MAL_ADVOBFUSCATOR_STRINGS_1

YARA detection rule by @qutluch@infosec.exchange · BSD-2-Clause

Rule detecting ADVObfuscator strings.

rule MAL_ADVOBFUSCATOR_STRINGS_1 {
  meta:
    author      = "@qutluch@infosec.exchange"
    description = "Rule detecting ADVObfuscator strings."
    disclaimer  = "THIS RULE IS EXTREMELY NOISY AND UNREFINED. IT WORKS IN THE MOST GENERAL SENSE AND REQUIRES TUNING."
    reference   = "https://github.com/andrivet/ADVobfuscator"
    research    = "https://research.openanalysis.net/advobfuscator/python/obfuscation/strings/tooling/2023/10/08/advobfuscator.html"
    research    = "https://malware.news/t/lets-learn-dissecting-lazarus-windows-x86-loader-involved-in-crypto-trading-app-distribution-snowman-advobfuscator/33904"
    DaysofYARA  = "7/100"
    license     = "BSD-2-Clause"
    date        = "2024-01-07"
    version     = "1.0"

  strings:
        $sub1 = { 2c ?? 88 [5-9] 40 83 F? ?? 72 ?? }
    $sub2 = { 2c ?? 88 [5-9] 41 83 F? ?? 72 ?? }
    $sub3 = { 2c ?? 88 [5-9] 42 83 F? ?? 72 ?? }
    $sub4 = { 2c ?? 88 [5-9] 43 83 F? ?? 72 ?? }
    $sub5 = { 2c ?? 88 [5-9] 44 83 F? ?? 72 ?? }
    $sub6 = { 2c ?? 88 [5-9] 45 83 F? ?? 72 ?? }
    $sub7 = { 2c ?? 88 [5-9] 46 83 F? ?? 72 ?? }
    $sub8 = { 2c ?? 88 [5-9] 47 83 F? ?? 72 ?? }
        $xor1 = { (30 | 32) [5-9] 40 83 F? ?? 72 ?? }
    $xor2 = { (30 | 32) [5-9] 41 83 F? ?? 72 ?? }
    $xor3 = { (30 | 32) [5-9] 42 83 F? ?? 72 ?? }
    $xor4 = { (30 | 32) [5-9] 43 83 F? ?? 72 ?? }
    $xor5 = { (30 | 32) [5-9] 44 83 F? ?? 72 ?? }
    $xor6 = { (30 | 32) [5-9] 45 83 F? ?? 72 ?? }
    $xor7 = { (30 | 32) [5-9] 46 83 F? ?? 72 ?? }
    $xor8 = { (30 | 32) [5-9] 47 83 F? ?? 72 ?? }
  

  condition:
    uint16(0) == 0x5A4D
    and (uint32(uint32(0x3C)) == 0x00004550)
    and uint16(uint32(0x3C) + 0x18) == 0x10b      and for any of them: (# > 10)
    and filesize < 5MB
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

08e88dad-ecb2-4d2e-a05e-cc050045d056

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion