win_gauss_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com · GPL-2.0

Detects win.gauss.

rule win_gauss_auto {
  meta:
    author             = "Felix Bilstein - yara-signator at cocacoding dot com"
    date               = "2023-07-11"
    version            = "1"
    description        = "Detects win.gauss."
    info               = "autogenerated rule brought to you by yara-signator"
    tool               = "yara-signator v0.6.0"
    signator_config    = "callsandjumps;datarefs;binvalue"
    malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gauss"
    malpedia_rule_date = "20230705"
    malpedia_hash      = "42d0574f4405bd7d2b154d321d345acb18834a41"
    malpedia_version   = "20230715"
    malpedia_license   = "CC BY-SA 4.0"
    malpedia_sharing   = "TLP:WHITE"
  

  strings:
    $sequence_0  = { 57 89 65 f0 8b 75 08 e8 ?? ?? ?? ?? }
                        $sequence_1  = { e8 ?? ?? ?? ?? 89 45 08 89 45 ec c6 45 fc 01 }
                        $sequence_2  = { 33 db 89 5d e4 66 89 5d d4 89 5d fc c6 45 fc 01 }
                            $sequence_3  = { 56 e8 ?? ?? ?? ?? 8b b0 80 00 00 00 e8 ?? ?? ?? ?? 8b 4c 24 08 }
                            $sequence_4  = { e8 ?? ?? ?? ?? 8b 4c 24 08 89 88 80 00 00 00 8b c6 }
                        $sequence_5  = { 8b f1 50 89 75 f0 e8 ?? ?? ?? ?? 83 65 fc 00 c7 06 ?? ?? ?? ?? 83 4d fc ff }
                                    $sequence_6  = { 56 8b f0 76 05 e8 ?? ?? ?? ?? 8b 46 18 3b c7 73 0c }
                                    $sequence_7  = { 72 05 8b 40 04 eb 03 83 c0 04 66 83 24 48 00 }
                            $sequence_8  = { b8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 51 56 8d 45 08 8b f1 }
                                $sequence_9  = { e8 ?? ?? ?? ?? c7 44 24 10 ff ff ff ff 8b 4c 24 08 8b c6 }
                        $sequence_10 = { 56 8b f0 39 5e 14 57 }
                        $sequence_11 = { ff 76 14 57 56 e8 ?? ?? ?? ?? eb 18 }
                            $sequence_12 = { 83 7d 08 00 76 53 8b 4e 18 83 f9 08 }
                        $sequence_13 = { cc 83 3e 00 75 05 e8 ?? ?? ?? ?? }
                        $sequence_14 = { 6a 01 e8 ?? ?? ?? ?? 59 c3 55 8b ec 83 ec 14 }
                                    $sequence_15 = { c6 45 fc 02 83 c0 01 50 8b 4d ec e8 ?? ?? ?? ?? 89 45 e8 c7 45 fc 01 00 00 00 }
                                    $sequence_16 = { 8b 4e 18 83 f9 08 53 8d 56 04 72 07 8b 1a 89 5d fc }
                
  condition:
    7 of them and filesize < 827392
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

76994ba0-f535-4940-846b-302142ccf50b

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion