SOSEMANUK_mul_ia__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule SOSEMANUK_mul_ia__32_big_1024_ (No description metadata provided).

rule SOSEMANUK_mul_ia__32_big_1024_ {
  strings:
    $a0 = { 00 00 00 00 18 0f 40 cd 30 1e 80 33 28 11 c0 fe 60 3c a9 66 78 33 e9 ab 50 22 29 55 48 2d 69 98 c0 78 fb cc d8 77 bb 01 f0 66 7b ff e8 69 3b 32 a0 44 52 aa b8 4b 12 67 90 5a d2 99 88 55 92 54 29 f0 5f 31 31 ff 1f fc 19 ee df 02 01 e1 9f cf 49 cc f6 57 51 c3 b6 9a 79 d2 76 64 61 dd 36 a9 e9 88 a4 fd f1 87 e4 30 d9 96 24 ce c1 99 64 03 89 b4 0d 9b 91 bb 4d 56 b9 aa 8d a8 a1 a5 cd 65 52 49 be 62 4a 46 fe af 62 57 3e 51 7a 58 7e 9c 32 75 17 04 2a 7a 57 c9 02 6b 97 37 1a 64 d7 fa 92 31 45 ae 8a 3e 05 63 a2 2f c5 9d ba 20 85 50 f2 0d ec c8 ea 02 ac 05 c2 13 6c fb da 1c 2c 36 7b b9 e1 53 63 b6 a1 9e 4b a7 61 60 53 a8 21 ad 1b 85 48 35 03 8a 08 f8 2b 9b c8 06 33 94 88 cb bb c1 1a 9f a3 ce 5a 52 8b df 9a ac 93 d0 da 61 db fd b3 f9 c3 f2 f3 34 eb e3 33 ca f3 ec 73 07 a4 92 d5 c4 bc 9d 95 09 94 8c 55 f7 8c 83 15 3a c4 ae 7c a2 dc a1 3c 6f f4 b0 fc 91 ec bf bc 5c 64 ea 2e 08 7c e5 6e c5 54 f4 ae 3b 4c fb ee f6 04 d6 87 6e 1c d9 c7 a3 34 c8 07 5d 2c c7 47 90 8d 62 8a f5 95 6d ca 38 bd 7c 0a c6 a5 73 4a 0b ed 5e 23 93 f5 51 63 5e dd 40 a3 a0 c5 4f e3 6d 4d 1a 71 39 55 15 31 f4 7d 04 f1 0a 65 0b b1 c7 2d 26 d8 5f 35 29 98 92 1d 38 58 6c 05 37 18 a1 f6 db 6b a6 ee d4 2b 6b c6 c5 eb 95 de ca ab 58 96 e7 c2 c0 8e e8 82 0d a6 f9 42 f3 be f6 02 3e 36 a3 90 6a 2e ac d0 a7 06 bd 10 59 1e b2 50 94 56 9f 39 0c 4e 90 79 c1 66 81 b9 3f 7e 8e f9 f2 df 2b 34 97 c7 24 74 5a ef 35 b4 a4 f7 3a f4 69 bf 17 9d f1 a7 18 dd 3c 8f 09 1d c2 97 06 5d 0f 1f 53 cf 5b 07 5c 8f 96 2f 4d 4f 68 37 42 0f a5 7f 6f 66 3d 67 60 26 f0 4f 71 e6 0e 57 7e a6 c3 e1 8d 03 21 f9 82 43 ec d1 93 83 12 c9 9c c3 df 81 b1 aa 47 99 be ea 8a b1 af 2a 74 a9 a0 6a b9 21 f5 f8 ed 39 fa b8 20 11 eb 78 de 09 e4 38 13 41 c9 51 8b 59 c6 11 46 71 d7 d1 b8 69 d8 91 75 c8 7d 5c 10 d0 72 1c dd f8 63 dc 23 e0 6c 9c ee a8 41 f5 76 b0 4e b5 bb 98 5f 75 45 80 50 35 88 08 05 a7 dc 10 0a e7 11 38 1b 27 ef 20 14 67 22 68 39 0e ba 70 36 4e 77 58 27 8e 89 40 28 ce 44 b3 c4 bd 43 ab cb fd 8e 83 da 3d 70 9b d5 7d bd d3 f8 14 25 cb f7 54 e8 e3 e6 94 16 fb e9 d4 db 73 bc 46 8f 6b b3 06 42 43 a2 c6 bc 5b ad 86 71 13 80 ef e9 0b 8f af 24 23 9e 6f da 3b 91 2f 17 9a 34 e2 72 82 3b a2 bf aa 2a 62 41 b2 25 22 8c fa 08 4b 14 e2 07 0b d9 ca 16 cb 27 d2 19 8b ea 5a 4c 19 be 42 43 59 73 6a 52 99 8d 72 5d d9 40 3a 70 b0 d8 22 7f f0 15 0a 6e 30 eb 12 61 70 26 45 1f d6 e5 5d 10 96 28 75 01 56 d6 6d 0e 16 1b 25 23 7f 83 3d 2c 3f 4e 15 3d ff b0 0d 32 bf 7d 85 67 2d 29 9d 68 6d e4 b5 79 ad 1a ad 76 ed d7 e5 5b 84 4f fd 54 c4 82 d5 45 04 7c cd 4a 44 b1 6c ef 89 d4 74 e0 c9 19 5c f1 09 e7 44 fe 49 2a 0c d3 20 b2 14 dc 60 7f 3c cd a0 81 24 c2 e0 4c ac 97 72 18 b4 98 32 d5 9c 89 f2 2b 84 86 b2 e6 cc ab db 7e d4 a4 9b b3 fc b5 5b 4d e4 ba 1b 80 17 56 68 87 0f 59 28 4a 27 48 e8 b4 3f 47 a8 79 77 6a c1 e1 6f 65 81 2c 47 74 41 d2 5f 7b 01 1f d7 2e 93 4b cf 21 d3 86 e7 30 13 78 ff 3f 53 b5 b7 12 3a 2d af 1d 7a e0 87 0c ba 1e 9f 03 fa d3 3e a6 37 b6 26 a9 77 7b 0e b8 b7 85 16 b7 f7 48 5e 9a 9e d0 46 95 de 1d 6e 84 1e e3 76 8b 5e 2e fe de cc 7a e6 d1 8c b7 ce c0 4c 49 d6 cf 0c 84 9e e2 65 1c 86 ed 25 d1 ae fc e5 2f b6 f3 a5 e2 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

a2a9617e-dc8f-49b8-8c7b-6fb4f4a715be

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion