XProtect_MACOS_SOMA_E

YARA detection rule by Rulezet · GPL-2.0
MACOS.SOMA.E
rule XProtect_MACOS_SOMA_E {
  meta:
    description = "MACOS.SOMA.E"

  strings:
    $a   = { 50 4f 53 54 20 2f 70 32 70 20 48 54 54 50 2f 31 2e 31 0d 0a 48 6f 73 74 3a 00 }
    $a00 = "PNQW$*v5"
    $a01 = "QMPP%)w:"
    $a02 = "RLWQ&(x;"
    $a03 = "SKVR''y8"
    $a04 = "TJUS(&z9"
    $a05 = "UIT\\)%{>"
    $a06 = "VH[]*$|?"
    $a07 = "WGZ^+#}<"
    $a08 = "XFY_,\"~="
    $a09 = { 59 45 58 58 2d 21 7f 22 }
    $a0a = "ZD_Y. `#"
    $a0b = "[C^Z/?a "
    $a0c = "\\B][0>b!"
    $a0d = "]A\\D1=c&"
    $a0e = "^@CE2<d'"
    $a0f = "__BF3;e$"
    $a10 = "@^AG4:f%"
    $a11 = "A]@@59g*"
    $a12 = "B\\GA68h+"
    $a13 = "C[FB77i("
    $a14 = "DZEC86j)"
    $a15 = "EYDL95k."
    $a16 = "FXKM:4l/"
    $a17 = "GWJN;3m,"
    $a18 = "HVIO<2n-"
    $a19 = { 49 55 48 48 3d 31 6f 12 }
    $a1a = { 4a 54 4f 49 3e 30 50 13 }
    $a1b = { 4b 53 4e 4a 3f 0f 51 10 }
    $a1c = { 4c 52 4d 4b 00 0e 52 11 }
    $a1d = { 4d 51 4c 74 01 0d 53 16 }
    $a1e = { 4e 50 73 75 02 0c 54 17 }
    $a1f = { 4f 6f 72 76 03 0b 55 14 }
    $a20 = { 70 6e 71 77 04 0a 56 15 }
    $a21 = { 71 6d 70 70 05 09 57 1a }
    $a22 = { 72 6c 77 71 06 08 58 1b }
    $a23 = { 73 6b 76 72 07 07 59 18 }
    $a24 = { 74 6a 75 73 08 06 5a 19 }
    $a25 = { 75 69 74 7c 09 05 5b 1e }
    $a26 = { 76 68 7b 7d 0a 04 5c 1f }
    $a27 = { 77 67 7a 7e 0b 03 5d 1c }
    $a28 = { 78 66 79 7f 0c 02 5e 1d }
    $a29 = { 79 65 78 78 0d 01 5f 02 }
    $a2a = { 7a 64 7f 79 0e 00 40 03 }
    $a2b = { 7b 63 7e 7a 0f 1f 41 00 }
    $a2c = { 7c 62 7d 7b 10 1e 42 01 }
    $a2d = { 7d 61 7c 64 11 1d 43 06 }
    $a2e = { 7e 60 63 65 12 1c 44 07 }
    $a2f = { 7f 7f 62 66 13 1b 45 04 }
    $a30 = { 60 7e 61 67 14 1a 46 05 }
    $a31 = { 61 7d 60 60 15 19 47 0a }
    $a32 = { 62 7c 67 61 16 18 48 0b }
    $a33 = { 63 7b 66 62 17 17 49 08 }
    $a34 = { 64 7a 65 63 18 16 4a 09 }
    $a35 = { 65 79 64 6c 19 15 4b 0e }
    $a36 = { 66 78 6b 6d 1a 14 4c 0f }
    $a37 = { 67 77 6a 6e 1b 13 4d 0c }
    $a38 = { 68 76 69 6f 1c 12 4e 0d }
    $a39 = { 69 75 68 68 1d 11 4f 72 }
    $a3a = { 6a 74 6f 69 1e 10 30 73 }
    $a3b = { 6b 73 6e 6a 1f 6f 31 70 }
    $a3c = "lrmk`n2q"
    $a3d = { 6d 71 6c 14 61 6d 33 76 }
    $a3e = { 6e 70 13 15 62 6c 34 77 }
    $a3f = { 6f 0f 12 16 63 6b 35 74 }
    $a40 = { 10 0e 11 17 64 6a 36 75 }
    $a41 = { 11 0d 10 10 65 69 37 7a }
    $a42 = { 12 0c 17 11 66 68 38 7b }
    $a43 = { 13 0b 16 12 67 67 39 78 }
    $a44 = { 14 0a 15 13 68 66 3a 79 }
    $a45 = { 15 09 14 1c 69 65 3b 7e }
    $a46 = { 16 08 1b 1d 6a 64 3c 7f }
    $a47 = { 17 07 1a 1e 6b 63 3d 7c }
    $a48 = { 18 06 19 1f 6c 62 3e 7d }
    $a49 = { 19 05 18 18 6d 61 3f 62 }
    $a4a = { 1a 04 1f 19 6e 60 20 63 }
    $a4b = { 1b 03 1e 1a 6f 7f 21 60 }
    $a4c = { 1c 02 1d 1b 70 7e 22 61 }
    $a4d = { 1d 01 1c 04 71 7d 23 66 }
    $a4e = { 1e 00 03 05 72 7c 24 67 }
    $a4f = { 1f 1f 02 06 73 7b 25 64 }
    $a50 = { 00 1e 01 07 74 7a 26 65 }
    $a51 = { 01 1d 00 00 75 79 27 6a }
    $a52 = { 02 1c 07 01 76 78 28 6b }
    $a53 = { 03 1b 06 02 77 77 29 68 }
    $a54 = { 04 1a 05 03 78 76 2a 69 }
    $a55 = { 05 19 04 0c 79 75 2b 6e }
    $a56 = { 06 18 0b 0d 7a 74 2c 6f }
    $a57 = { 07 17 0a 0e 7b 73 2d 6c }
    $a58 = { 08 16 09 0f 7c 72 2e 6d }
    $a59 = { 09 15 08 08 7d 71 2f 52 }
    $a5a = { 0a 14 0f 09 7e 70 10 53 }
    $a5b = { 0b 13 0e 0a 7f 4f 11 50 }
    $a5c = { 0c 12 0d 0b 40 4e 12 51 }
    $a5d = { 0d 11 0c 34 41 4d 13 56 }
    $a5e = { 0e 10 33 35 42 4c 14 57 }
    $a5f = { 0f 2f 32 36 43 4b 15 54 }
    $a60 = { 30 2e 31 37 44 4a 16 55 }
    $a61 = { 31 2d 30 30 45 49 17 5a }
    $a62 = { 32 2c 37 31 46 48 18 5b }
    $a63 = { 33 2b 36 32 47 47 19 58 }
    $a64 = { 34 2a 35 33 48 46 1a 59 }
    $a65 = { 35 29 34 3c 49 45 1b 5e }
    $a66 = { 36 28 3b 3d 4a 44 1c 5f }
    $a67 = { 37 27 3a 3e 4b 43 1d 5c }
    $a68 = { 38 26 39 3f 4c 42 1e 5d }
    $a69 = { 39 25 38 38 4d 41 1f 42 }
    $a6a = { 3a 24 3f 39 4e 40 00 43 }
    $a6b = { 3b 23 3e 3a 4f 5f 01 40 }
    $a6c = { 3c 22 3d 3b 50 5e 02 41 }
    $a6d = { 3d 21 3c 24 51 5d 03 46 }
    $a6e = { 3e 20 23 25 52 5c 04 47 }
    $a6f = { 3f 3f 22 26 53 5b 05 44 }
    $a70 = { 20 3e 21 27 54 5a 06 45 }
    $a71 = { 21 3d 20 20 55 59 07 4a }
    $a72 = { 22 3c 27 21 56 58 08 4b }
    $a73 = "#;&\"WW\tH"
    $a74 = "$:%#XV\nI"
    $a75 = { 25 39 24 2c 59 55 0b 4e }
    $a76 = { 26 38 2b 2d 5a 54 0c 4f }
    $a77 = "'7*.[S\rL"
    $a78 = { 28 36 29 2f 5c 52 0e 4d }
    $a79 = { 29 35 28 28 5d 51 0f b2 }
    $a7a = { 2a 34 2f 29 5e 50 f0 b3 }
    $a7b = { 2b 33 2e 2a 5f af f1 b0 }
    $a7c = { 2c 32 2d 2b a0 ae f2 b1 }
    $a7d = { 2d 31 2c d4 a1 ad f3 b6 }
    $a7e = { 2e 30 d3 d5 a2 ac f4 b7 }
    $a7f = { 2f cf d2 d6 a3 ab f5 b4 }
    $a80 = { d0 ce d1 d7 a4 aa f6 b5 }
    $a81 = { d1 cd d0 d0 a5 a9 f7 ba }
    $a82 = { d2 cc d7 d1 a6 a8 f8 bb }
    $a83 = { d3 cb d6 d2 a7 a7 f9 b8 }
    $a84 = { d4 ca d5 d3 a8 a6 fa b9 }
    $a85 = { d5 c9 d4 dc a9 a5 fb be }
    $a86 = { d6 c8 db dd aa a4 fc bf }
    $a87 = { d7 c7 da de ab a3 fd bc }
    $a88 = { d8 c6 d9 df ac a2 fe bd }
    $a89 = { d9 c5 d8 d8 ad a1 ff a2 }
    $a8a = { da c4 df d9 ae a0 e0 a3 }
    $a8b = { db c3 de da af bf e1 a0 }
    $a8c = { dc c2 dd db b0 be e2 a1 }
    $a8d = { dd c1 dc c4 b1 bd e3 a6 }
    $a8e = { de c0 c3 c5 b2 bc e4 a7 }
    $a8f = { df df c2 c6 b3 bb e5 a4 }
    $a90 = { c0 de c1 c7 b4 ba e6 a5 }
    $a91 = { c1 dd c0 c0 b5 b9 e7 aa }
    $a92 = { c2 dc c7 c1 b6 b8 e8 ab }
    $a93 = { c3 db c6 c2 b7 b7 e9 a8 }
    $a94 = { c4 da c5 c3 b8 b6 ea a9 }
    $a95 = { c5 d9 c4 cc b9 b5 eb ae }
    $a96 = { c6 d8 cb cd ba b4 ec af }
    $a97 = { c7 d7 ca ce bb b3 ed ac }
    $a98 = { c8 d6 c9 cf bc b2 ee ad }
    $a99 = { c9 d5 c8 c8 bd b1 ef 92 }
    $a9a = { ca d4 cf c9 be b0 d0 93 }
    $a9b = { cb d3 ce ca bf 8f d1 90 }
    $a9c = { cc d2 cd cb 80 8e d2 91 }
    $a9d = { cd d1 cc f4 81 8d d3 96 }
    $a9e = { ce d0 f3 f5 82 8c d4 97 }
    $a9f = { cf ef f2 f6 83 8b d5 94 }
    $aa0 = { f0 ee f1 f7 84 8a d6 95 }
    $aa1 = { f1 ed f0 f0 85 89 d7 9a }
    $aa2 = { f2 ec f7 f1 86 88 d8 9b }
    $aa3 = { f3 eb f6 f2 87 87 d9 98 }
    $aa4 = { f4 ea f5 f3 88 86 da 99 }
    $aa5 = { f5 e9 f4 fc 89 85 db 9e }
    $aa6 = { f6 e8 fb fd 8a 84 dc 9f }
    $aa7 = { f7 e7 fa fe 8b 83 dd 9c }
    $aa8 = { f8 e6 f9 ff 8c 82 de 9d }
    $aa9 = { f9 e5 f8 f8 8d 81 df 82 }
    $aaa = { fa e4 ff f9 8e 80 c0 83 }
    $aab = { fb e3 fe fa 8f 9f c1 80 }
    $aac = { fc e2 fd fb 90 9e c2 81 }
    $aad = { fd e1 fc e4 91 9d c3 86 }
    $aae = { fe e0 e3 e5 92 9c c4 87 }
    $aaf = { ff ff e2 e6 93 9b c5 84 }
    $ab0 = { e0 fe e1 e7 94 9a c6 85 }
    $ab1 = { e1 fd e0 e0 95 99 c7 8a }
    $ab2 = { e2 fc e7 e1 96 98 c8 8b }
    $ab3 = { e3 fb e6 e2 97 97 c9 88 }
    $ab4 = { e4 fa e5 e3 98 96 ca 89 }
    $ab5 = { e5 f9 e4 ec 99 95 cb 8e }
    $ab6 = { e6 f8 eb ed 9a 94 cc 8f }
    $ab7 = { e7 f7 ea ee 9b 93 cd 8c }
    $ab8 = { e8 f6 e9 ef 9c 92 ce 8d }
    $ab9 = { e9 f5 e8 e8 9d 91 cf f2 }
    $aba = { ea f4 ef e9 9e 90 b0 f3 }
    $abb = { eb f3 ee ea 9f ef b1 f0 }
    $abc = { ec f2 ed eb e0 ee b2 f1 }
    $abd = { ed f1 ec 94 e1 ed b3 f6 }
    $abe = { ee f0 93 95 e2 ec b4 f7 }
    $abf = { ef 8f 92 96 e3 eb b5 f4 }
    $ac0 = { 90 8e 91 97 e4 ea b6 f5 }
    $ac1 = { 91 8d 90 90 e5 e9 b7 fa }
    $ac2 = { 92 8c 97 91 e6 e8 b8 fb }
    $ac3 = { 93 8b 96 92 e7 e7 b9 f8 }
    $ac4 = { 94 8a 95 93 e8 e6 ba f9 }
    $ac5 = { 95 89 94 9c e9 e5 bb fe }
    $ac6 = { 96 88 9b 9d ea e4 bc ff }
    $ac7 = { 97 87 9a 9e eb e3 bd fc }
    $ac8 = { 98 86 99 9f ec e2 be fd }
    $ac9 = { 99 85 98 98 ed e1 bf e2 }
    $aca = { 9a 84 9f 99 ee e0 a0 e3 }
    $acb = { 9b 83 9e 9a ef ff a1 e0 }
    $acc = { 9c 82 9d 9b f0 fe a2 e1 }
    $acd = { 9d 81 9c 84 f1 fd a3 e6 }
    $ace = { 9e 80 83 85 f2 fc a4 e7 }
    $acf = { 9f 9f 82 86 f3 fb a5 e4 }
    $ad0 = { 80 9e 81 87 f4 fa a6 e5 }
    $ad1 = { 81 9d 80 80 f5 f9 a7 ea }
    $ad2 = { 82 9c 87 81 f6 f8 a8 eb }
    $ad3 = { 83 9b 86 82 f7 f7 a9 e8 }
    $ad4 = { 84 9a 85 83 f8 f6 aa e9 }
    $ad5 = { 85 99 84 8c f9 f5 ab ee }
    $ad6 = { 86 98 8b 8d fa f4 ac ef }
    $ad7 = { 87 97 8a 8e fb f3 ad ec }
    $ad8 = { 88 96 89 8f fc f2 ae ed }
    $ad9 = { 89 95 88 88 fd f1 af d2 }
    $ada = { 8a 94 8f 89 fe f0 90 d3 }
    $adb = { 8b 93 8e 8a ff cf 91 d0 }
    $adc = { 8c 92 8d 8b c0 ce 92 d1 }
    $add = { 8d 91 8c b4 c1 cd 93 d6 }
    $ade = { 8e 90 b3 b5 c2 cc 94 d7 }
    $adf = { 8f af b2 b6 c3 cb 95 d4 }
    $ae0 = { b0 ae b1 b7 c4 ca 96 d5 }
    $ae1 = { b1 ad b0 b0 c5 c9 97 da }
    $ae2 = { b2 ac b7 b1 c6 c8 98 db }
    $ae3 = { b3 ab b6 b2 c7 c7 99 d8 }
    $ae4 = { b4 aa b5 b3 c8 c6 9a d9 }
    $ae5 = { b5 a9 b4 bc c9 c5 9b de }
    $ae6 = { b6 a8 bb bd ca c4 9c df }
    $ae7 = { b7 a7 ba be cb c3 9d dc }
    $ae8 = { b8 a6 b9 bf cc c2 9e dd }
    $ae9 = { b9 a5 b8 b8 cd c1 9f c2 }
    $aea = { ba a4 bf b9 ce c0 80 c3 }
    $aeb = { bb a3 be ba cf df 81 c0 }
    $aec = { bc a2 bd bb d0 de 82 c1 }
    $aed = { bd a1 bc a4 d1 dd 83 c6 }
    $aee = { be a0 a3 a5 d2 dc 84 c7 }
    $aef = { bf bf a2 a6 d3 db 85 c4 }
    $af0 = { a0 be a1 a7 d4 da 86 c5 }
    $af1 = { a1 bd a0 a0 d5 d9 87 ca }
    $af2 = { a2 bc a7 a1 d6 d8 88 cb }
    $af3 = { a3 bb a6 a2 d7 d7 89 c8 }
    $af4 = { a4 ba a5 a3 d8 d6 8a c9 }
    $af5 = { a5 b9 a4 ac d9 d5 8b ce }
    $af6 = { a6 b8 ab ad da d4 8c cf }
    $af7 = { a7 b7 aa ae db d3 8d cc }
    $af8 = { a8 b6 a9 af dc d2 8e cd }
    $af9 = { a9 b5 a8 a8 dd d1 8f 32 }
    $afa = { aa b4 af a9 de d0 70 33 }
    $afb = { ab b3 ae aa df 2f 71 30 }
    $afc = { ac b2 ad ab 20 2e 72 31 }
    $afd = { ad b1 ac 54 21 2d 73 36 }
    $afe = { ae b0 53 55 22 2c 74 37 }
    $aff = { af 4f 52 56 23 2b 75 34 }

    $b   = "security 2>&1 > /dev/null find-generic-password -ga 'Chrome' | awk '{print $2}'"
    $b00 = ".EQ\\Wqiu"
    $b01 = "/FP[Vrhz"
    $b02 = ",GWZUsg{"
    $b03 = "-@VYT|fx"
    $b04 = "*AUX[}ey"
    $b05 = "+BTWZ~d~"
    $b06 = { 28 43 5b 56 59 7f 63 7f }
    $b07 = ")LZUXxb|"
    $b08 = "&MYT_ya}"
    $b09 = "'NXS^z`b"
    $b0a = { 24 4f 5f 52 5d 7b 7f 63 }
    $b0b = "%H^Q\\d~`"
    $b0c = "\"I]PCe}a"
    $b0d = "#J\\OBf|f"
    $b0e = " KCNAg{g"
    $b0f = "!TBM@`zd"
    $b10 = ">UALGaye"
    $b11 = "?V@KFbxj"
    $b12 = "<WGJEcwk"
    $b13 = "=PFIDlvh"
    $b14 = ":QEHKmui"
    $b15 = ";RDGJntn"
    $b16 = "8SKFIoso"
    $b17 = "9\\JEHhrl"
    $b18 = "6]IDOiqm"
    $b19 = "7^HCNjpR"
    $b1a = "4_OBMkOS"
    $b1b = "5XNALTNP"
    $b1c = "2YM@sUMQ"
    $b1d = { 33 5a 4c 7f 72 56 4c 56 }
    $b1e = "0[s~qWKW"
    $b1f = "1dr}pPJT"
    $b20 = { 0e 65 71 7c 77 51 49 55 }
    $b21 = { 0f 66 70 7b 76 52 48 5a }
    $b22 = { 0c 67 77 7a 75 53 47 5b }
    $b23 = "\r`vyt\\FX"
    $b24 = "\naux{]EY"
    $b25 = { 0b 62 74 77 7a 5e 44 5e }
    $b26 = { 08 63 7b 76 79 5f 43 5f }
    $b27 = "\tlzuxXB\\"
    $b28 = { 06 6d 79 74 7f 59 41 5d }
    $b29 = { 07 6e 78 73 7e 5a 40 42 }
    $b2a = { 04 6f 7f 72 7d 5b 5f 43 }
    $b2b = { 05 68 7e 71 7c 44 5e 40 }
    $b2c = { 02 69 7d 70 63 45 5d 41 }
    $b2d = { 03 6a 7c 6f 62 46 5c 46 }
    $b2e = { 00 6b 63 6e 61 47 5b 47 }
    $b2f = { 01 74 62 6d 60 40 5a 44 }
    $b30 = { 1e 75 61 6c 67 41 59 45 }
    $b31 = { 1f 76 60 6b 66 42 58 4a }
    $b32 = { 1c 77 67 6a 65 43 57 4b }
    $b33 = { 1d 70 66 69 64 4c 56 48 }
    $b34 = { 1a 71 65 68 6b 4d 55 49 }
    $b35 = { 1b 72 64 67 6a 4e 54 4e }
    $b36 = { 18 73 6b 66 69 4f 53 4f }
    $b37 = { 19 7c 6a 65 68 48 52 4c }
    $b38 = { 16 7d 69 64 6f 49 51 4d }
    $b39 = { 17 7e 68 63 6e 4a 50 32 }
    $b3a = { 14 7f 6f 62 6d 4b 2f 33 }
    $b3b = { 15 78 6e 61 6c 34 2e 30 }
    $b3c = { 12 79 6d 60 13 35 2d 31 }
    $b3d = { 13 7a 6c 1f 12 36 2c 36 }
    $b3e = { 10 7b 13 1e 11 37 2b 37 }
    $b3f = { 11 04 12 1d 10 30 2a 34 }
    $b40 = { 6e 05 11 1c 17 31 29 35 }
    $b41 = { 6f 06 10 1b 16 32 28 3a }
    $b42 = { 6c 07 17 1a 15 33 27 3b }
    $b43 = { 6d 00 16 19 14 3c 26 38 }
    $b44 = { 6a 01 15 18 1b 3d 25 39 }
    $b45 = { 6b 02 14 17 1a 3e 24 3e }
    $b46 = { 68 03 1b 16 19 3f 23 3f }
    $b47 = { 69 0c 1a 15 18 38 22 3c }
    $b48 = { 66 0d 19 14 1f 39 21 3d }
    $b49 = { 67 0e 18 13 1e 3a 20 22 }
    $b4a = { 64 0f 1f 12 1d 3b 3f 23 }
    $b4b = { 65 08 1e 11 1c 24 3e 20 }
    $b4c = { 62 09 1d 10 03 25 3d 21 }
    $b4d = { 63 0a 1c 0f 02 26 3c 26 }
    $b4e = { 60 0b 03 0e 01 27 3b 27 }
    $b4f = { 61 14 02 0d 00 20 3a 24 }
    $b50 = { 7e 15 01 0c 07 21 39 25 }
    $b51 = { 7f 16 00 0b 06 22 38 2a }
    $b52 = { 7c 17 07 0a 05 23 37 2b }
    $b53 = { 7d 10 06 09 04 2c 36 28 }
    $b54 = { 7a 11 05 08 0b 2d 35 29 }
    $b55 = { 7b 12 04 07 0a 2e 34 2e }
    $b56 = { 78 13 0b 06 09 2f 33 2f }
    $b57 = { 79 1c 0a 05 08 28 32 2c }
    $b58 = { 76 1d 09 04 0f 29 31 2d }
    $b59 = { 77 1e 08 03 0e 2a 30 12 }
    $b5a = { 74 1f 0f 02 0d 2b 0f 13 }
    $b5b = { 75 18 0e 01 0c 14 0e 10 }
    $b5c = { 72 19 0d 00 33 15 0d 11 }
    $b5d = { 73 1a 0c 3f 32 16 0c 16 }
    $b5e = { 70 1b 33 3e 31 17 0b 17 }
    $b5f = { 71 24 32 3d 30 10 0a 14 }
    $b60 = { 4e 25 31 3c 37 11 09 15 }
    $b61 = { 4f 26 30 3b 36 12 08 1a }
    $b62 = { 4c 27 37 3a 35 13 07 1b }
    $b63 = { 4d 20 36 39 34 1c 06 18 }
    $b64 = { 4a 21 35 38 3b 1d 05 19 }
    $b65 = { 4b 22 34 37 3a 1e 04 1e }
    $b66 = { 48 23 3b 36 39 1f 03 1f }
    $b67 = { 49 2c 3a 35 38 18 02 1c }
    $b68 = { 46 2d 39 34 3f 19 01 1d }
    $b69 = { 47 2e 38 33 3e 1a 00 02 }
    $b6a = { 44 2f 3f 32 3d 1b 1f 03 }
    $b6b = { 45 28 3e 31 3c 04 1e 00 }
    $b6c = { 42 29 3d 30 23 05 1d 01 }
    $b6d = { 43 2a 3c 2f 22 06 1c 06 }
    $b6e = { 40 2b 23 2e 21 07 1b 07 }
    $b6f = { 41 34 22 2d 20 00 1a 04 }
    $b70 = { 5e 35 21 2c 27 01 19 05 }
    $b71 = { 5f 36 20 2b 26 02 18 0a }
    $b72 = { 5c 37 27 2a 25 03 17 0b }
    $b73 = { 5d 30 26 29 24 0c 16 08 }
    $b74 = { 5a 31 25 28 2b 0d 15 09 }
    $b75 = { 5b 32 24 27 2a 0e 14 0e }
    $b76 = { 58 33 2b 26 29 0f 13 0f }
    $b77 = { 59 3c 2a 25 28 08 12 0c }
    $b78 = { 56 3d 29 24 2f 09 11 0d }
    $b79 = { 57 3e 28 23 2e 0a 10 f2 }
    $b7a = { 54 3f 2f 22 2d 0b ef f3 }
    $b7b = { 55 38 2e 21 2c f4 ee f0 }
    $b7c = { 52 39 2d 20 d3 f5 ed f1 }
    $b7d = { 53 3a 2c df d2 f6 ec f6 }
    $b7e = { 50 3b d3 de d1 f7 eb f7 }
    $b7f = { 51 c4 d2 dd d0 f0 ea f4 }
    $b80 = { ae c5 d1 dc d7 f1 e9 f5 }
    $b81 = { af c6 d0 db d6 f2 e8 fa }
    $b82 = { ac c7 d7 da d5 f3 e7 fb }
    $b83 = { ad c0 d6 d9 d4 fc e6 f8 }
    $b84 = { aa c1 d5 d8 db fd e5 f9 }
    $b85 = { ab c2 d4 d7 da fe e4 fe }
    $b86 = { a8 c3 db d6 d9 ff e3 ff }
    $b87 = { a9 cc da d5 d8 f8 e2 fc }
    $b88 = { a6 cd d9 d4 df f9 e1 fd }
    $b89 = { a7 ce d8 d3 de fa e0 e2 }
    $b8a = { a4 cf df d2 dd fb ff e3 }
    $b8b = { a5 c8 de d1 dc e4 fe e0 }
    $b8c = { a2 c9 dd d0 c3 e5 fd e1 }
    $b8d = { a3 ca dc cf c2 e6 fc e6 }
    $b8e = { a0 cb c3 ce c1 e7 fb e7 }
    $b8f = { a1 d4 c2 cd c0 e0 fa e4 }
    $b90 = { be d5 c1 cc c7 e1 f9 e5 }
    $b91 = { bf d6 c0 cb c6 e2 f8 ea }
    $b92 = { bc d7 c7 ca c5 e3 f7 eb }
    $b93 = { bd d0 c6 c9 c4 ec f6 e8 }
    $b94 = { ba d1 c5 c8 cb ed f5 e9 }
    $b95 = { bb d2 c4 c7 ca ee f4 ee }
    $b96 = { b8 d3 cb c6 c9 ef f3 ef }
    $b97 = { b9 dc ca c5 c8 e8 f2 ec }
    $b98 = { b6 dd c9 c4 cf e9 f1 ed }
    $b99 = { b7 de c8 c3 ce ea f0 d2 }
    $b9a = { b4 df cf c2 cd eb cf d3 }
    $b9b = { b5 d8 ce c1 cc d4 ce d0 }
    $b9c = { b2 d9 cd c0 f3 d5 cd d1 }
    $b9d = { b3 da cc ff f2 d6 cc d6 }
    $b9e = { b0 db f3 fe f1 d7 cb d7 }
    $b9f = { b1 e4 f2 fd f0 d0 ca d4 }
    $ba0 = { 8e e5 f1 fc f7 d1 c9 d5 }
    $ba1 = { 8f e6 f0 fb f6 d2 c8 da }
    $ba2 = { 8c e7 f7 fa f5 d3 c7 db }
    $ba3 = { 8d e0 f6 f9 f4 dc c6 d8 }
    $ba4 = { 8a e1 f5 f8 fb dd c5 d9 }
    $ba5 = { 8b e2 f4 f7 fa de c4 de }
    $ba6 = { 88 e3 fb f6 f9 df c3 df }
    $ba7 = { 89 ec fa f5 f8 d8 c2 dc }
    $ba8 = { 86 ed f9 f4 ff d9 c1 dd }
    $ba9 = { 87 ee f8 f3 fe da c0 c2 }
    $baa = { 84 ef ff f2 fd db df c3 }
    $bab = { 85 e8 fe f1 fc c4 de c0 }
    $bac = { 82 e9 fd f0 e3 c5 dd c1 }
    $bad = { 83 ea fc ef e2 c6 dc c6 }
    $bae = { 80 eb e3 ee e1 c7 db c7 }
    $baf = { 81 f4 e2 ed e0 c0 da c4 }
    $bb0 = { 9e f5 e1 ec e7 c1 d9 c5 }
    $bb1 = { 9f f6 e0 eb e6 c2 d8 ca }
    $bb2 = { 9c f7 e7 ea e5 c3 d7 cb }
    $bb3 = { 9d f0 e6 e9 e4 cc d6 c8 }
    $bb4 = { 9a f1 e5 e8 eb cd d5 c9 }
    $bb5 = { 9b f2 e4 e7 ea ce d4 ce }
    $bb6 = { 98 f3 eb e6 e9 cf d3 cf }
    $bb7 = { 99 fc ea e5 e8 c8 d2 cc }
    $bb8 = { 96 fd e9 e4 ef c9 d1 cd }
    $bb9 = { 97 fe e8 e3 ee ca d0 b2 }
    $bba = { 94 ff ef e2 ed cb af b3 }
    $bbb = { 95 f8 ee e1 ec b4 ae b0 }
    $bbc = { 92 f9 ed e0 93 b5 ad b1 }
    $bbd = { 93 fa ec 9f 92 b6 ac b6 }
    $bbe = { 90 fb 93 9e 91 b7 ab b7 }
    $bbf = { 91 84 92 9d 90 b0 aa b4 }
    $bc0 = { ee 85 91 9c 97 b1 a9 b5 }
    $bc1 = { ef 86 90 9b 96 b2 a8 ba }
    $bc2 = { ec 87 97 9a 95 b3 a7 bb }
    $bc3 = { ed 80 96 99 94 bc a6 b8 }
    $bc4 = { ea 81 95 98 9b bd a5 b9 }
    $bc5 = { eb 82 94 97 9a be a4 be }
    $bc6 = { e8 83 9b 96 99 bf a3 bf }
    $bc7 = { e9 8c 9a 95 98 b8 a2 bc }
    $bc8 = { e6 8d 99 94 9f b9 a1 bd }
    $bc9 = { e7 8e 98 93 9e ba a0 a2 }
    $bca = { e4 8f 9f 92 9d bb bf a3 }
    $bcb = { e5 88 9e 91 9c a4 be a0 }
    $bcc = { e2 89 9d 90 83 a5 bd a1 }
    $bcd = { e3 8a 9c 8f 82 a6 bc a6 }
    $bce = { e0 8b 83 8e 81 a7 bb a7 }
    $bcf = { e1 94 82 8d 80 a0 ba a4 }
    $bd0 = { fe 95 81 8c 87 a1 b9 a5 }
    $bd1 = { ff 96 80 8b 86 a2 b8 aa }
    $bd2 = { fc 97 87 8a 85 a3 b7 ab }
    $bd3 = { fd 90 86 89 84 ac b6 a8 }
    $bd4 = { fa 91 85 88 8b ad b5 a9 }
    $bd5 = { fb 92 84 87 8a ae b4 ae }
    $bd6 = { f8 93 8b 86 89 af b3 af }
    $bd7 = { f9 9c 8a 85 88 a8 b2 ac }
    $bd8 = { f6 9d 89 84 8f a9 b1 ad }
    $bd9 = { f7 9e 88 83 8e aa b0 92 }
    $bda = { f4 9f 8f 82 8d ab 8f 93 }
    $bdb = { f5 98 8e 81 8c 94 8e 90 }
    $bdc = { f2 99 8d 80 b3 95 8d 91 }
    $bdd = { f3 9a 8c bf b2 96 8c 96 }
    $bde = { f0 9b b3 be b1 97 8b 97 }
    $bdf = { f1 a4 b2 bd b0 90 8a 94 }
    $be0 = { ce a5 b1 bc b7 91 89 95 }
    $be1 = { cf a6 b0 bb b6 92 88 9a }
    $be2 = { cc a7 b7 ba b5 93 87 9b }
    $be3 = { cd a0 b6 b9 b4 9c 86 98 }
    $be4 = { ca a1 b5 b8 bb 9d 85 99 }
    $be5 = { cb a2 b4 b7 ba 9e 84 9e }
    $be6 = { c8 a3 bb b6 b9 9f 83 9f }
    $be7 = { c9 ac ba b5 b8 98 82 9c }
    $be8 = { c6 ad b9 b4 bf 99 81 9d }
    $be9 = { c7 ae b8 b3 be 9a 80 82 }
    $bea = { c4 af bf b2 bd 9b 9f 83 }
    $beb = { c5 a8 be b1 bc 84 9e 80 }
    $bec = { c2 a9 bd b0 a3 85 9d 81 }
    $bed = { c3 aa bc af a2 86 9c 86 }
    $bee = { c0 ab a3 ae a1 87 9b 87 }
    $bef = { c1 b4 a2 ad a0 80 9a 84 }
    $bf0 = { de b5 a1 ac a7 81 99 85 }
    $bf1 = { df b6 a0 ab a6 82 98 8a }
    $bf2 = { dc b7 a7 aa a5 83 97 8b }
    $bf3 = { dd b0 a6 a9 a4 8c 96 88 }
    $bf4 = { da b1 a5 a8 ab 8d 95 89 }
    $bf5 = { db b2 a4 a7 aa 8e 94 8e }
    $bf6 = { d8 b3 ab a6 a9 8f 93 8f }
    $bf7 = { d9 bc aa a5 a8 88 92 8c }
    $bf8 = { d6 bd a9 a4 af 89 91 8d }
    $bf9 = { d7 be a8 a3 ae 8a 90 72 }
    $bfa = { d4 bf af a2 ad 8b 6f 73 }
    $bfb = { d5 b8 ae a1 ac 74 6e 70 }
    $bfc = { d2 b9 ad a0 53 75 6d 71 }
    $bfd = { d3 ba ac 5f 52 76 6c 76 }
    $bfe = { d0 bb 53 5e 51 77 6b 77 }
    $bff = { d1 44 52 5d 50 70 6a 74 }

    $adrop = { 74 65 6c 6c [1-30] 61 70 70 [1-30] 54 65 72 6d 69 6e 61 6c [1-30] 74 6f [1-30] 63 6c 6f 73 65 [1-30] 66 69 72 73 74 [1-30] 77 69 6e 64 6f 77 }
    $bdrop = { 55 53 45 52 00 2f 55 73 65 72 73 2f 00 2f 65 78 65 00 63 68 6d 6f 64 20 2b 78 20 00 72 6d 20 00 }

  condition:
    BINARYALERT_Macho_PRIVATE and any of ($a*) and any of ($b*) and filesize < 4MB
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

83fa5e3b-8c0a-4b83-8e3c-ea0e441b12f9
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
