win_leakthemall_auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com · GPL-2.0

autogenerated rule brought to you by yara-signator

rule win_leakthemall_auto {
  meta:
    author             = "Felix Bilstein - yara-signator at cocacoding dot com"
    date               = "2020-10-14"
    version            = "1"
    description        = "autogenerated rule brought to you by yara-signator"
    tool               = "yara-signator v0.5.0"
    signator_config    = "callsandjumps;datarefs;binvalue"
    malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.leakthemall"
    malpedia_rule_date = "20201014"
    malpedia_hash      = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
    malpedia_version   = "20201014"
    malpedia_license   = "CC BY-SA 4.0"
    malpedia_sharing   = "TLP:WHITE"
  

  strings:
    $sequence_0 = { e9 ?? ?? ?? ?? 48 89 74 24 20 4c 89 44 24 10 0f 57 c0 0f 11 44 24 40 48 c7 44 24 50 00 00 00 00 48 8d 0d 74 a7 02 00 }
                                    $sequence_1 = { c3 c6 84 24 f0 00 00 00 00 48 8b ac 24 c8 00 00 00 48 81 c4 d0 00 00 00 c3 48 8b 44 24 50 48 8b 4c 24 70 }
                                    $sequence_2 = { 48 8b b4 24 88 00 00 00 48 89 74 24 40 e8 ?? ?? ?? ?? 48 8b 44 24 48 48 85 c0 74 74 48 8b 9c 24 90 00 00 00 }
                                    $sequence_3 = { c4 c1 49 6d f7 c4 41 09 6c fe c4 c1 41 6d ff c5 7a 7e 66 48 c5 7a 7e 6e 10 c5 7a 7e 36 c5 7a 7e 7e 20 }
                                    $sequence_4 = { f2 0f 5e c1 f2 0f 10 0d ?? ?? ?? ?? f2 0f 59 c8 f2 0f 10 54 24 50 66 0f 2e d1 0f 86 de 01 00 00 f2 0f 10 15 ?? ?? ?? ?? }
                                    $sequence_5 = { e9 ?? ?? ?? ?? 48 8b 4c 24 18 48 8d 79 30 e8 ?? ?? ?? ?? 48 8b 54 24 40 48 8d 7a 18 48 89 c8 }
                                    $sequence_6 = { e8 ?? ?? ?? ?? 0f b7 44 24 16 0f b7 c0 48 89 04 24 e8 ?? ?? ?? ?? 48 8d 05 0e f5 1d 00 48 89 04 24 }
                                    $sequence_7 = { e8 ?? ?? ?? ?? 48 8b 44 24 18 eb c7 48 c7 44 24 48 00 00 00 00 48 8b 6c 24 20 48 83 c4 28 c3 }
                                    $sequence_8 = { e9 ?? ?? ?? ?? 48 89 54 24 70 4c 89 44 24 68 48 8d 05 58 02 0f 00 48 89 04 24 48 89 5c 24 08 48 89 74 24 10 }
                                    $sequence_9 = { 48 8d 0d 65 dd 01 00 48 89 8c 24 80 00 00 00 48 89 84 24 88 00 00 00 48 8b 05 ?? ?? ?? ?? 48 89 04 24 48 8d 05 0a cd 05 00 48 89 44 24 08 }
                
  condition:
    7 of them and filesize < 10363904
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

89f7d714-2589-47ea-8adc-e00b6a97cda4

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion