win_godoh_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com · GPL-2.0

autogenerated rule brought to you by yara-signator

rule win_godoh_auto {
  meta:
    author             = "Felix Bilstein - yara-signator at cocacoding dot com"
    date               = "2020-10-14"
    version            = "1"
    description        = "autogenerated rule brought to you by yara-signator"
    tool               = "yara-signator v0.5.0"
    signator_config    = "callsandjumps;datarefs;binvalue"
    malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.godoh"
    malpedia_rule_date = "20201014"
    malpedia_hash      = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
    malpedia_version   = "20201014"
    malpedia_license   = "CC BY-SA 4.0"
    malpedia_sharing   = "TLP:WHITE"
  

  strings:
    $sequence_0 = { cf 8e 5f f8 88 ee e8 ?? ?? ?? ?? 45 50 }
                            $sequence_1 = { 48 89 e9 ff 15 ?? ?? ?? ?? 48 09 c0 74 09 48 89 03 48 83 c3 08 eb d6 }
                                    $sequence_2 = { 11 c0 01 db 75 0a 8b 1e 48 83 ee fc 11 db }
                                $sequence_3 = { 36 b6 f8 18 87 23 d1 98 a8 5d 55 87 99 b9 0f 0f 4a }
                            $sequence_4 = { 35 41 36 41 37 41 38 41 39 41 12 94 20 fe 3a 41 3b 41 3c 41 3d fe 03 89 7f }
                            $sequence_5 = { 70 13 d3 40 17 7b 00 5c 35 48 3f 80 e2 }
                            $sequence_6 = { 28 25 c9 e9 a6 f2 6e 12 c6 6f e1 39 f0 11 40 2e }
                                $sequence_7 = { d0 24 89 9e f2 09 6a 14 79 52 5a b8 b6 01 c7 65 }
                                $sequence_8 = { 85 2e ba b6 9d 28 79 43 8b 9c 76 0a 59 4a 07 bd 0e 53 17 86 }
                        $sequence_9 = { 35 dc 3e 69 04 79 3c 5f 6a d5 }
          
  condition:
    7 of them and filesize < 14467072
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

0aa1d875-4385-44f5-8054-1721b04f0ec4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion