Backdoor_Win32_HackerDefender_2

YARA detection rule by roadwy

Backdoor:Win32/HackerDefender,SIGNATURE_TYPE_PEHSTR_EXT,19 00 14 00 18 00 00

rule Backdoor_Win32_HackerDefender_2{
	meta:
		description = "Backdoor:Win32/HackerDefender,SIGNATURE_TYPE_PEHSTR_EXT,19 00 14 00 18 00 00 "
		
	strings :
		$a_00_0 = {5c 5c 2e 5c 48 78 44 65 66 44 72 69 76 65 72 } 		$a_00_1 = {5c 5c 2e 5c 6d 61 69 6c 73 6c 6f 74 5c 68 78 64 65 66 2d 72 6b 31 30 30 73 } 		$a_00_2 = {5c 5c 2e 5c 6d 61 69 6c 73 6c 6f 74 5c 68 78 64 65 66 2d 72 6b 31 30 30 73 30 41 43 45 45 37 36 31 } 		$a_00_3 = {50 72 65 66 65 74 63 68 5c 2a 2e 70 66 } 		$a_00_4 = {5c 5c 2e 5c 6d 61 69 6c 73 6c 6f 74 5c 68 78 64 65 66 2d 72 6b 63 } 		$a_00_5 = {5c 5c 2e 5c 6d 61 69 6c 73 6c 6f 74 5c 68 78 64 65 66 2d 72 6b 62 } 		$a_00_6 = {5c 5c 2e 5c 6d 61 69 6c 73 6c 6f 74 5c 68 78 64 65 66 2d 72 6b 73 } 		$a_01_7 = {2d 3a 62 64 3a 2d } 		$a_00_8 = {2d 3a 49 4e 53 54 41 4c 4c 4f 4e 4c 59 } 		$a_00_9 = {2d 3a 52 45 46 52 45 53 48 } 		$a_00_10 = {2d 3a 4e 4f 53 45 52 56 49 43 45 } 		$a_00_11 = {2d 3a 55 4e 49 4e 53 54 41 4c 4c } 		$a_01_12 = {2d 3a 42 44 3a 2d } 		$a_00_13 = {47 48 61 6e 64 6c 65 73 20 76 31 2e 30 20 66 6f 72 20 47 4b 69 74 20 62 79 20 67 72 61 79 2c 74 68 78 20 66 6f 72 20 48 6f 6c 79 5f 46 61 74 68 65 72 20 26 26 20 52 61 74 74 65 72 2f 32 39 41 } 		$a_00_14 = {5c 00 44 00 6f 00 73 00 44 00 65 00 76 00 69 00 63 00 65 00 73 00 5c 00 48 00 78 00 44 00 65 00 66 00 44 00 72 00 69 00 76 00 65 00 72 00 } 		$a_00_15 = {5c 00 44 00 65 00 76 00 69 00 63 00 65 00 5c 00 48 00 78 00 44 00 65 00 66 00 44 00 72 00 69 00 76 00 65 00 72 00 } 		$a_00_16 = {5a 77 44 75 70 6c 69 63 61 74 65 54 6f 6b 65 6e } 		$a_00_17 = {5a 77 4f 70 65 6e 50 72 6f 63 65 73 73 54 6f 6b 65 6e } 		$a_00_18 = {8b 4d e8 89 4d f4 c7 45 f8 00 00 00 00 8d 55 f4 52 8d 45 d0 50 68 ff 0f 1f 20 00 8d 4d a0 51 ff 15 } 		$a_00_19 = {ff 75 f0 ff 15 f4 07 01 00 85 c0 7c 4d 8d 45 d0 50 6a 01 8d 45 b8 53 50 68 ff 00 0f 00 ff 75 0c ff 15 } 		$a_00_20 = {85 c0 7c 27 8d 45 d0 6a 08 50 6a 09 ff 75 dc 89 5d d4 ff 15 } 		$a_00_21 = {85 c0 7c 7a 8d 45 b4 50 68 ff 00 0f 00 8b 4d f0 51 ff 15 } 		$a_00_22 = {85 c0 7c 30 c7 45 c8 00 00 00 00 6a 08 8d 55 c4 52 6a 09 8b 45 a0 50 ff 15 } 		$a_00_23 = {85 c0 7c 09 8b 4d b0 c7 01 01 00 00 00 8b 55 c4 52 ff 15 } 	condition:
		((#a_00_0  & 1)*2+(#a_00_1  & 1)*2+(#a_00_2  & 1)*2+(#a_00_3  & 1)*2+(#a_00_4  & 1)*2+(#a_00_5  & 1)*2+(#a_00_6  & 1)*2+(#a_01_7  & 1)*2+(#a_00_8  & 1)*2+(#a_00_9  & 1)*2+(#a_00_10  & 1)*2+(#a_00_11  & 1)*2+(#a_01_12  & 1)*2+(#a_00_13  & 1)*2+(#a_00_14  & 1)*5+(#a_00_15  & 1)*5+(#a_00_16  & 1)*3+(#a_00_17  & 1)*3+(#a_00_18  & 1)*5+(#a_00_19  & 1)*5+(#a_00_20  & 1)*5+(#a_00_21  & 1)*5+(#a_00_22  & 1)*5+(#a_00_23  & 1)*5) >=20
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

1c931fea-2569-4127-9f5c-4465b2cde7c6

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion