Anubis_T5__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule Anubis_T5__32_big_1024_ (No description metadata provided).

rule Anubis_T5__32_big_1024_ {
  strings:
    $a0 = { 00 00 00 00 01 02 06 08 02 04 0c 10 03 06 0a 18 04 08 18 20 05 0a 1e 28 06 0c 14 30 07 0e 12 38 08 10 30 40 09 12 36 48 0a 14 3c 50 0b 16 3a 58 0c 18 28 60 0d 1a 2e 68 0e 1c 24 70 0f 1e 22 78 10 20 60 80 11 22 66 88 12 24 6c 90 13 26 6a 98 14 28 78 a0 15 2a 7e a8 16 2c 74 b0 17 2e 72 b8 18 30 50 c0 19 32 56 c8 1a 34 5c d0 1b 36 5a d8 1c 38 48 e0 1d 3a 4e e8 1e 3c 44 f0 1f 3e 42 f8 20 40 c0 1d 21 42 c6 15 22 44 cc 0d 23 46 ca 05 24 48 d8 3d 25 4a de 35 26 4c d4 2d 27 4e d2 25 28 50 f0 5d 29 52 f6 55 2a 54 fc 4d 2b 56 fa 45 2c 58 e8 7d 2d 5a ee 75 2e 5c e4 6d 2f 5e e2 65 30 60 a0 9d 31 62 a6 95 32 64 ac 8d 33 66 aa 85 34 68 b8 bd 35 6a be b5 36 6c b4 ad 37 6e b2 a5 38 70 90 dd 39 72 96 d5 3a 74 9c cd 3b 76 9a c5 3c 78 88 fd 3d 7a 8e f5 3e 7c 84 ed 3f 7e 82 e5 40 80 9d 3a 41 82 9b 32 42 84 91 2a 43 86 97 22 44 88 85 1a 45 8a 83 12 46 8c 89 0a 47 8e 8f 02 48 90 ad 7a 49 92 ab 72 4a 94 a1 6a 4b 96 a7 62 4c 98 b5 5a 4d 9a b3 52 4e 9c b9 4a 4f 9e bf 42 50 a0 fd ba 51 a2 fb b2 52 a4 f1 aa 53 a6 f7 a2 54 a8 e5 9a 55 aa e3 92 56 ac e9 8a 57 ae ef 82 58 b0 cd fa 59 b2 cb f2 5a b4 c1 ea 5b b6 c7 e2 5c b8 d5 da 5d ba d3 d2 5e bc d9 ca 5f be df c2 60 c0 5d 27 61 c2 5b 2f 62 c4 51 37 63 c6 57 3f 64 c8 45 07 65 ca 43 0f 66 cc 49 17 67 ce 4f 1f 68 d0 6d 67 69 d2 6b 6f 6a d4 61 77 6b d6 67 7f 6c d8 75 47 6d da 73 4f 6e dc 79 57 6f de 7f 5f 70 e0 3d a7 71 e2 3b af 72 e4 31 b7 73 e6 37 bf 74 e8 25 87 75 ea 23 8f 76 ec 29 97 77 ee 2f 9f 78 f0 0d e7 79 f2 0b ef 7a f4 01 f7 7b f6 07 ff 7c f8 15 c7 7d fa 13 cf 7e fc 19 d7 7f fe 1f df 80 1d 27 74 81 1f 21 7c 82 19 2b 64 83 1b 2d 6c 84 15 3f 54 85 17 39 5c 86 11 33 44 87 13 35 4c 88 0d 17 34 89 0f 11 3c 8a 09 1b 24 8b 0b 1d 2c 8c 05 0f 14 8d 07 09 1c 8e 01 03 04 8f 03 05 0c 90 3d 47 f4 91 3f 41 fc 92 39 4b e4 93 3b 4d ec 94 35 5f d4 95 37 59 dc 96 31 53 c4 97 33 55 cc 98 2d 77 b4 99 2f 71 bc 9a 29 7b a4 9b 2b 7d ac 9c 25 6f 94 9d 27 69 9c 9e 21 63 84 9f 23 65 8c a0 5d e7 69 a1 5f e1 61 a2 59 eb 79 a3 5b ed 71 a4 55 ff 49 a5 57 f9 41 a6 51 f3 59 a7 53 f5 51 a8 4d d7 29 a9 4f d1 21 aa 49 db 39 ab 4b dd 31 ac 45 cf 09 ad 47 c9 01 ae 41 c3 19 af 43 c5 11 b0 7d 87 e9 b1 7f 81 e1 b2 79 8b f9 b3 7b 8d f1 b4 75 9f c9 b5 77 99 c1 b6 71 93 d9 b7 73 95 d1 b8 6d b7 a9 b9 6f b1 a1 ba 69 bb b9 bb 6b bd b1 bc 65 af 89 bd 67 a9 81 be 61 a3 99 bf 63 a5 91 c0 9d ba 4e c1 9f bc 46 c2 99 b6 5e c3 9b b0 56 c4 95 a2 6e c5 97 a4 66 c6 91 ae 7e c7 93 a8 76 c8 8d 8a 0e c9 8f 8c 06 ca 89 86 1e cb 8b 80 16 cc 85 92 2e cd 87 94 26 ce 81 9e 3e cf 83 98 36 d0 bd da ce d1 bf dc c6 d2 b9 d6 de d3 bb d0 d6 d4 b5 c2 ee d5 b7 c4 e6 d6 b1 ce fe d7 b3 c8 f6 d8 ad ea 8e d9 af ec 86 da a9 e6 9e db ab e0 96 dc a5 f2 ae dd a7 f4 a6 de a1 fe be df a3 f8 b6 e0 dd 7a 53 e1 df 7c 5b e2 d9 76 43 e3 db 70 4b e4 d5 62 73 e5 d7 64 7b e6 d1 6e 63 e7 d3 68 6b e8 cd 4a 13 e9 cf 4c 1b ea c9 46 03 eb cb 40 0b ec c5 52 33 ed c7 54 3b ee c1 5e 23 ef c3 58 2b f0 fd 1a d3 f1 ff 1c db f2 f9 16 c3 f3 fb 10 cb f4 f5 02 f3 f5 f7 04 fb f6 f1 0e e3 f7 f3 08 eb f8 ed 2a 93 f9 ef 2c 9b fa e9 26 83 fb eb 20 8b fc e5 32 b3 fd e7 34 bb fe e1 3e a3 ff e3 38 ab }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

749a126c-3d86-4d14-bf14-3a559705edfa

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion