t_class_16_sbox__16_big_512_

YARA detection rule by HydraDragonAntivirus · GPL-2.0

Rule t_class_16_sbox__16_big_512_ (No description metadata provided).

rule t_class_16_sbox__16_big_512_ {
  strings:
    $a0 = { a3 db d7 6e 09 66 83 d0 f8 be 48 58 f6 11 f4 cf b3 14 21 2d 15 a2 78 dd 99 f5 b1 c4 af ed f9 81 e7 9b 2d aa 4d 40 8a 75 ce 54 4c d5 ca d5 2e 75 52 2d 95 1a d9 1a 1e 73 4e 4a 38 7c 44 2c 28 b3 0a 21 df b6 02 d4 a0 3e 17 34 f1 58 60 74 68 2c 12 71 b7 f5 7a 76 c3 91 e9 df fa b5 3d 04 53 2e 96 e2 84 3b 6b 22 ba 34 f2 a7 63 c8 9a fb 19 32 7c 2e ae e5 e5 40 f5 ad f7 27 16 3e 6a 9a a2 ee 39 19 b6 8e 7b e1 0f f9 c1 e9 93 48 81 6a 1b d0 ee 85 b4 c9 1a 63 ea 16 d0 13 91 86 2f 7b b8 28 55 9d b9 17 da bc 85 41 3f 12 41 40 bf c1 e0 cb 5a 4e 58 8d 80 eb 5f 96 66 3f 0b 58 d8 82 90 2f 35 dd d5 22 c0 45 a7 a2 33 bc 06 8a 65 a0 69 65 45 15 00 b6 94 22 56 15 6d cb 98 5f 9b 67 76 2c 97 95 fc 94 b2 0c c2 bd b0 f8 fe eb db 44 20 f6 e1 a9 eb 0b d6 e3 e4 c0 dd 18 47 b7 4a 03 1d 16 42 db ed 8f 9e 11 6e 60 49 50 3c d9 cd fa 43 ae 27 d8 d2 8c 07 65 d4 51 de db c7 80 67 d8 18 68 89 0f cb f7 30 3d 1f 5a 8d aa c6 d9 8f ad aa c4 c8 62 74 a3 dc 5a c9 4d 5d 1b 5c f1 31 69 a4 5c 70 98 88 a8 61 a0 2c 66 9f 03 0d 5d 2b 3c 87 36 50 2f 82 a0 54 0b 64 8a 26 7e 7d b9 03 45 40 0d 34 5e 4b ce 1c d6 73 fe d1 b0 c4 85 fd 5e 3b fc cc d6 fb d3 7f 06 ab 01 e6 68 3e e8 5b a5 a5 6e ad ce 04 1d 23 13 9c 5f 14 c6 51 f0 22 e0 f0 f3 29 d5 79 33 71 82 7e ef ff 9b 8c 65 0e 23 e2 c1 0c 3d ef 61 bc f8 72 96 75 81 6f 90 37 ff a1 45 ec 47 d3 63 8e 13 62 bf 8b 2e 86 28 10 3b e8 3c 08 ce 77 82 11 f7 be c0 92 ef 4f 2c 24 4b c5 93 32 6b 36 bd 9d d0 cf d7 f3 80 a6 f6 bb 4e ac 75 5e 68 6c f3 a9 33 13 47 57 0b 25 03 b5 97 e3 3c bd ef a8 72 3a 38 01 aa 05 3f 59 91 2a 0e 46 98 }

  condition:
    $a0
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

24b5dfce-8949-44a9-8fae-e4f087aa6638

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion