Trojan_Win32_Ninunarch_Q

YARA detection rule by roadwy

Trojan:Win32/Ninunarch.Q,SIGNATURE_TYPE_PEHSTR,07 00 07 00 03 00 00

rule Trojan_Win32_Ninunarch_Q{
	meta:
		description = "Trojan:Win32/Ninunarch.Q,SIGNATURE_TYPE_PEHSTR,07 00 07 00 03 00 00 "
		
	strings :
		$a_01_0 = {2f 73 79 6e 63 2f 70 61 79 2f 3f 61 6a 61 78 3d 31 26 67 6f 3d 61 75 74 68 26 70 61 73 73 77 6f 72 64 3d 25 73 26 63 72 79 70 74 3d } 		$a_01_1 = {61 48 52 30 63 44 6f 76 4c 32 52 76 64 32 35 73 62 32 46 6b 63 33 56 77 63 47 39 79 64 43 35 69 61 58 6f 3d } 		$a_01_2 = {33 65 34 2f 33 65 34 2f 64 6f 33 65 34 77 6e 33 65 34 6c 6f 33 65 34 61 33 65 34 64 73 33 65 34 75 70 33 65 34 70 6f 33 65 34 72 74 33 65 34 } 	condition:
		((#a_01_0  & 1)*6+(#a_01_1  & 1)*1+(#a_01_2  & 1)*1) >=7
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f675d8ed-632a-4a7e-b328-ab498ca4d6e6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion