CAST128___CAST256_sbox3__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CAST128___CAST256_sbox3__32_big_1024_ (No description metadata provided).

rule CAST128___CAST256_sbox3__32_big_1024_ {
  strings:
    $a0 = { 8d ef c2 40 25 fa 5d 9f eb 90 3d bf e8 10 c9 07 47 60 7f ff 36 9f e4 4b 8c 1f c6 44 ae ce ca 90 be b1 f9 bf ee fb ca ea e8 cf 19 50 51 df 07 ae 92 0e 88 06 f0 ad 05 48 e1 3c 8d 83 92 70 10 d5 11 10 7d 9f 07 64 7d b9 b2 e3 e4 d4 3d 4f 28 5e b9 af a8 20 fa de 82 e0 a0 67 26 8b 82 72 79 2e 55 3f b2 c0 48 9a e2 2b d4 ef 97 94 12 5e 3f bc 21 ff fc ee 82 5b 1b fd 92 55 c5 ed 12 57 a2 40 4e 1a 83 02 ba e0 7f ff 52 82 46 e7 8e 57 14 0e 33 73 f7 bf 8c 9f 81 88 a6 fc 4e e8 c9 82 b5 a5 a8 c0 1d b7 57 9f c2 64 67 09 4f 31 f2 bd 3f 5f 40 ff f7 c1 1f b7 8d fc 8e 6b d2 c1 43 7b e5 9b 99 b0 3d bf b5 db c6 4b 63 8d c0 e6 55 81 9d 99 a1 97 c8 1c 4a 01 2d 6e c5 88 4a 28 cc c3 6f 71 b8 43 c2 13 6c 07 43 f1 83 09 89 3c 0f ed dd 5f 2f 7f e8 50 d7 c0 7f 7e 02 50 7f bf 5a fb 9a 04 a7 47 d2 d0 16 51 19 2e af 70 bf 3e 58 c3 13 80 5f 98 30 2e 72 7c c3 c4 0a 0f b4 02 0f 7f ef 82 8c 96 fd ad 5d 2c 2a ae 8e e9 9a 49 50 da 88 b8 84 27 f4 a0 1e ac 57 90 79 6f b4 49 82 52 dc 15 ef bd 7d 9b a6 72 59 7d ad a8 40 d8 45 f5 45 04 fa 5d 74 03 e8 3e c3 05 4f 91 75 1a 92 56 69 c2 23 ef e9 41 a9 03 f1 2e 60 27 0d f2 02 76 e4 b6 94 fd 65 74 92 79 85 b2 82 76 db cb 02 77 81 76 f8 af 91 8d 4e 48 f7 9e 8f 61 6d df e2 9d 84 0e 84 2f 7d 83 34 0c e5 c8 96 bb b6 82 93 b4 b1 48 ef 30 3c ab 98 4f af 28 77 9f af 9b 92 dc 56 0d 22 4d 1e 20 84 37 aa 88 7d 29 dc 96 27 56 d3 dc 8b 90 7c ee b5 1f d2 40 e7 c0 7c e3 e5 66 b4 a1 c3 e9 61 5e 3c f8 20 9d 60 94 d1 e3 cd 9c a3 41 5c 76 46 0e 00 ea 98 3b d4 d6 78 81 fd 47 57 2c f7 6c ed d9 bd a8 22 9c 12 7d ad aa 43 8a 07 4e 1f 97 c0 90 08 1b db 8a 93 a0 7e be b9 38 ca 15 97 b0 3c ff 3d c2 c0 f8 8d 1a b2 ec 64 38 0e 51 68 cc 7b fb d9 0f 27 88 12 49 01 81 5d e5 ff d4 dd 7e f8 6a 76 a2 e2 14 b9 a4 03 68 92 5d 95 8f 4b 39 ff fa ba 39 ae e9 a4 ff d3 0b fa f7 93 3b 6d 49 86 23 19 3c bc fa 27 62 75 45 82 5c f4 7a 61 bd 8b a0 d1 1e 42 d1 ce ad 04 f4 12 7e a3 92 10 42 8d b7 82 72 a9 72 92 70 c4 a8 12 7d e5 0b 28 5b a1 c8 3c 62 f4 4f 35 c0 ea a5 e8 05 d2 31 42 89 29 fb b4 fc df 82 4f b6 6a 53 0e 7d c1 5b 1f 08 1f ab 10 86 18 ae fc fd 08 6d f9 ff 28 89 69 4b cc 11 23 6a 5c ae 12 de ca 4d 2c 3f 8c c5 d2 d0 2d fe f8 ef 58 96 e4 cf 52 da 95 15 5b 67 49 4a 48 8c b9 b6 a8 0c 5c 8f 82 bc 89 d3 6b 45 3a 60 94 37 ec 00 c9 a9 44 71 52 53 0a 87 4b 49 d7 73 bc 40 7c 34 67 1c 02 71 7e f6 4f eb 55 36 a2 d0 2f ff d2 bf 60 c4 d4 3f 03 c0 50 b4 ef 6d 07 47 8c d1 00 6e 18 88 a2 e5 3f 55 b9 e6 d4 bc a2 04 80 16 97 57 38 33 d7 20 7d 67 de 0f 8f 3d 72 f8 7b 33 ab cc 4f 33 76 88 c5 5d 7b 00 a6 b0 94 7b 00 01 57 00 75 d2 f9 bb 88 f8 89 42 01 9e 42 64 a5 ff 85 63 02 e0 72 db d9 2b ee 97 1b 69 6e a2 2f de 5f 08 ae 2b af 7a 61 6d e5 c9 87 67 cf 1f eb d2 61 ef c8 c2 f1 ac 25 71 cc 82 39 c2 67 21 4c b8 b1 e5 83 d1 b7 dc 3e 62 7f 10 bd ce f9 0a 5c 38 0f f0 44 3d 60 6e 6d c6 60 54 3a 49 57 27 c1 48 2b e9 8a 1d 8a b4 17 38 20 e1 be 24 af 96 da 0f 68 45 84 25 99 83 3b e5 60 0d 45 7d 28 2f 93 50 83 34 b3 62 d9 1d 11 20 2b 6d 8d a0 64 2b 1e 31 9c 30 5a 00 52 bc e6 88 1b 03 58 8a f7 ba ef d5 41 42 ed 9c a4 31 5c 11 83 32 3e c5 df ef 46 36 a1 33 c5 01 e9 d3 53 1c ee 35 37 83 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

590b2aae-967b-43ce-98f1-7941740e9d9f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion