seed_SS3__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule seed_SS3__32_big_1024_ (No description metadata provided).

rule seed_SS3__32_big_1024_ {
  strings:
    $a0 = { 08 30 38 38 c8 e0 e8 28 0d 21 2c 2d 86 a2 a4 26 cf c3 cc 0f ce d2 dc 1e 83 b3 b0 33 88 b0 b8 38 8f a3 ac 2f 40 60 60 20 45 51 54 15 c7 c3 c4 07 44 40 44 04 4f 63 6c 2f 4b 63 68 2b 4b 53 58 1b c3 c3 c0 03 42 62 60 22 03 33 30 33 85 b1 b4 35 09 21 28 29 80 a0 a0 20 c2 e2 e0 22 87 a3 a4 27 c3 d3 d0 13 81 91 90 11 01 11 10 11 06 02 04 06 0c 10 1c 1c 8c b0 bc 3c 06 32 34 36 4b 43 48 0b cf e3 ec 2f 88 80 88 08 4c 60 6c 2c 88 a0 a8 28 07 13 14 17 c4 c0 c4 04 06 12 14 16 c4 f0 f4 34 c2 c2 c0 02 45 41 44 05 c1 e1 e0 21 c6 d2 d4 16 0f 33 3c 3f 0d 31 3c 3d 8e 82 8c 0e 88 90 98 18 08 20 28 28 4e 42 4c 0e c6 f2 f4 36 0e 32 3c 3e 85 a1 a4 25 c9 f1 f8 39 0d 01 0c 0d cf d3 dc 1f c8 d0 d8 18 0b 23 28 2b 46 62 64 26 4a 72 78 3a 07 23 24 27 0f 23 2c 2f c1 f1 f0 31 42 72 70 32 42 42 40 02 c4 d0 d4 14 41 41 40 01 c0 c0 c0 00 43 73 70 33 47 63 64 27 8c a0 ac 2c 8b 83 88 0b c7 f3 f4 37 8d a1 ac 2d 80 80 80 00 0f 13 1c 1f ca c2 c8 0a 0c 20 2c 2c 8a a2 a8 2a 04 30 34 34 c2 d2 d0 12 0b 03 08 0b ce e2 ec 2e c9 e1 e8 29 4d 51 5c 1d 84 90 94 14 08 10 18 18 c8 f0 f8 38 47 53 54 17 8e a2 ac 2e 08 00 08 08 c5 c1 c4 05 03 13 10 13 cd c1 cc 0d 86 82 84 06 89 b1 b8 39 cf f3 fc 3f 4d 71 7c 3d c1 c1 c0 01 01 31 30 31 c5 f1 f4 35 8a 82 88 0a 4a 62 68 2a 81 b1 b0 31 c1 d1 d0 11 00 20 20 20 c7 d3 d4 17 02 02 00 02 02 22 20 22 04 00 04 04 48 60 68 28 41 71 70 31 07 03 04 07 cb d3 d8 1b 8d 91 9c 1d 89 91 98 19 41 61 60 21 8e b2 bc 3e c6 e2 e4 26 49 51 58 19 cd d1 dc 1d 41 51 50 11 80 90 90 10 cc d0 dc 1c 8a 92 98 1a 83 a3 a0 23 8b a3 a8 2b c0 d0 d0 10 81 81 80 01 0f 03 0c 0f 47 43 44 07 0a 12 18 1a c3 e3 e0 23 cc e0 ec 2c 8d 81 8c 0d 8f b3 bc 3f 86 92 94 16 4b 73 78 3b 4c 50 5c 1c 82 a2 a0 22 81 a1 a0 21 43 63 60 23 03 23 20 23 4d 41 4c 0d c8 c0 c8 08 8e 92 9c 1e 8c 90 9c 1c 0a 32 38 3a 0c 00 0c 0c 0e 22 2c 2e 8a b2 b8 3a 4e 62 6c 2e 8f 93 9c 1f 4a 52 58 1a c2 f2 f0 32 82 92 90 12 c3 f3 f0 33 49 41 48 09 48 70 78 38 cc c0 cc 0c 05 11 14 15 cb f3 f8 3b 40 70 70 30 45 71 74 35 4f 73 7c 3f 05 31 34 35 00 10 10 10 03 03 00 03 44 60 64 24 4d 61 6c 2d c6 c2 c4 06 44 70 74 34 c5 d1 d4 15 84 b0 b4 34 ca e2 e8 2a 09 01 08 09 46 72 74 36 09 11 18 19 ce f2 fc 3e 40 40 40 00 02 12 10 12 c0 e0 e0 20 8d b1 bc 3d 05 01 04 05 ca f2 f8 3a 01 01 00 01 c0 f0 f0 30 0a 22 28 2a 4e 52 5c 1e 89 a1 a8 29 46 52 54 16 43 43 40 03 85 81 84 05 04 10 14 14 89 81 88 09 8b 93 98 1b 80 b0 b0 30 c5 e1 e4 25 48 40 48 08 49 71 78 39 87 93 94 17 cc f0 fc 3c 0e 12 1c 1e 82 82 80 02 01 21 20 21 8c 80 8c 0c 0b 13 18 1b 4f 53 5c 1f 47 73 74 37 44 50 54 14 82 b2 b0 32 0d 11 1c 1d 05 21 24 25 4f 43 4c 0f 00 00 00 00 46 42 44 06 cd e1 ec 2d 48 50 58 18 42 52 50 12 cb e3 e8 2b 4e 72 7c 3e ca d2 d8 1a c9 c1 c8 09 cd f1 fc 3d 00 30 30 30 85 91 94 15 45 61 64 25 0c 30 3c 3c 86 b2 b4 36 c4 e0 e4 24 8b b3 b8 3b 4c 70 7c 3c 0e 02 0c 0e 40 50 50 10 09 31 38 39 06 22 24 26 02 32 30 32 84 80 84 04 49 61 68 29 83 93 90 13 07 33 34 37 c7 e3 e4 27 04 20 24 24 84 a0 a4 24 cb c3 c8 0b 43 53 50 13 0a 02 08 0a 87 83 84 07 c9 d1 d8 19 4c 40 4c 0c 83 83 80 03 8f 83 8c 0f ce c2 cc 0e 0b 33 38 3b 4a 42 48 0a 87 b3 b4 37 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e30f608b-57f0-4a56-81d1-60258d18dbdd

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion