CAST128_sbox6__32_big_1024_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule CAST128_sbox6__32_big_1024_ (No description metadata provided).

rule CAST128_sbox6__32_big_1024_ {
  strings:
    $a0 = { f6 fa 8f 9d 2c ac 6c e1 4c a3 48 67 e2 33 7f 7c 95 db 08 e7 01 68 43 b4 ec ed 5c bc 32 55 53 ac bf 9f 09 60 df a1 e2 ed 83 f0 57 9d 63 ed 86 b9 1a b6 a6 b8 de 5e be 39 f3 8f f7 32 89 89 b1 38 33 f1 49 61 c0 19 37 bd f5 06 c6 da e4 62 5e 7e a3 08 ea 99 4e 23 e3 3c 79 cb d7 cc 48 a1 43 67 a3 14 96 19 fe c9 4b d5 a1 14 17 4a ea a0 18 66 a0 84 db 2d 09 a8 48 6f a8 88 61 4a 29 00 af 98 01 66 59 91 e1 99 28 63 c8 f3 0c 60 2e 78 ef 3c d0 d5 19 32 cf 0f ec 14 f7 ca 07 d2 d0 a8 20 72 fd 41 19 7e 93 05 a6 b0 e8 6b e3 da 74 be d3 cd 37 2d a5 3c 4c 7f 44 48 da b5 d4 40 6d ba 0e c3 08 39 19 a7 9f ba ee d9 49 db cf b0 4e 67 0c 53 5c 3d 9c 01 64 bd b9 41 2c 0e 63 6a ba 7d d9 cd ea 6f 73 88 e7 0b c7 62 35 f2 9a db 5c 4c dd 8d f0 d4 8d 8c b8 81 53 e2 08 a1 98 66 1a e2 ea c8 28 4c af 89 aa 92 82 23 93 34 be 53 3b 3a 21 bf 16 43 4b e3 9a ea 39 06 ef e8 c3 6e f8 90 cd d9 80 22 6d ae c3 40 a4 a3 df 7e 9c 09 a6 94 a8 07 5b 7c 5e cc 22 1d b3 a6 9a 69 a0 2f 68 81 8a 54 ce b2 29 6f 53 c0 84 3a fe 89 36 55 25 bf e6 8a b4 62 8a bc cf 22 2e bf 25 ac 6f 48 a9 a9 93 87 53 bd db 65 e7 6f fb e7 e9 67 fd 78 0b a9 35 63 8e 34 2b c1 e8 a1 1b e9 49 80 74 0d c8 08 7d fc 8d e4 bf 99 a1 11 01 a0 7f d3 79 75 da 5a 26 c0 e8 1f 99 4f 95 28 cd 89 fd 33 9f ed b8 78 34 bf 5f 04 45 6d 22 25 86 98 c9 c4 c8 3b 2d c1 56 be 4f 62 8d aa 57 f5 5e c5 e2 22 0a be d2 91 6e bf 4e c7 5b 95 24 f2 c3 c0 42 d1 5d 99 cd 0d 7f a0 7b 6e 27 ff a8 dc 8a f0 73 45 c1 06 f4 1e 23 2f 35 16 23 86 e6 ea 89 26 33 33 b0 94 15 7e c6 f2 37 2b 74 af 69 25 73 e4 e9 a9 d8 48 f3 16 02 89 3a 62 ef 1d a7 87 e2 38 f3 a5 f6 76 74 36 48 53 20 95 10 63 45 76 69 8d b6 fa d4 07 59 2a f9 50 36 f7 35 23 4c fb 6e 87 7d a4 ce c0 6c 15 2d aa cb 03 96 a8 c5 0d fe 5d fc d7 07 ab 09 21 c4 2f 89 df f0 bb 5f e2 be 78 44 8f 4f 33 75 46 13 c9 2b 05 d0 8d 48 b9 d5 85 dc 04 94 41 c8 09 8f 9b 7d ed e7 86 c3 9a 33 73 42 41 00 05 6a 09 17 51 0e f3 c8 a6 89 00 72 d6 28 20 76 82 a9 a9 f7 be bf 32 67 9d d4 5b 5b 75 b3 53 fd 00 cb b0 e3 58 83 0f 22 0a 1f 8f b2 14 d3 72 cf 08 cc 3c 4a 13 8c f6 31 66 06 1c 87 be 88 c9 8f 88 60 62 e3 97 47 cf 8e 7a b6 c8 52 83 3c c2 ac fb 3f c0 69 76 4e 8f 02 52 64 d8 31 4d da 38 70 e3 1e 66 54 59 c1 09 08 f0 51 30 21 a5 6c 5b 68 b7 82 2f 8a a0 30 07 cd 3e 74 71 9e ef dc 87 26 81 07 33 40 d4 7e 43 2f d9 0c 5e c2 41 88 09 28 6c f5 92 d8 91 08 a9 30 f6 95 7e f3 05 b7 fb ff bd c2 66 e9 6f 6f e4 ac 98 b1 73 ec c0 bc 60 b4 2a 95 34 98 da fb a1 ae 12 2d 4b d7 36 0f 25 fa ab a4 f3 fc eb e2 96 91 23 25 7f 0c 3d 93 48 af 49 36 14 00 bc e8 81 6f 4a 38 14 f2 00 a3 f9 40 43 9c 7a 54 c2 bc 70 4f 57 da 41 e7 f9 c2 5a d3 3a 54 f4 a0 84 b1 7f 55 05 59 35 7c be ed bd 15 c8 7f 97 c5 ab ba 5a c7 b5 b6 f6 de af 3a 47 9c 3a 53 02 da 25 65 3d 7e 6a 54 26 8d 49 51 a4 77 ea 50 17 d5 5b d7 d2 5d 88 44 13 6c 76 04 04 a8 c8 b8 e5 a1 21 b8 1a 92 8a 60 ed 58 69 97 c5 5b 96 ea ec 99 1b 29 93 59 13 01 fd b7 f1 08 8e 8d fa 9a b6 f6 f5 3b 4c bf 9f 4a 5d e3 ab e6 05 1d 35 a0 e1 d8 55 d3 6b 4c f1 f5 44 ed eb b0 e9 35 24 be bb 8f bd a2 d7 62 cf 49 c9 2f 54 38 b5 f3 31 71 28 a4 54 48 39 29 05 a6 5b 1d b8 85 1c 97 bd d6 75 cf 2f }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

dac7fbad-a361-4cdc-a60e-b936a7e3bebc

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion