MALPEDIA_Win_Babar_Auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com · GPL-2.0

autogenerated rule brought to you by yara-signator

rule MALPEDIA_Win_Babar_Auto: FILE {
  meta:
    description        = "autogenerated rule brought to you by yara-signator"
    author             = "Felix Bilstein - yara-signator at cocacoding dot com"
    id                 = "907c27e3-2fb8-508f-9c67-d8826ced6045"
    date               = "2023-12-06"
    modified           = "2023-12-08"
    reference          = "https://malpedia.caad.fkie.fraunhofer.de/details/win.babar"
    source_url         = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.babar_auto.yar#L1-L166"
    license_url        = "N/A"
    logic_hash         = "8e0331df8b3130917de8e5e3d5d2fa36fbe1f95285a5ec05160d56f936d6e114"
    score              = 75
    quality            = 75
    tags               = "FILE"
    version            = "1"
    tool               = "yara-signator v0.6.0"
    signator_config    = "callsandjumps;datarefs;binvalue"
    malpedia_rule_date = "20231130"
    malpedia_hash      = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
    malpedia_version   = "20230808"
    malpedia_license   = "CC BY-SA 4.0"
    malpedia_sharing   = "TLP:WHITE"

  strings:
    $sequence_0  = { 3b d6 0f 86 f9 fe ff ff 8b 54 24 3c 8b 44 24 38 }
    $sequence_1  = { 3b d6 0f 8c 7a ff ff ff 8b bc 24 d0 00 00 00 dd d9 }
    $sequence_2  = { 3b d5 7e 47 8d 0c 95 00 00 00 00 2b d9 }
    $sequence_3  = { 3b d5 0f 86 71 ff ff ff 81 44 24 18 90 02 00 00 dd d8 81 6c 24 28 80 02 00 00 83 c7 10 81 c6 80 02 00 00 }
    $sequence_4  = { 46 8d 44 af 08 8d 57 08 8d 4c b5 00 d9 42 f8 }
    $sequence_5  = { 3b d6 0f 82 ee fe ff ff 8b 74 24 58 03 f5 }
    $sequence_6  = { 3b d6 72 1b 57 8b cb }
    $sequence_7  = { 3b d6 72 d9 33 f6 eb 08 }
    $sequence_8  = { 89 06 0f 84 96 00 00 00 50 ff d7 89 46 04 8b 0d ?? ?? ?? ?? 89 4e 08 }
    $sequence_9  = { 8d 84 07 d8 98 80 69 c1 c0 07 8b fa 03 c6 33 fe }
    $sequence_10 = { 80 38 00 8b 0d ?? ?? ?? ?? 74 1d 80 39 00 75 06 8b 0d ?? ?? ?? ?? 8a 11 }
    $sequence_11 = { 23 d1 33 d0 03 54 24 4c 8d 94 32 21 08 b4 49 c1 ca 0a 03 d1 8b f1 }
    $sequence_12 = { 57 8d 3c 85 a0 9e 01 10 8b 07 03 c3 8a 48 24 }
    $sequence_13 = { e8 ?? ?? ?? ?? 57 e8 ?? ?? ?? ?? 83 c4 10 8d 84 24 80 00 00 00 50 ff d5 }
    $sequence_14 = { 0f b6 4e 04 88 48 04 8b 56 04 c1 ea 08 88 50 05 0f b6 4e 06 }
    $sequence_15 = { 8b 4b 04 55 8b 2d ?? ?? ?? ?? 68 ?? ?? ?? ?? }

  condition:
    7 of them and filesize < 1294336
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

902ce505-6768-4867-b726-78fffd8f2c8d

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion