Trojan_Win32_TrickBotCrypt_EA_MTB_2

YARA detection rule by roadwy

Trojan:Win32/TrickBotCrypt.EA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00

rule Trojan_Win32_TrickBotCrypt_EA_MTB_2{
	meta:
		description = "Trojan:Win32/TrickBotCrypt.EA!MTB,SIGNATURE_TYPE_PEHSTR_EXT,05 00 05 00 05 00 00 "
		
	strings :
		$a_03_0 = {0f b6 04 0e 03 c2 33 d2 f7 35 ?? ?? ?? ?? a1 ?? ?? ?? ?? 8b d8 0f af d8 4b 0f af d8 a1 ?? ?? ?? ?? 03 d3 2b d0 8b 44 24 10 8a 18 8a 14 0a 32 da 88 18 } 		$a_81_1 = {38 6f 46 62 6f 23 48 55 68 7a 21 4e 5e 7a 56 4e 23 7a 66 65 5a 67 5f 73 4d 6e 58 3f 50 26 37 45 36 25 69 41 23 4d 54 26 6f 36 36 69 74 24 74 5f 37 4a 51 69 62 59 66 52 65 74 37 48 69 50 3f 5f 2a 56 30 37 76 4d 57 62 } 		$a_81_2 = {51 66 52 43 4d 76 33 45 48 59 59 3c 57 36 25 61 50 55 59 47 55 6a 74 2a 36 47 23 26 50 26 38 46 61 62 57 47 65 43 40 4f 6a 26 23 79 49 26 48 70 6b 6c 42 49 31 4a 79 50 23 45 54 76 5f 57 56 52 57 25 42 53 5a 47 29 76 26 63 51 3f 6e 79 73 7a 37 4a 48 3e 21 46 78 43 7a 2a 69 66 4c 4f 4e 21 79 31 67 4f 37 6e 3f 59 6a 30 37 30 29 42 } 		$a_81_3 = {4e 54 28 5a 70 23 5e 23 40 23 36 49 5e 41 6b 74 3e 4a 6c 56 26 3e 50 59 77 65 34 30 6a 61 5a 25 6e 4d 58 4e 40 53 2a 4f 21 6a 6c 4f 4a 44 6d 37 4d 28 76 64 3f 55 4f 25 78 3f 42 6d 48 4c 6d 78 26 28 28 3f 51 64 68 5a 28 25 5a 52 77 5e 32 67 64 4a 3e 65 35 44 28 4f } 		$a_81_4 = {54 6a 79 36 6f 23 6c 57 6d 67 75 35 21 49 30 3e 34 6c 77 79 73 29 4f 5e 4c 71 2b 29 6f 5e 6b 72 55 58 42 38 4e 2b 35 64 5f 28 55 43 64 4e 43 6a 70 64 55 71 53 69 42 2a 24 6c 33 24 45 52 6e 4c 31 34 78 66 52 6a 2a 36 21 3f 23 78 32 48 78 } 	condition:
		((#a_03_0  & 1)*5+(#a_81_1  & 1)*5+(#a_81_2  & 1)*5+(#a_81_3  & 1)*5+(#a_81_4  & 1)*5) >=5
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4ae5c5a0-716c-47ec-8a34-d543d450450f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion