {f1 d5 00 fa 4c 62 cc f4 0f 0b } 		$a_01_1 = {57 6d 56 74 59 57 35 68 49 45 78 30 5a 43 34 78 46 44 41 53 42 67 4e 56 42 41 4d 54 43 31 70 6c 62 57 46 75 59 53 42 4d 64 47 51 75 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 73 4d 67 30 } 		$a_01_2 = {36 42 56 4a 30 62 45 6c 75 61 58 52 56 62 6d 6c 6a 62 32 52 6c 55 33 52 79 61 57 35 6e 41 41 42 52 42 56 4a 30 62 45 4e 76 63 48 6c 56 62 6d 6c 6a 62 32 52 6c 55 33 52 79 61 57 35 6e 41 41 41 2f } 		$a_01_3 = {41 53 41 43 49 41 4d 67 42 43 41 46 49 41 59 67 42 79 41 49 49 41 6b 67 43 69 41 4c 49 41 77 67 44 53 41 4f 49 41 43 42 44 79 41 51 49 42 45 67 45 69 41 54 49 42 51 67 46 53 41 57 49 42 63 67 } 		$a_03_4 = {1f 00 e8 69 31 00 00 8b d8 85 ?? ?? ?? 8b 0e 48 8d 05 22 ?? ?? ?? ?? ?? 0d 3b 00 01 00 89 4c 24 30 48 89 44 24 28 48 ?? ?? ?? ?? 00 00 b9 07 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 13 93 ff ff eb 06 8b 44 24 50 89 07 48 8b 74 24 60 8b c3 48 8b 5c } 		$a_01_5 = {5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 5a 00 65 00 6d 00 61 00 6e 00 61 00 41 00 6e 00 74 00 69 00 4d 00 61 00 6c 00 77 00 61 00 72 00 65 00 } 	condition:
		((#a_01_0  & 1)*100+(#a_01_1  & 1)*1+(#a_01_2  & 1)*1+(#a_01_3  & 1)*1+(#a_03_4  & 1)*2+(#a_01_5  & 1)*2) >=103
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

22bfad4c-d318-4a68-81a3-d48a54e91a24

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion