CAST128_sbox8__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CAST128_sbox8__32_big_1024_ (No description metadata provided).

rule CAST128_sbox8__32_big_1024_ {
  strings:
    $a0 = { e2 16 30 0d bb dd ff fc a7 eb da bd 35 64 80 95 77 89 f8 b7 e6 c1 12 1b 0e 24 16 00 05 2c e8 b5 11 a9 cf b0 e5 95 2f 11 ec e7 99 0a 93 86 d1 74 2a 42 93 1c 76 e3 81 11 b1 2d ef 3a 37 dd dd fc de 9a de b1 0a 0c c3 2c be 19 70 29 84 a0 09 40 bb 24 3a 0f b4 d1 37 cf b4 4e 79 f0 04 9e ed fd 0b 15 a1 5d 48 0d 31 68 8b bb de 5a 66 9d ed 42 c7 ec e8 31 3f 8f 95 e7 72 df 19 1b 75 80 33 0d 94 07 42 51 5c 7d cd fa ab be 6d 63 aa 40 21 64 b3 01 d4 0a 02 e7 d1 ca 53 57 1d ae 7a 31 82 a2 12 a8 dd ec fd aa 33 5d 17 6f 43 e8 71 fb 46 d4 38 12 90 22 ce 94 9a d4 b8 47 69 ad 96 5b d8 62 82 f3 d0 55 66 fb 97 67 15 b8 0b 4e 1d 5b 47 a0 4c fd e0 6f c2 8e c4 b8 57 e8 72 6e 64 7a 78 fc 99 86 5d 44 60 8b d5 93 6c 20 0e 03 39 dc 5f f6 5d 0b 00 a3 ae 63 af f2 7e 8b d6 32 70 10 8c 0c bb d3 50 49 29 98 df 04 98 0c f4 2a 9b 6d f4 91 9e 7e dd 53 06 91 85 48 58 cb 7e 07 3b 74 ef 2e 52 2f ff b1 d2 47 08 cc 1c 7e 27 cd a4 eb 21 5b 3c f1 d2 e2 19 b4 7a 38 42 4f 76 18 35 85 60 39 9d 17 de e7 27 eb 35 e6 c9 af f6 7b 36 ba f5 b8 09 c4 67 cd c1 89 10 b1 e1 1d bf 7b 06 cd 1a f8 71 70 c6 08 2d 5e 33 54 d4 de 49 5a 64 c6 d0 06 bc c0 c6 2c 3d d0 0d b3 70 8f 8f 34 77 d5 1b 42 26 4f 62 0f 24 b8 d2 bf 15 c1 b7 9e 46 a5 25 64 f8 d7 e5 4e 3e 37 81 60 78 95 cd a5 85 9c 15 a5 e6 45 97 88 c3 7b c7 5f db 07 ba 0c 06 76 a3 ab 7f 22 9b 1e 31 84 2e 7b 24 25 9f d7 f8 be f4 72 83 5f fc b8 6d f4 c1 f2 96 f5 b1 95 fd 0a f0 fc b0 fe 13 4c e2 50 6d 3d 4f 9b 12 ea f2 15 f2 25 a2 23 73 6f 9f b4 c4 28 25 d0 49 79 34 c7 13 f8 c4 61 81 87 ea 7a 6e 98 7c d1 6e fc 14 36 87 6c f1 54 41 07 be de ee 14 56 e9 af 27 a0 4a a4 41 3c f7 c8 99 92 ec ba e6 dd 67 01 6d 15 16 82 eb a8 42 ee df fd ba 60 b4 f1 90 7b 75 20 e3 03 0f 24 d8 c2 9e e1 39 67 3b ef a6 3f b8 71 87 30 54 b6 f2 cf 3b 9f 32 64 42 cb 15 a4 cc b0 1a 45 04 f1 e4 7d 8d 84 4a 1b e5 ba e7 df dc 42 cb da 70 cd 7d ae 0a 57 e8 5b 7a d5 3f 5a f6 20 cf 4d 8c ce a4 d4 28 79 d1 30 a4 34 86 eb fb 33 d3 cd dc 77 85 3b 53 37 ef fc b5 c5 06 87 78 e5 80 b3 e6 4e 68 b8 f4 c5 c8 b3 7e 0d 80 9e a2 39 8f eb 7c 13 2a 4f 94 43 b7 95 0e 2f ee 7d 1c 22 36 13 bd dd 06 ca a2 37 df 93 2b c4 24 82 89 ac f3 eb c3 57 15 f6 b7 ef 34 78 dd f2 67 61 6f c1 48 cb e4 90 52 81 5e 5e 41 0f ab b4 8a 24 65 2e da 7f a4 e8 7b 40 e4 e9 8e a0 84 58 89 e9 e1 ef d3 90 fc dd 07 d3 5b db 48 56 94 38 d7 e5 b2 57 72 01 01 73 0e de bc 5b 64 31 13 94 91 7e 4f 50 3c 2f ba 64 6f 12 82 75 23 d2 4a e0 77 96 95 f9 c1 7a 8f 7a 5b 21 21 d1 87 b8 96 29 26 3a 4d ba 51 0c df 81 f4 7c 9f ad 11 63 ed ea 7b 59 65 1a 00 72 6e 11 40 30 92 00 da 6d 77 4a 0c dd 61 ad 1f 46 03 60 5b df b0 9e ed c3 64 22 eb e6 a8 ce e7 d2 8a a0 e7 36 a0 55 64 a6 b9 10 85 32 09 c7 eb 8f 37 2d e7 05 ca 89 51 57 0f df 09 82 2b bd 69 1a 6c aa 12 e4 f2 87 45 1c 0f e0 f6 a2 7a 3a da 48 19 4c f1 76 4f 0d 77 1c 2b 67 cd b1 56 35 0d 83 84 59 38 fa 0f 42 39 9e f3 36 99 7b 07 0e 84 09 3d 4a a9 3e 61 83 60 d8 7b 1f a9 8b 0c 11 49 38 2c e9 76 25 a5 06 14 d1 b7 0e 25 24 4b 0c 76 83 47 58 9e 8d 82 0d 20 59 d1 a4 66 bb 1e f8 da 0a 82 04 f1 91 30 ba 6e 4e c0 99 26 51 64 1e e7 23 0d 50 b2 ad 80 ea ee 68 01 8d b2 a2 83 ea 8b f5 9e }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

862d4d95-0928-4c26-9cb3-7e2b2880f555

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion