TrojanDownloader_O97M_Powdow_AR_MTB_8

YARA detection rule by roadwy

TrojanDownloader:O97M/Powdow.AR!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,19 00 19 00 04 00 00

rule TrojanDownloader_O97M_Powdow_AR_MTB_8{
	meta:
		description = "TrojanDownloader:O97M/Powdow.AR!MTB,SIGNATURE_TYPE_MACROHSTR_EXT,19 00 19 00 04 00 00 "
		
	strings :
		$a_00_0 = {64 32 6c 75 62 57 64 74 64 48 4d 36 64 32 6c 75 4d 7a 4a 66 55 48 4a 76 59 32 56 7a 63 77 3d 3d } 		$a_00_1 = {63 47 39 33 5a 58 4a 7a 61 47 56 73 62 43 35 6c 65 47 55 67 4c 56 64 70 62 6d 52 76 64 31 4e 30 65 57 78 6c 49 45 68 70 5a 47 52 6c 62 69 41 74 52 58 68 6c 59 33 56 30 61 57 39 75 55 47 39 73 61 57 4e 35 49 45 4a 35 63 47 46 7a 63 79 41 67 4c 57 4e 76 62 57 31 68 62 6d 51 67 49 69 41 6d 49 48 73 67 61 58 64 79 49 47 68 30 64 48 41 36 4c 79 38 } 		$a_00_2 = {4c 6d 70 77 5a 79 41 74 54 33 56 30 52 6d 6c 73 5a 53 42 44 4f 6c 78 56 63 32 56 79 63 31 78 51 64 57 4a 73 61 57 4e 63 } 		$a_03_3 = {4c 6d 56 34 5a 58 30 37 49 43 59 67 65 31 4e 30 59 58 4a 30 4c 56 42 79 62 32 4e 6c 63 33 4d 67 4c 55 5a 70 62 47 56 51 59 58 52 6f 49 43 4a 44 4f 6c 78 56 63 32 56 79 63 31 78 51 64 57 4a 73 61 57 4e 63 55 47 6c 6a 64 48 56 79 5a 58 4e 63 [0-14] 4c 6d 56 34 5a 53 4a 39 49 67 } 	condition:
		((#a_00_0  & 1)*5+(#a_00_1  & 1)*5+(#a_00_2  & 1)*10+(#a_03_3  & 1)*10) >=25
 
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

45db492d-b985-4e62-a787-b900e1252250

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion