Trojan_Win32_CoinMiner_Z_MTB

YARA detection rule by roadwy

Trojan:Win32/CoinMiner.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00

rule Trojan_Win32_CoinMiner_Z_MTB{
	meta:
		description = "Trojan:Win32/CoinMiner.Z!MTB,SIGNATURE_TYPE_PEHSTR,01 00 01 00 01 00 00 "
		
	strings :
		$a_01_0 = {3f 2c d3 51 f2 3f c2 13 1c 58 e3 61 d3 08 2d 8c 4d 70 9b 41 6f 35 1b f1 2a 16 4d 92 ae e7 d2 e3 14 33 f2 c2 d6 79 60 f0 30 38 d2 e1 f2 db 3c 74 f1 e0 38 dd cb 1c f9 ca 07 83 0f 18 e9 96 cf cd 16 1f 75 dd 01 b6 4f ca df 14 43 e2 4c 0c 8a f1 41 7e 65 88 1e 11 dd 74 c0 83 2e fc 4c 7b 99 68 bf 9a e2 24 1a b7 70 df 8b 75 80 03 3c d4 48 53 cb 22 5c 18 34 e8 83 da b3 c3 1e 22 26 b0 f2 44 23 b6 89 c1 cc 92 e7 fb ec 21 8b c6 79 e8 e3 61 } 	condition:
		((#a_01_0  & 1)*1) >=1
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

24ed3d1f-869a-42fa-958c-f6687cc90b0c

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion