Trojan_Win32_Emotetcrypt_IU_MTB

YARA detection rule by roadwy

Trojan:Win32/Emotetcrypt.IU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 06 00 00

rule Trojan_Win32_Emotetcrypt_IU_MTB{
	meta:
		description = "Trojan:Win32/Emotetcrypt.IU!MTB,SIGNATURE_TYPE_PEHSTR_EXT,0b 00 0b 00 06 00 00 "
		
	strings :
		$a_01_0 = {44 6c 6c 52 65 67 69 73 74 65 72 53 65 72 76 65 72 } 		$a_01_1 = {6f 4e 65 6e 41 41 61 62 63 62 7a 5a 43 6a 31 28 61 6b 42 3c 74 52 65 36 48 3e 7a 47 6c 37 6e 47 72 46 37 56 38 49 6b 4f 4f 4b 78 49 } 		$a_01_2 = {4d 4f 53 26 34 28 4d 34 63 29 48 47 28 31 47 62 63 23 78 4f 6c 6a 4a 29 35 6c 5f 4c 21 4d 3f 71 37 21 43 58 3f 25 58 35 61 71 24 28 33 55 38 59 37 6c 69 41 39 4c 25 44 6e 61 25 23 2b 70 38 3f 4f 25 6e 61 53 5f 73 68 4c 6e 70 75 38 75 6c 4a 71 51 73 3c 68 5e 54 24 41 4d 76 74 65 43 57 39 39 61 51 48 39 69 51 79 68 55 4f 35 4f 76 62 37 74 4c 44 52 5f 67 33 } 		$a_01_3 = {35 48 7a 79 78 68 55 66 35 45 6b 6d 4d 74 62 32 4f 4b 51 67 31 63 42 40 4d 55 69 29 61 49 6f 5a 47 56 47 42 76 3c 45 43 41 39 74 24 6c 4f 79 31 33 58 46 50 73 50 3c 41 52 59 4c 43 23 4a 43 41 4f 37 3f 38 32 55 36 70 67 63 6e 61 72 37 68 56 63 49 41 32 57 70 2b 77 55 33 66 72 54 68 6d 26 6a 73 21 6b 61 6f 51 52 55 3f 31 62 50 3f } 		$a_01_4 = {6d 41 4f 2a 4d 3e 71 6b 4f 3e 43 26 5f 66 46 29 2a 55 68 45 3f 61 53 6e 69 6c 25 54 45 26 77 6f 6d 4a 69 72 42 39 31 6a 7a 71 57 39 42 53 68 29 75 28 6e 59 23 46 4b 34 34 48 34 47 59 63 33 42 6b 30 4e 29 4b 45 57 69 26 39 71 6c 23 70 67 46 36 75 4c 29 45 31 6b 4d 33 39 42 73 50 63 73 40 75 52 32 5f 3e 3e 35 65 32 67 29 67 66 4c 62 68 66 64 49 23 59 6a 74 } 		$a_01_5 = {75 39 30 5e 31 47 4c 49 63 5e 44 44 32 57 62 26 46 67 28 48 7a 56 2a 35 3c 6e 6b 40 65 71 55 65 6b 34 2a 3e 7a 32 6a 50 47 31 70 68 35 34 26 6c 4d 78 4a 30 63 32 6e 31 41 7a 73 28 62 26 36 4c 6f 67 3c 24 38 56 25 76 72 45 57 24 33 4a 35 35 23 28 3c 55 78 4e 30 37 46 39 34 3c 3f 38 3c 5e 3f 4d 72 66 34 39 23 3e 45 51 34 31 3c 31 46 5e } 	condition:
		((#a_01_0  & 1)*10+(#a_01_1  & 1)*1+(#a_01_2  & 1)*1+(#a_01_3  & 1)*1+(#a_01_4  & 1)*1+(#a_01_5  & 1)*1) >=11
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1e6f4128-bd55-404e-9adf-82517775acef

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion