Ponmocup_ren

YARA detection rule by Danny Heppener, Fox-IT · GPL-2.0

Ponmocup plugin detection (memory)

rule Ponmocup_ren: plugins {
  meta:
    description = "Ponmocup plugin detection (memory)"
    author      = "Danny Heppener, Fox-IT"

  strings:
    $1100 = { 4D 5A 90 [29] 4C 04 }
    $1201 = { 4D 5A 90 [29] B1 04 }
    $1300 = { 4D 5A 90 [29] 14 05 }
    $1350 = { 4D 5A 90 [29] 46 05 }
    $1400 = { 4D 5A 90 [29] 78 05 }
    $1402 = { 4D 5A 90 [29] 7A 05 }
    $1403 = { 4D 5A 90 [29] 7B 05 }
    $1404 = { 4D 5A 90 [29] 7C 05 }
    $1405 = { 4D 5A 90 [29] 7D 05 }
    $1406 = { 4D 5A 90 [29] 7E 05 }
    $1500 = { 4D 5A 90 [29] DC 05 }
    $1501 = { 4D 5A 90 [29] DD 05 }
    $1502 = { 4D 5A 90 [29] DE 05 }
    $1505 = { 4D 5A 90 [29] E1 05 }
    $1506 = { 4D 5A 90 [29] E2 05 }
    $1507 = { 4D 5A 90 [29] E3 05 }
    $1508 = { 4D 5A 90 [29] E4 05 }
    $1509 = { 4D 5A 90 [29] E5 05 }
    $1510 = { 4D 5A 90 [29] E6 05 }
    $1511 = { 4D 5A 90 [29] E7 05 }
    $1512 = { 4D 5A 90 [29] E8 05 }
    $1600 = { 4D 5A 90 [29] 40 06 }
    $1601 = { 4D 5A 90 [29] 41 06 }
    $1700 = { 4D 5A 90 [29] A4 06 }
    $1800 = { 4D 5A 90 [29] 08 07 }
    $1801 = { 4D 5A 90 [29] 09 07 }
    $1802 = { 4D 5A 90 [29] 0A 07 }
    $1803 = { 4D 5A 90 [29] 0B 07 }
    $2001 = { 4D 5A 90 [29] D1 07 }
    $2002 = { 4D 5A 90 [29] D2 07 }
    $2003 = { 4D 5A 90 [29] D3 07 }
    $2004 = { 4D 5A 90 [29] D4 07 }
    $2500 = { 4D 5A 90 [29] C4 09 }
    $2501 = { 4D 5A 90 [29] C5 09 }
    $2550 = { 4D 5A 90 [29] F6 09 }
    $2600 = { 4D 5A 90 [29] 28 0A }
    $2610 = { 4D 5A 90 [29] 32 0A }
    $2700 = { 4D 5A 90 [29] 8C 0A }
    $2701 = { 4D 5A 90 [29] 8D 0A }
    $2750 = { 4D 5A 90 [29] BE 0A }
    $2760 = { 4D 5A 90 [29] C8 0A }
    $2810 = { 4D 5A 90 [29] FA 0A }

  condition:
    any of them
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

599a232b-df34-4325-8436-c28400c839e1

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion