seed_SS1__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule seed_SS1__32_big_1024_ (No description metadata provided).

rule seed_SS1__32_big_1024_ {
  strings:
    $a0 = { 38 38 08 30 e8 28 c8 e0 2c 2d 0d 21 a4 26 86 a2 cc 0f cf c3 dc 1e ce d2 b0 33 83 b3 b8 38 88 b0 ac 2f 8f a3 60 20 40 60 54 15 45 51 c4 07 c7 c3 44 04 44 40 6c 2f 4f 63 68 2b 4b 63 58 1b 4b 53 c0 03 c3 c3 60 22 42 62 30 33 03 33 b4 35 85 b1 28 29 09 21 a0 20 80 a0 e0 22 c2 e2 a4 27 87 a3 d0 13 c3 d3 90 11 81 91 10 11 01 11 04 06 06 02 1c 1c 0c 10 bc 3c 8c b0 34 36 06 32 48 0b 4b 43 ec 2f cf e3 88 08 88 80 6c 2c 4c 60 a8 28 88 a0 14 17 07 13 c4 04 c4 c0 14 16 06 12 f4 34 c4 f0 c0 02 c2 c2 44 05 45 41 e0 21 c1 e1 d4 16 c6 d2 3c 3f 0f 33 3c 3d 0d 31 8c 0e 8e 82 98 18 88 90 28 28 08 20 4c 0e 4e 42 f4 36 c6 f2 3c 3e 0e 32 a4 25 85 a1 f8 39 c9 f1 0c 0d 0d 01 dc 1f cf d3 d8 18 c8 d0 28 2b 0b 23 64 26 46 62 78 3a 4a 72 24 27 07 23 2c 2f 0f 23 f0 31 c1 f1 70 32 42 72 40 02 42 42 d4 14 c4 d0 40 01 41 41 c0 00 c0 c0 70 33 43 73 64 27 47 63 ac 2c 8c a0 88 0b 8b 83 f4 37 c7 f3 ac 2d 8d a1 80 00 80 80 1c 1f 0f 13 c8 0a ca c2 2c 2c 0c 20 a8 2a 8a a2 34 34 04 30 d0 12 c2 d2 08 0b 0b 03 ec 2e ce e2 e8 29 c9 e1 5c 1d 4d 51 94 14 84 90 18 18 08 10 f8 38 c8 f0 54 17 47 53 ac 2e 8e a2 08 08 08 00 c4 05 c5 c1 10 13 03 13 cc 0d cd c1 84 06 86 82 b8 39 89 b1 fc 3f cf f3 7c 3d 4d 71 c0 01 c1 c1 30 31 01 31 f4 35 c5 f1 88 0a 8a 82 68 2a 4a 62 b0 31 81 b1 d0 11 c1 d1 20 20 00 20 d4 17 c7 d3 00 02 02 02 20 22 02 22 04 04 04 00 68 28 48 60 70 31 41 71 04 07 07 03 d8 1b cb d3 9c 1d 8d 91 98 19 89 91 60 21 41 61 bc 3e 8e b2 e4 26 c6 e2 58 19 49 51 dc 1d cd d1 50 11 41 51 90 10 80 90 dc 1c cc d0 98 1a 8a 92 a0 23 83 a3 a8 2b 8b a3 d0 10 c0 d0 80 01 81 81 0c 0f 0f 03 44 07 47 43 18 1a 0a 12 e0 23 c3 e3 ec 2c cc e0 8c 0d 8d 81 bc 3f 8f b3 94 16 86 92 78 3b 4b 73 5c 1c 4c 50 a0 22 82 a2 a0 21 81 a1 60 23 43 63 20 23 03 23 4c 0d 4d 41 c8 08 c8 c0 9c 1e 8e 92 9c 1c 8c 90 38 3a 0a 32 0c 0c 0c 00 2c 2e 0e 22 b8 3a 8a b2 6c 2e 4e 62 9c 1f 8f 93 58 1a 4a 52 f0 32 c2 f2 90 12 82 92 f0 33 c3 f3 48 09 49 41 78 38 48 70 cc 0c cc c0 14 15 05 11 f8 3b cb f3 70 30 40 70 74 35 45 71 7c 3f 4f 73 34 35 05 31 10 10 00 10 00 03 03 03 64 24 44 60 6c 2d 4d 61 c4 06 c6 c2 74 34 44 70 d4 15 c5 d1 b4 34 84 b0 e8 2a ca e2 08 09 09 01 74 36 46 72 18 19 09 11 fc 3e ce f2 40 00 40 40 10 12 02 12 e0 20 c0 e0 bc 3d 8d b1 04 05 05 01 f8 3a ca f2 00 01 01 01 f0 30 c0 f0 28 2a 0a 22 5c 1e 4e 52 a8 29 89 a1 54 16 46 52 40 03 43 43 84 05 85 81 14 14 04 10 88 09 89 81 98 1b 8b 93 b0 30 80 b0 e4 25 c5 e1 48 08 48 40 78 39 49 71 94 17 87 93 fc 3c cc f0 1c 1e 0e 12 80 02 82 82 20 21 01 21 8c 0c 8c 80 18 1b 0b 13 5c 1f 4f 53 74 37 47 73 54 14 44 50 b0 32 82 b2 1c 1d 0d 11 24 25 05 21 4c 0f 4f 43 00 00 00 00 44 06 46 42 ec 2d cd e1 58 18 48 50 50 12 42 52 e8 2b cb e3 7c 3e 4e 72 d8 1a ca d2 c8 09 c9 c1 fc 3d cd f1 30 30 00 30 94 15 85 91 64 25 45 61 3c 3c 0c 30 b4 36 86 b2 e4 24 c4 e0 b8 3b 8b b3 7c 3c 4c 70 0c 0e 0e 02 50 10 40 50 38 39 09 31 24 26 06 22 30 32 02 32 84 04 84 80 68 29 49 61 90 13 83 93 34 37 07 33 e4 27 c7 e3 24 24 04 20 a4 24 84 a0 c8 0b cb c3 50 13 43 53 08 0a 0a 02 84 07 87 83 d8 19 c9 d1 4c 0c 4c 40 80 03 83 83 8c 0f 8f 83 cc 0e ce c2 38 3b 0b 33 48 0a 4a 42 b4 37 87 b3 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

b9ee5e3b-a397-4c71-af6d-cc86e8a39ae8

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion