CAST128___CAST256_sbox4__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CAST128___CAST256_sbox4__32_big_1024_ (No description metadata provided).

rule CAST128___CAST256_sbox4__32_big_1024_ {
  strings:
    $a0 = { 9d b3 04 20 1f b6 e9 de a7 be 7b ef d2 73 a2 98 4a 4f 7b db 64 ad 8c 57 85 51 04 43 fa 02 0e d1 7e 28 7a ff e6 0f b6 63 09 5f 35 a1 79 eb f1 20 fd 05 9d 43 64 97 b7 b1 f3 64 1f 63 24 1e 4a df 28 14 7f 5f 4f a2 b8 cd c9 43 00 40 0c c3 22 20 fd d3 0b 30 c0 a5 37 4f 1d 2d 00 d9 24 14 7b 15 ee 4d 11 1a 0f ca 51 67 71 ff 90 4c 2d 19 5f fe 1a 05 64 5f 0c 13 fe fe 08 1b 08 ca 05 17 01 21 80 53 01 00 e8 3e 5e fe ac 9a f4 f8 7f e7 27 01 d2 b8 ee 5f 06 df 42 61 bb 9e 9b 8a 72 93 ea 25 ce 84 ff df f5 71 88 01 3d d6 4b 04 a2 6f 26 3b 7e d4 84 00 54 7e eb e6 44 6d 4c a0 6c f3 d6 f5 26 49 ab df ae a0 c7 f5 36 33 8c c1 50 3f 7e 93 d3 77 20 61 11 b6 38 e1 72 50 0e 03 f8 0e b2 bb ab e0 50 2e ec 8d 77 de 57 97 1e 81 e1 4f 67 46 c9 33 54 00 69 20 31 8f 08 1d bb 99 ff c3 04 a5 4d 35 18 05 7f 3d 5c e3 a6 c8 66 c6 5d 5b cc a9 da ec 6f ea 9f 92 6f 91 9f 46 22 2f 39 91 46 7d a5 bf 6d 8e 11 43 c4 4f 43 95 83 02 d0 21 4e eb 02 20 83 b8 3f b6 18 0c 18 f8 93 1e 28 16 58 e6 26 48 6e 3e 8b d7 8a 70 74 77 e4 c1 b5 06 e0 7c f3 2d 0a 25 79 09 8b 02 e4 ea bb 81 28 12 3b 23 69 de ad 38 15 74 ca 16 df 87 1b 62 21 1c 40 b7 a5 1a 9e f9 00 14 37 7b 04 1e 8a c8 09 11 40 03 bd 59 e4 d2 e3 d1 56 d5 4f e8 76 d5 2f 91 a3 40 55 7b e8 de 00 ea e4 a7 0c e5 c2 ec 4d b4 bb a6 e7 56 bd ff dd 33 69 ac ec 17 b0 35 06 57 23 27 99 af c8 b0 56 c8 c3 91 6b 65 81 1c 5e 14 61 19 6e 85 cb 75 be 07 c0 02 c2 32 55 77 89 3f f4 ec 5b bf c9 2d d0 ec 3b 25 b7 80 1a b7 8d 6d 3b 24 20 c7 63 ef c3 66 a5 fc 9c 38 28 80 0a ce 32 05 aa c9 54 8a ec a1 d7 c7 04 1a fa 32 1d 16 62 5a 67 01 90 2c 9b 75 7a 54 31 d4 77 f7 91 26 b0 31 36 cc 6f db c7 0b 8b 46 d9 e6 6a 48 56 e5 5a 79 02 6a 4c eb 52 43 7e ff 2f 8f 76 b4 0d f9 80 a5 86 74 cd e3 ed da 04 eb 17 a9 be 04 2c 18 f4 df b7 74 7f 9d ab 2a f7 b4 ef c3 4d 20 2e 09 6b 7c 17 41 a2 54 e5 b6 a0 35 21 3d 42 f6 2c 1c 7c 26 61 c2 f5 0f 65 52 da f9 d2 c2 31 f8 25 13 0f 69 d8 16 7f a2 04 18 f2 c8 00 1a 96 a6 0d 15 26 ab 63 31 5c 21 5e 0a 72 ec 49 ba fe fd 18 79 08 d9 8d 0d bd 86 31 11 70 a7 3e 9b 64 0c cc 3e 10 d7 d5 ca d3 b6 0c ae c3 88 f7 30 01 e1 6c 72 8a ff 71 ea e2 a1 1f 9a f3 6e cf cb d1 2f c1 de 84 17 ac 07 be 6b cb 44 a1 d8 8b 9b 0f 56 01 39 88 c3 b1 c5 2f ca b4 be 31 cd d8 78 28 06 12 a3 a4 e2 6f 7d e5 32 58 fd 7e b6 d0 1e e9 00 24 ad ff c2 f4 99 0f c5 97 11 aa c5 00 1d 7b 95 82 e5 e7 d2 10 98 73 f6 00 61 30 96 c3 2d 95 21 ad a1 21 ff 29 90 84 15 7f bb 97 7f af 9e b3 db 29 c9 ed 2a 5c e2 a4 65 a7 30 f3 2c d0 aa 3f e8 8a 5c c0 91 d4 9e 2c e7 0c e4 54 a9 d6 0a cd 86 01 5f 19 19 77 07 91 03 de a0 3a f6 78 a8 56 5e de e3 56 df 21 f0 5c be 8b 75 e3 87 b3 c5 06 51 b8 a5 c3 ef d8 ee b6 d2 e5 23 be 77 c2 15 45 29 2f 69 ef df af e6 7a fb f4 70 c4 b2 f3 e0 eb 5b d6 cc 98 76 39 e4 46 0c 1f da 85 38 19 87 83 2f ca 00 73 67 a9 91 44 f8 29 6b 29 9e 49 2f c2 95 92 66 be ab b5 67 6e 69 9b d3 dd da df 7e 05 2f db 25 70 1c 1b 5e 51 ee f6 53 24 e6 6a fc e3 6c 03 16 cc 04 86 44 21 3e b7 dc 59 d0 79 65 29 1f cc d6 fd 43 41 82 39 79 93 2b cd f6 b6 57 c3 4d 4e df d2 82 7a e5 29 0c 3c b9 53 6b 85 1e 20 fe 98 33 55 7e 13 ec f0 b0 d3 ff b3 72 3f 85 c5 c1 0a ef 7e d2 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

753e6839-ec96-4272-bc9f-5f127c20988f

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion