AcidBox_SSP_DLL_Loader_Unique_Return_Codes_A

YARA detection rule by BitsOfBinary · GPL-2.0

Detects AcidBox SSP DLL loaders, based on unique return codes seen in functions

rule AcidBox_SSP_DLL_Loader_Unique_Return_Codes_A {
  meta:
    description = "Detects AcidBox SSP DLL loaders, based on unique return codes seen in functions"
    author      = "BitsOfBinary"
    reference   = "https://unit42.paloaltonetworks.com/acidbox-rare-malware/"
    reference   = "https://bitsofbinary.github.io/yara/2023/04/01/100daysofyara-day-91.html"
    hash        = "003669761229d3e1db0f5a5b333ef62b3dffcc8e27c821ce9018362e0a2df7e9"
    version     = "1.0"
    date        = "2023-04-01"
    DaysofYARA  = "91/100"

  strings:
    $ = { 06 04 00 a0 }
    $ = { 01 04 00 a0 }
    $ = { 02 04 00 a0 }
    $ = { 0c 0c 00 a0 }
    $ = { 02 0c 00 a0 }
    $ = { 01 07 00 a0 }
    $ = { 07 08 00 a0 }
    $ = { 02 07 00 a0 }
    $ = { 04 06 00 a0 }
    $ = { 08 06 00 a0 }
    $ = { 02 06 00 a0 }
    $ = { 0c 08 00 a0 }
    $ = { 06 08 00 a0 }
    $ = { 04 08 00 a0 }
    $ = { 07 10 03 a0 }
    $ = { 09 10 03 a0 }
    $ = { 11 10 03 a0 }
    $ = { 02 10 03 a0 }
    $ = { 04 04 08 a0 }
    $ = { 07 04 08 a0 }
    $ = { 02 03 00 a0 }
    $ = { 02 04 08 a0 }
    $ = { 04 01 08 a0 }
    $ = { 06 01 08 a0 }
    $ = { 0e 01 08 a0 }
    $ = { 01 02 08 a0 }
    $ = { 02 02 08 a0 }
    $ = { 04 02 08 a0 }
    $ = { 06 02 08 a0 }
    $ = { 01 00 00 c0 }
    $ = { 02 0a 08 a0 }
    $ = { 02 06 03 a0 }
    $ = { 04 06 03 a0 }
    $ = { 10 06 03 a0 }
    $ = { 0e 06 03 a0 }
    $ = { 02 08 02 80 }
    $ = { 06 08 02 80 }
    $ = { 01 08 02 80 }
    $ = { 04 08 02 80 }
    $ = { 07 08 02 80 }
    $ = { 71 80 07 80 }
    $ = { 06 01 03 80 }
    $ = { 02 01 03 80 }
    $ = { 02 06 03 80 }
    $ = { 01 06 03 80 }
    $ = { 02 07 03 80 }
    $ = { 06 07 03 80 }
    $ = { 07 06 04 80 }
    $ = { 04 06 04 80 }
    $ = { 05 06 04 80 }
    $ = { 02 06 04 80 }
    $ = { 07 16 04 80 }
    $ = { 04 16 04 80 }
    $ = { 06 16 04 80 }
    $ = { 02 16 04 80 }
    $ = { 02 28 04 80 }
    $ = { 07 28 04 80 }
    $ = { 06 0b 04 80 }
    $ = { 02 0b 04 80 }
    $ = { 02 0c 04 80 }
    $ = { 02 0d 04 80 }
    $ = { 06 0d 04 80 }
    $ = { 02 1c 04 80 }
    $ = { 04 1c 04 80 }
    $ = { 07 1c 04 80 }
    $ = { 06 1c 04 80 }
    $ = { 0c 1c 04 80 }
    $ = { 06 1d 04 80 }
    $ = { 09 22 04 80 }
    $ = { 09 08 04 80 }
    $ = { 09 09 04 80 }
    $ = { 09 07 04 80 }
    $ = { 02 22 04 80 }
    $ = { 0c 01 04 80 }
    $ = { 02 01 04 80 }
    $ = { 02 10 04 80 }
    $ = { 02 11 04 80 }
    $ = { 07 11 04 80 }
    $ = { 0a 11 04 80 }
    $ = { 02 12 04 80 }
    $ = { 0a 12 04 80 }
    $ = { 07 12 04 80 }
    $ = { 01 0f 04 80 }
    $ = { 07 0f 04 80 }
    $ = { 02 0f 04 80 }
    $ = { 0a 0f 04 80 }
    $ = { 0b 0f 04 80 }
    $ = { 02 02 04 80 }
    $ = { 07 04 04 80 }
    $ = { 0c 04 04 80 }
    $ = { 02 04 04 80 }
    $ = { 02 14 04 80 }
    $ = { 02 15 04 80 }
    $ = { 0a 14 04 80 }
    $ = { 07 15 04 80 }
    $ = { 0c 15 04 80 }
    $ = { 09 25 04 80 }
    $ = { 02 25 04 80 }
    $ = { 02 26 04 80 }
    $ = { 06 27 04 80 }
    $ = { 07 27 04 80 }
    $ = { 09 27 04 80 }
    $ = { 0c 27 04 80 }
    $ = { 0a 27 04 80 }
    $ = { 04 27 04 80 }
    $ = { 02 27 04 80 }
    $ = { 04 13 04 80 }
    $ = { 0c 13 04 80 }
    $ = { 06 13 04 80 }
    $ = { 01 13 04 80 }
    $ = { 02 13 04 80 }
    $ = { 0c 21 04 80 }
    $ = { 06 21 04 80 }
    $ = { 05 21 04 80 }
    $ = { 02 21 04 80 }
    $ = { 06 17 04 80 }
    $ = { 0c 17 04 80 }
    $ = { 02 17 04 80 }
    $ = { 02 05 05 80 }
    $ = { 06 05 05 80 }
    $ = { 06 07 05 80 }
    $ = { 04 07 05 80 }
    $ = { 02 07 05 80 }
    $ = { 02 09 05 80 }
    $ = { 06 09 05 80 }
    $ = { 01 0b 07 80 }
    $ = { 06 0b 07 80 }
    $ = { 02 0b 07 80 }
    $ = { 06 0c 07 80 }
    $ = { 02 0c 07 80 }
    $ = { 05 03 01 80 }
    $ = { 02 03 01 80 }

  condition:
    uint16(0) == 0x5A4D and filesize < 500KB and 80 of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

d9961645-5464-4c69-857e-f79fd1e33034

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion