t_class_32_sbox__32_lil_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule t_class_32_sbox__32_lil_1024_ (No description metadata provided).

rule t_class_32_sbox__32_lil_1024_ {
  strings:
    $a0 = { 87 18 aa a3 5c 43 5e d7 42 c0 65 09 f4 6e 0e 83 20 ee 57 f8 d3 fe 84 48 02 c5 66 f6 ae e8 54 f4 d9 e9 2e b3 d4 38 1f 21 5d 9b 82 15 3c df 5c 78 49 42 86 99 63 39 2e b1 9f 42 f4 af 35 2c 43 f9 25 03 f4 e7 70 dd c0 2d ed 3d 97 4d 5e dc 02 8a 42 5b 17 ce bf 12 00 4c 8c d7 94 ca 6b b2 aa 2e 9a 1b c1 52 46 81 16 95 c5 8e ea d9 8f c2 8a 1e 0f 5c ed 4e 1c 10 b4 38 82 b0 2d 44 e1 29 09 28 de 43 18 0a fc 99 82 df 4b bc 2f 02 dd 15 39 a0 fa 03 a8 17 de b2 46 f1 42 33 23 60 c3 e7 ce 68 ef 07 d6 12 ab eb 97 b7 9b 85 7f 7a 2f 2e 1f c3 da 71 5b e9 9a 26 e2 fa d1 c3 39 3d 36 6b a5 53 f2 de c9 96 5f fc c9 84 a3 b3 27 6b df 6d a5 ba 10 b5 25 f2 a7 85 0f 63 71 2e e8 9a 16 88 cb 19 2a 1e 95 7c af f6 f5 ae b3 c2 cb e5 5d f5 4f f5 14 62 6b f7 e3 83 0b 16 f5 a6 9e 6a af 41 e0 a2 17 1f 2f 39 ee 99 3b b6 c0 5e a6 7b c6 16 70 0f a4 09 77 c1 01 6e 32 93 d9 80 b2 81 18 14 fb 1b 27 f2 af ee 03 82 54 b4 96 9d 6b 1a c0 a8 17 ea 6e bf d5 d0 88 78 ee 91 64 fe fc 2f cd 93 a1 b8 84 01 0d 55 30 49 ae b9 36 4f 01 da 88 70 a8 85 2a 6c ad 3f 78 c6 22 41 e7 4d 20 bf 59 e7 c2 e0 8e 24 00 5a 6b 44 3b 58 c2 9f 0d 80 95 a8 14 5f a1 c3 6c 66 70 f1 fe 0b 55 91 c1 d8 66 8a 7b 90 69 5e 1b 35 3e 62 a8 d5 35 fa bd c0 cc 68 f0 a7 cd 6a 3a 33 36 e9 55 06 b9 2d 60 65 c1 13 df 69 6d b1 0b 45 3c b8 80 00 63 37 b2 94 11 a9 d8 56 13 bc b6 6d d7 79 55 98 a8 2f 5c 9b 6e 19 f4 76 76 54 db 97 66 a8 64 fc ad 16 6e b2 15 c5 7f c2 3c eb 6f b0 06 a3 c8 fe d9 99 67 db 33 91 1a 20 dd 66 24 e1 cd 5d eb eb 50 8f 11 d6 26 b2 af e4 f3 ce b9 dd 89 61 b3 47 b1 19 7a 4a 84 30 c7 1d 5c ed 7d 42 8f c5 8b ed 21 e4 dd 9e fb 47 1e 6e 5e 71 cc 49 99 ff c0 3c 0f 2f 12 cd 84 51 d2 43 6c 5e 7a 27 bc 18 bf d2 e0 c6 d7 07 20 e4 b7 d4 3f 52 1f de a2 b8 d9 c7 6b 1a da 67 02 8c 88 18 54 e3 d1 89 79 7d ba cb 53 77 cc 30 55 96 2d 1f a1 9d 82 8d a7 90 15 c6 49 c1 c1 8f 1c 7f 53 aa 69 9b 77 c8 b7 f2 71 74 fa 58 3c dc 18 44 dc c9 76 8c 8c 5d f0 d9 20 5c 4d 0d a8 31 73 c4 74 a4 e9 10 94 70 11 42 0e 88 2b 08 c8 61 4a 33 6b 2c d2 8e f6 9f 1b cc 43 0d f3 0f 3c 2b a0 64 e5 87 4f 5a f5 50 e7 f8 40 82 5f f1 a7 54 21 fe 00 64 d6 37 6d 26 f1 06 d5 7d 73 09 e0 03 36 de bb 40 a8 0f 67 34 9e ab 31 4b 18 b6 da 1c f5 52 1f 73 4f eb 58 d1 43 e3 b9 c4 dd 77 8d fd a6 3d b9 3b 2d d5 0f cc f8 12 54 fb 60 33 a6 7f d0 3a e5 ab 1c 0f 70 e6 0b ed 24 3e ec c1 3d 5b 95 67 36 a5 15 9d 54 ad d7 46 ce 04 76 be 7a 23 a0 e0 48 9c 02 7c f0 14 b7 49 12 51 ba d6 9e 22 78 7f a4 f0 bd ff cf 29 84 ca 07 79 da f4 65 71 da 35 9f 7e 44 aa d2 ff ac 52 74 8c a7 74 d6 0e 6a a4 61 e2 2a 15 63 0c aa b7 12 ef 27 59 61 bc 18 b1 4f 72 8d 75 51 75 7b 68 81 6f b3 f0 52 37 ed 54 42 a1 71 72 c7 ec ab ac 31 d3 ec 4a f9 8e cd 94 e9 62 81 9e 4d 8b 30 37 62 86 e8 21 8a 10 0b 7f 91 e8 d6 b5 a9 08 f8 ad 97 77 31 04 d3 11 21 c9 ca be 46 5d b3 92 36 0a 43 4f 22 40 19 24 5e a6 bc c5 ba 70 ec 32 cc a8 ae 36 8b ae 7b 9d d5 24 29 cf 5a 8a 09 f3 81 6b 39 a6 22 25 de bb b8 1c 5c ac 1d fe b8 5e 97 c6 b3 6c 83 4f 16 a9 76 63 c1 13 4c 22 19 57 35 3b 20 25 fe c0 3a b5 9a a1 66 e3 4f b2 f0 bd 98 a9 fd a8 71 2d d5 3a a8 96 08 01 3f 05 e6 05 00 d3 b0 59 cc cb 99 2a 40 3d 5e 46 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

e2dc2277-4c1a-4146-af8a-2c605618e9dc

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion