Trojan_Win32_Coinminer_SIB_MTB

YARA detection rule by roadwy

Trojan:Win32/Coinminer.SIB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,4a 00 3f 00 07 00 00

rule Trojan_Win32_Coinminer_SIB_MTB{
	meta:
		description = "Trojan:Win32/Coinminer.SIB!MTB,SIGNATURE_TYPE_PEHSTR_EXT,4a 00 3f 00 07 00 00 "
		
	strings :
		$a_00_0 = {73 74 72 61 74 75 6d 2b 74 63 70 3a 2f 2f } 		$a_00_1 = {6d 69 6e 65 72 2e 66 65 65 2e 78 6d 72 69 67 2e 63 6f 6d } 		$a_00_2 = {65 6d 65 72 67 65 6e 63 79 2e 66 65 65 2e 78 6d 72 69 67 2e 63 6f 6d } 		$a_03_3 = {89 f5 8b 74 24 ?? f7 d5 89 eb 89 fd 8b 7c 24 ?? 21 c3 f7 d5 89 e9 89 dd 8b 9c 24 ?? ?? ?? ?? 21 d1 31 dd 89 ac 24 } 		$a_03_4 = {89 dd 8b 9c 24 ?? ?? ?? ?? f7 d5 f7 d6 89 ea 89 f0 8b b4 24 ?? ?? ?? ?? 21 da 89 d5 8b 54 24 ?? 21 f0 33 44 24 ?? f7 d6 31 d5 89 ac 24 } 		$a_03_5 = {89 d8 8b 5c 24 ?? f7 d0 89 c2 89 f0 8b 74 24 ?? 21 da 8b 5c 24 ?? f7 d0 23 44 24 ?? 89 d7 33 44 24 ?? 31 df 8b 5c 24 90 1b 00 89 7c 24 } 		$a_03_6 = {89 c8 8b 8c 24 ?? ?? ?? ?? f7 d0 89 c2 89 d8 8b 9c 24 ?? ?? ?? ?? f7 d0 21 f0 33 84 24 ?? ?? ?? ?? 21 da 89 d7 8b 94 24 90 1b 00 89 44 24 ?? 89 d8 31 d7 f7 d0 89 7c 24 } 	condition:
		((#a_00_0  & 1)*50+(#a_00_1  & 1)*10+(#a_00_2  & 1)*10+(#a_03_3  & 1)*1+(#a_03_4  & 1)*1+(#a_03_5  & 1)*1+(#a_03_6  & 1)*1) >=63
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

f5a0908a-31aa-44cf-9fe4-676f07b20947

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion