CAST_256_t_m__32_lil_768_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CAST_256_t_m__32_lil_768_ (No description metadata provided).

rule CAST_256_t_m__32_lil_768_ {
  strings:
    $a0 = { 99 79 82 5a a1 d6 51 d1 a9 33 21 48 b1 90 f0 be b9 ed bf 35 c1 4a 8f ac c9 a7 5e 23 d1 04 2e 9a d9 61 fd 10 e1 be cc 87 e9 1b 9c fe f1 78 6b 75 f9 d5 3a ec 01 33 0a 63 09 90 d9 d9 11 ed a8 50 19 4a 78 c7 21 a7 47 3e 29 04 17 b5 31 61 e6 2b 39 be b5 a2 41 1b 85 19 49 78 54 90 51 d5 23 07 3a 65 5c c9 42 c2 2b 40 4a 1f fb b6 52 7c ca 2d 5a d9 99 a4 62 36 69 1b 6a 93 38 92 72 f0 07 09 7a 4d d7 7f 82 aa a6 f6 8a 07 76 6d 92 64 45 e4 9a c1 14 5b a2 1e e4 d1 aa 7b b3 48 b2 d8 82 bf ba 35 52 36 c2 92 21 ad ca ef f0 23 d2 4c c0 9a da a9 8f 11 e2 06 5f 88 ea 63 2e ff f2 c0 fd 75 db 50 36 38 e3 ad 05 af eb 0a d5 25 f3 67 a4 9c fb c4 73 13 03 22 43 8a 0b 7f 12 01 13 dc e1 77 1b 39 b1 ee 23 96 80 65 2b f3 4f dc 33 50 1f 53 3b ad ee c9 43 0a be 40 4b 67 8d b7 53 c4 5c 2e 5b 21 2c a5 63 7e fb 1b 6b db ca 92 73 38 9a 09 7b 95 69 80 83 f2 38 f7 8b 4f 08 6e 93 ac d7 e4 7c 3c 10 a7 84 99 df 1d 8c f6 ae 94 94 53 7e 0b 9c b0 4d 82 a4 0d 1d f9 ac 6a ec 6f b4 c7 bb e6 bc 24 8b 5d c4 81 5a d4 cc de 29 4b d4 3b f9 c1 dc 98 c8 38 e4 f5 97 af ec 52 67 26 f4 af 36 9d fc 0c 06 14 04 6a d5 8a 0c c7 a4 01 14 24 74 78 1c 81 43 ef 24 de 12 66 2c 3b e2 dc 34 98 b1 53 1d 28 ea 15 25 85 b9 8c 2d e2 88 03 35 3f 58 7a 3d 9c 27 f1 45 f9 f6 67 4d 56 c6 de 55 b3 95 55 5d 10 65 cc 65 6d 34 43 6d ca 03 ba 75 27 d3 30 7d 84 a2 a7 85 e1 71 1e 8d 3e 41 95 95 9b 10 0c 9d f8 df 82 a5 55 af f9 ad b2 7e 70 b5 0f 4e e7 bd 6c 1d 5e c5 c9 ec d4 cd 26 bc 4b d5 83 8b c2 be 13 c4 84 c6 70 93 fb ce cd 62 72 d6 2a 32 e9 de 87 01 60 e6 e4 d0 d6 ee 41 a0 4d f6 9e 6f c4 fe fb 3e 3b 06 59 0e b2 0e b6 dd 28 16 13 ad 9f 1e 70 7c 16 26 cd 4b 8d 2e 2a 1b 04 36 87 ea 7a 3e e4 b9 f1 46 41 89 68 4e 9e 58 df 56 fb 27 56 5e 58 f7 cc 66 b5 c6 43 6e 12 96 ba 76 6f 65 31 5f ff 9d f3 67 5c 6d 6a 6f b9 3c e1 77 16 0c 58 7f 73 db ce 87 d0 aa 45 8f 2d 7a bc 97 8a 49 33 9f e7 18 aa a7 44 e8 20 af a1 b7 97 b7 fe 86 0e bf 5b 56 85 c7 b8 25 fc cf 15 f5 72 d7 72 c4 e9 df cf 93 60 e7 2c 63 d7 ef 89 32 4e f7 e6 01 c5 ff 43 d1 3b 07 a1 a0 b2 0f fe 6f 29 17 5b 3f a0 00 eb 77 62 08 48 47 d9 10 a5 16 50 18 02 e6 c6 20 5f b5 3d 28 bc 84 b4 30 19 54 2b 38 76 23 a2 40 d3 f2 18 48 30 c2 8f 50 8d 91 06 58 ea 60 7d 60 47 30 f4 68 a4 ff 6a 70 01 cf e1 78 5e 9e 58 80 bb 6d cf 88 18 3d 46 90 75 0c bd 98 d2 db 33 a0 2f ab aa a8 8c 7a 21 b0 e9 49 98 b8 46 19 0f }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b1f037a6-ff47-4afd-9b76-5058b20decee

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion