MALPEDIA_Win_Purplefox_Auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com · GPL-2.0

autogenerated rule brought to you by yara-signator

rule MALPEDIA_Win_Purplefox_Auto: FILE {
  meta:
    description        = "autogenerated rule brought to you by yara-signator"
    author             = "Felix Bilstein - yara-signator at cocacoding dot com"
    id                 = "864146ba-a135-5d92-a900-c7434a0b6e81"
    date               = "2023-12-06"
    modified           = "2023-12-08"
    reference          = "https://malpedia.caad.fkie.fraunhofer.de/details/win.purplefox"
    source_url         = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.purplefox_auto.yar#L1-L376"
    license_url        = "N/A"
    logic_hash         = "2241b5e41c5930d16a914d761ccbb07709436fc80bf5297a0da02f1f8d89a59e"
    score              = 75
    quality            = 73
    tags               = "FILE"
    version            = "1"
    tool               = "yara-signator v0.6.0"
    signator_config    = "callsandjumps;datarefs;binvalue"
    malpedia_rule_date = "20231130"
    malpedia_hash      = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
    malpedia_version   = "20230808"
    malpedia_license   = "CC BY-SA 4.0"
    malpedia_sharing   = "TLP:WHITE"

  strings:
    $sequence_0  = { 89 45 ec 8d 45 f0 50 8d 4d d8 8d 55 f8 51 }
    $sequence_1  = { d2 de fe ca 28 c3 80 d2 62 9c }
    $sequence_2  = { 66 f7 d9 c1 e8 10 52 66 c1 d9 08 0f 9f c5 }
    $sequence_3  = { 89 18 e8 ?? ?? ?? ?? 4c 8d 15 a7 c7 00 00 48 85 c0 74 04 4c 8d 50 10 8b cb }
    $sequence_4  = { 8d 45 f8 50 6a 00 6a 00 c7 45 f8 00 00 00 00 }
    $sequence_5  = { 48 8b 8d 08 04 00 00 48 8d 44 24 70 4d 8b 00 45 33 c9 ba 00 00 01 00 48 89 74 24 28 48 89 9c 24 f0 04 00 00 }
    $sequence_6  = { ff 15 ?? ?? ?? ?? 48 8b c8 ff 15 ?? ?? ?? ?? 48 8d 15 28 46 00 00 48 8b ce }
    $sequence_7  = { 8b 04 c5 2c bb 40 00 5d c3 8b ff 55 8b ec }
    $sequence_8  = { ff d6 83 c4 10 8d 54 24 24 52 8d 44 24 10 e8 ?? ?? ?? ?? }
    $sequence_9  = { 0f 10 05 ?? ?? ?? ?? f2 0f 10 0d ?? ?? ?? ?? 48 89 bc 24 c8 00 00 00 33 ff }
    $sequence_10 = { 51 0f 9d c3 8b 74 24 04 68 5a f8 5b ca 8b 7c 24 0c }
    $sequence_11 = { 56 57 68 ?? ?? ?? ?? e8 ?? ?? ?? ?? 83 c4 04 6a 00 6a 00 }
    $sequence_12 = { cf b9 45 23 34 0a e8 ?? ?? ?? ?? 06 }
    $sequence_13 = { b6 14 dc 1a 70 38 1f a5 }
    $sequence_14 = { 41 5d 41 5c 5f c3 48 89 74 24 78 48 8b b4 24 90 00 00 00 }
    $sequence_15 = { 8d 4d f4 51 52 56 6a 00 50 }
    $sequence_16 = { 48 8b 42 38 48 89 41 08 48 8b 4a 50 48 85 c9 }
    $sequence_17 = { e8 ?? ?? ?? ?? 8d bd dc fd ff ff e8 ?? ?? ?? ?? 8d bd dc fd ff ff c7 45 fc ff ff ff ff }
    $sequence_18 = { 66 85 c9 75 f1 8d 85 f8 fd ff ff 56 33 f6 8d 50 02 }
    $sequence_19 = { 89 44 24 1c 52 8d 44 24 1c 50 }
    $sequence_20 = { 48 03 d8 41 b8 00 04 00 00 48 89 9d 00 04 00 00 e8 ?? ?? ?? ?? e9 ?? ?? ?? ?? 48 8b 4c 24 70 ff 15 ?? ?? ?? ?? }
    $sequence_21 = { 44 8b cf 48 89 44 24 20 e8 ?? ?? ?? ?? 8b c7 48 8d 4d d0 33 d2 }
    $sequence_22 = { 8b 70 3c 66 f7 da 0f ba e6 03 0f ca 20 c6 01 c6 42 }
    $sequence_23 = { 48 83 c3 08 48 3b df 72 ed 48 83 3d ?? ?? ?? ?? 00 74 1f 48 8d 0d 36 c6 00 00 e8 ?? ?? ?? ?? }
    $sequence_24 = { 57 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? bf 00 50 00 00 ff 15 ?? ?? ?? ?? 50 ff 15 ?? ?? ?? ?? }
    $sequence_25 = { ff 15 ?? ?? ?? ?? 48 8d 54 24 50 48 8d 0d 96 b1 00 00 e8 ?? ?? ?? ?? }
    $sequence_26 = { 3b f3 7d 1e 8b 4d e8 ff 15 ?? ?? ?? ?? 8b 4d f8 51 }
    $sequence_27 = { 52 ff d3 85 c0 75 07 b8 02 00 00 00 eb 1a }
    $sequence_28 = { 9c 36 88 10 c6 04 24 13 60 }
    $sequence_29 = { 66 8b 46 0c 8b 55 08 6a 01 66 89 45 e4 }
    $sequence_30 = { 45 33 c0 33 d2 44 89 b4 24 a0 00 00 00 48 89 44 24 20 }
    $sequence_31 = { a1 ?? ?? ?? ?? a3 ?? ?? ?? ?? a1 ?? ?? ?? ?? c7 05 ?? ?? ?? ?? bb 45 40 00 89 35 ?? ?? ?? ?? }
    $sequence_32 = { e8 ?? ?? ?? ?? 83 c4 08 33 ff eb 23 68 ?? ?? ?? ?? }
    $sequence_33 = { 48 85 c0 74 3f 48 8b 0d ?? ?? ?? ?? 48 8d 15 51 97 00 00 }
    $sequence_34 = { 8b 1d ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ff d3 85 c0 75 0c 8b 4f 08 }
    $sequence_35 = { c7 44 24 68 00 01 00 00 48 8b f9 48 89 74 24 60 89 74 24 58 89 74 24 50 48 89 74 24 48 }
    $sequence_36 = { 48 8d 0d e4 d2 00 00 48 3b d9 72 3e 48 8d 05 68 d6 00 00 48 3b d8 77 32 48 8b d3 }
    $sequence_37 = { 48 ff ce 75 a3 8b 45 04 03 c5 8b e8 83 38 00 }
    $sequence_38 = { 89 7c 24 04 e8 ?? ?? ?? ?? e8 ?? ?? ?? ?? 8d 64 24 2c 0f 85 0a 00 00 00 66 0f b6 d8 }
    $sequence_39 = { 56 57 48 83 ec 50 8b c9 48 8d 94 24 80 00 00 00 ff 15 ?? ?? ?? ?? }

  condition:
    7 of them and filesize < 1983488
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

04d4847d-2297-4520-8aa5-ecde785708dd

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion