BrowserModifier_Win32_Zwangi_44

YARA detection rule by roadwy

BrowserModifier:Win32/Zwangi,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 17 00 00

rule BrowserModifier_Win32_Zwangi_44{
	meta:
		description = "BrowserModifier:Win32/Zwangi,SIGNATURE_TYPE_PEHSTR_EXT,03 00 03 00 17 00 00 "
		
	strings :
		$a_01_0 = {8b 45 f0 03 45 08 2b 45 f0 33 45 f4 89 45 f4 } 		$a_01_1 = {8b 55 f0 03 55 08 2b 55 f0 33 55 f4 89 55 f4 } 		$a_01_2 = {8b 4d f0 03 4d 08 2b 4d f0 33 4d f4 89 4d f4 } 		$a_01_3 = {0f be 55 f3 2b 55 f4 03 55 ec 89 55 ec } 		$a_01_4 = {0f be 45 f3 2b 45 f4 03 45 ec 89 45 ec } 		$a_01_5 = {0f be 4d f3 2b 4d f4 03 4d ec 89 4d ec } 		$a_01_6 = {0f be 55 ef 2b 55 f0 03 55 e8 89 55 e8 } 		$a_01_7 = {0f be 45 ef 2b 45 f0 03 45 e8 89 45 e8 } 		$a_01_8 = {0f be 4d ef 2b 4d f0 03 4d e8 89 4d e8 } 		$a_03_9 = {8b 45 08 8a 08 88 4d ?? 0f be 55 ?? 8b 45 08 83 c0 01 89 45 08 } 		$a_01_10 = {75 02 eb 10 eb e7 } 		$a_01_11 = {75 02 eb 2a eb 19 } 		$a_01_12 = {75 02 eb 10 eb da } 		$a_01_13 = {75 02 eb 04 eb e7 } 		$a_01_14 = {eb d1 eb 4b eb 3b } 		$a_03_15 = {83 f9 22 75 02 eb ?? eb 90 09 04 00 0f be 4d } 		$a_03_16 = {83 f8 22 75 02 eb ?? eb 90 09 04 00 0f be 45 } 		$a_03_17 = {83 fa 22 75 02 eb ?? eb 90 09 04 00 0f be 55 } 		$a_03_18 = {0f be 02 83 f8 22 75 5a eb ?? eb } 		$a_03_19 = {0f be 08 83 f9 22 75 51 eb ?? eb } 		$a_01_20 = {eb c7 eb bb eb 08 } 		$a_03_21 = {75 0c c7 05 28 83 40 00 00 00 00 00 eb 90 09 09 00 28 83 40 00 0f be ?? 85 } 		$a_03_22 = {89 4d f4 8b 55 ?? 83 3a 00 74 90 09 22 00 89 4d 90 1b 00 c7 45 fc ?? ?? ?? ?? c7 45 f8 ?? ?? ?? ?? 8b 45 f8 2d } 	condition:
		((#a_01_0  & 1)*1+(#a_01_1  & 1)*1+(#a_01_2  & 1)*1+(#a_01_3  & 1)*1+(#a_01_4  & 1)*1+(#a_01_5  & 1)*1+(#a_01_6  & 1)*1+(#a_01_7  & 1)*1+(#a_01_8  & 1)*1+(#a_03_9  & 1)*1+(#a_01_10  & 1)*1+(#a_01_11  & 1)*1+(#a_01_12  & 1)*1+(#a_01_13  & 1)*1+(#a_01_14  & 1)*1+(#a_03_15  & 1)*1+(#a_03_16  & 1)*1+(#a_03_17  & 1)*1+(#a_03_18  & 1)*1+(#a_03_19  & 1)*1+(#a_01_20  & 1)*1+(#a_03_21  & 1)*1+(#a_03_22  & 1)*1) >=3
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

4fb8659d-254c-4c0a-bbad-c4faddd50872

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion