XProtect_MACOS_SOMA_F

YARA detection rule by Rulezet · GPL-2.0
MACOS.SOMA.F
rule XProtect_MACOS_SOMA_F {
  meta:
    description = "MACOS.SOMA.F"

  strings:
    $a = {
      73 79 73 74 65 6d 5f [40-60]
      41 70 70 6c 65 20 56 [240-280]
      64 73 63 6c 20 2f 4c [0-10]
      2f 70 61 73 73 77 6f [30-60]
      2f 6c 6f 67 69 6e 2d
    }

    $b01 = "rxrudl^qsnghmds"
    $b02 = "q{qvgo]rpmdkngp"
    $b03 = "pzpwfn\\sqlejofq"
    $b04 = "w}wpai[tvkbmhav"
    $b05 = "v|vq`hZuwjcli`w"
    $b06 = { 75 7f 75 72 63 6b 59 76 74 69 60 6f 6a 63 74 }
    $b07 = "t~tsbjXwuhankbu"
    $b08 = "{q{|meWxzgnadmz"
    $b09 = "zpz}ldVy{fo`el{"
    $b0a = "ysy~ogUzxelcfox"
    $b0b = { 78 72 78 7f 6e 66 54 7b 79 64 6d 62 67 6e 79 }
    $b0c = { 7f 75 7f 78 69 61 53 7c 7e 63 6a 65 60 69 7e }
    $b0d = { 7e 74 7e 79 68 60 52 7d 7f 62 6b 64 61 68 7f }
    $b0e = "}w}zkcQ~|ahgbk|"
    $b0f = { 7c 76 7c 7b 6a 62 50 7f 7d 60 69 66 63 6a 7d }
    $b10 = { 63 69 63 64 75 7d 4f 60 62 7f 76 79 7c 75 62 }
    $b11 = "bhbet|Nac~wx}tc"
    $b12 = { 61 6b 61 66 77 7f 4d 62 60 7d 74 7b 7e 77 60 }
    $b13 = { 60 6a 60 67 76 7e 4c 63 61 7c 75 7a 7f 76 61 }
    $b14 = "gmg`qyKdf{r}xqf"
    $b15 = "flfapxJegzs|ypg"
    $b16 = { 65 6f 65 62 73 7b 49 66 64 79 70 7f 7a 73 64 }
    $b17 = "dndcrzHgexq~{re"
    $b18 = "kakl}uGhjw~qt}j"
    $b19 = { 6a 60 6a 6d 7c 74 46 69 6b 76 7f 70 75 7c 6b }
    $b1a = { 69 63 69 6e 7f 77 45 6a 68 75 7c 73 76 7f 68 }
    $b1b = "hbho~vDkit}rw~i"
    $b1c = "oeohyqClnszupyn"
    $b1d = "ndnixpBmor{tqxo"
    $b1e = "mgmj{sAnlqxwr{l"
    $b1f = "lflkzr@ompyvszm"
    $b20 = { 53 59 53 54 45 4d 7f 50 52 4f 46 49 4c 45 52 }
    $b21 = "RXRUDL~QSNGHMDS"
    $b22 = "Q[QVGO}RPMDKNGP"
    $b23 = "PZPWFN|SQLEJOFQ"
    $b24 = "W]WPAI{TVKBMHAV"
    $b25 = "V\\VQ@HzUWJCLI@W"
    $b26 = "U_URCKyVTI@OJCT"
    $b27 = "T^TSBJxWUHANKBU"
    $b28 = "[Q[\\MEwXZGNADMZ"
    $b29 = "ZPZ]LDvY[FO@EL["
    $b2a = "YSY^OGuZXELCFOX"
    $b2b = "XRX_NFt[YDMBGNY"
    $b2c = "_U_XIAs\\^CJE@I^"
    $b2d = "^T^YH@r]_BKDAH_"
    $b2e = "]W]ZKCq^\\AHGBK\\"
    $b2f = "\\V\\[JBp_]@IFCJ]"
    $b30 = "CICDU]o@B_VY\\UB"
    $b31 = "BHBET\\nAC^WX]TC"
    $b32 = "AKAFW_mB@]T[^W@"
    $b33 = "@J@GV^lCA\\UZ_VA"
    $b34 = "GMG@QYkDF[R]XQF"
    $b35 = "FLFAPXjEGZS\\YPG"
    $b36 = "EOEBS[iFDYP_ZSD"
    $b37 = "DNDCRZhGEXQ^[RE"
    $b38 = "KAKL]UgHJW^QT]J"
    $b39 = "J@JM\\TfIKV_PU\\K"
    $b3a = "ICIN_WeJHU\\SV_H"
    $b3b = "HBHO^VdKIT]RW^I"
    $b3c = "OEOHYQcLNSZUPYN"
    $b3d = "NDNIXPbMOR[TQXO"
    $b3e = "MGMJ[SaNLQXWR[L"
    $b3f = "LFLKZR`OMPYVSZM"
    $b40 = { 33 39 33 34 25 2d 1f 30 32 2f 26 29 2c 25 32 }
    $b41 = { 32 38 32 35 24 2c 1e 31 33 2e 27 28 2d 24 33 }
    $b42 = { 31 3b 31 36 27 2f 1d 32 30 2d 24 2b 2e 27 30 }
    $b43 = { 30 3a 30 37 26 2e 1c 33 31 2c 25 2a 2f 26 31 }
    $b44 = { 37 3d 37 30 21 29 1b 34 36 2b 22 2d 28 21 36 }
    $b45 = { 36 3c 36 31 20 28 1a 35 37 2a 23 2c 29 20 37 }
    $b46 = { 35 3f 35 32 23 2b 19 36 34 29 20 2f 2a 23 34 }
    $b47 = { 34 3e 34 33 22 2a 18 37 35 28 21 2e 2b 22 35 }
    $b48 = { 3b 31 3b 3c 2d 25 17 38 3a 27 2e 21 24 2d 3a }
    $b49 = { 3a 30 3a 3d 2c 24 16 39 3b 26 2f 20 25 2c 3b }
    $b4a = { 39 33 39 3e 2f 27 15 3a 38 25 2c 23 26 2f 38 }
    $b4b = { 38 32 38 3f 2e 26 14 3b 39 24 2d 22 27 2e 39 }
    $b4c = { 3f 35 3f 38 29 21 13 3c 3e 23 2a 25 20 29 3e }
    $b4d = { 3e 34 3e 39 28 20 12 3d 3f 22 2b 24 21 28 3f }
    $b4e = { 3d 37 3d 3a 2b 23 11 3e 3c 21 28 27 22 2b 3c }
    $b4f = { 3c 36 3c 3b 2a 22 10 3f 3d 20 29 26 23 2a 3d }
    $b50 = { 23 29 23 24 35 3d 0f 20 22 3f 36 39 3c 35 22 }
    $b51 = { 22 28 22 25 34 3c 0e 21 23 3e 37 38 3d 34 23 }
    $b52 = "!+!&7?\r\" =4;>7 "
    $b53 = { 20 2a 20 27 36 3e 0c 23 21 3c 35 3a 3f 36 21 }
    $b54 = { 27 2d 27 20 31 39 0b 24 26 3b 32 3d 38 31 26 }
    $b55 = "&,&!08\n%':3<90'"
    $b56 = "%/%\"3;\t&$90?:3$"
    $b57 = { 24 2e 24 23 32 3a 08 27 25 38 31 3e 3b 32 25 }
    $b58 = { 2b 21 2b 2c 3d 35 07 28 2a 37 3e 31 34 3d 2a }
    $b59 = { 2a 20 2a 2d 3c 34 06 29 2b 36 3f 30 35 3c 2b }
    $b5a = { 29 23 29 2e 3f 37 05 2a 28 35 3c 33 36 3f 28 }
    $b5b = { 28 22 28 2f 3e 36 04 2b 29 34 3d 32 37 3e 29 }
    $b5c = { 2f 25 2f 28 39 31 03 2c 2e 33 3a 35 30 39 2e }
    $b5d = { 2e 24 2e 29 38 30 02 2d 2f 32 3b 34 31 38 2f }
    $b5e = { 2d 27 2d 2a 3b 33 01 2e 2c 31 38 37 32 3b 2c }
    $b5f = { 2c 26 2c 2b 3a 32 00 2f 2d 30 39 36 33 3a 2d }
    $b60 = { 13 19 13 14 05 0d 3f 10 12 0f 06 09 0c 05 12 }
    $b61 = { 12 18 12 15 04 0c 3e 11 13 0e 07 08 0d 04 13 }
    $b62 = { 11 1b 11 16 07 0f 3d 12 10 0d 04 0b 0e 07 10 }
    $b63 = { 10 1a 10 17 06 0e 3c 13 11 0c 05 0a 0f 06 11 }
    $b64 = { 17 1d 17 10 01 09 3b 14 16 0b 02 0d 08 01 16 }
    $b65 = { 16 1c 16 11 00 08 3a 15 17 0a 03 0c 09 00 17 }
    $b66 = { 15 1f 15 12 03 0b 39 16 14 09 00 0f 0a 03 14 }
    $b67 = { 14 1e 14 13 02 0a 38 17 15 08 01 0e 0b 02 15 }
    $b68 = { 1b 11 1b 1c 0d 05 37 18 1a 07 0e 01 04 0d 1a }
    $b69 = { 1a 10 1a 1d 0c 04 36 19 1b 06 0f 00 05 0c 1b }
    $b6a = { 19 13 19 1e 0f 07 35 1a 18 05 0c 03 06 0f 18 }
    $b6b = { 18 12 18 1f 0e 06 34 1b 19 04 0d 02 07 0e 19 }
    $b6c = { 1f 15 1f 18 09 01 33 1c 1e 03 0a 05 00 09 1e }
    $b6d = { 1e 14 1e 19 08 00 32 1d 1f 02 0b 04 01 08 1f }
    $b6e = { 1d 17 1d 1a 0b 03 31 1e 1c 01 08 07 02 0b 1c }
    $b6f = { 1c 16 1c 1b 0a 02 30 1f 1d 00 09 06 03 0a 1d }
    $b70 = { 03 09 03 04 15 1d 2f 00 02 1f 16 19 1c 15 02 }
    $b71 = { 02 08 02 05 14 1c 2e 01 03 1e 17 18 1d 14 03 }
    $b72 = { 01 0b 01 06 17 1f 2d 02 00 1d 14 1b 1e 17 00 }
    $b73 = { 00 0a 00 07 16 1e 2c 03 01 1c 15 1a 1f 16 01 }
    $b74 = { 07 0d 07 00 11 19 2b 04 06 1b 12 1d 18 11 06 }
    $b75 = { 06 0c 06 01 10 18 2a 05 07 1a 13 1c 19 10 07 }
    $b76 = { 05 0f 05 02 13 1b 29 06 04 19 10 1f 1a 13 04 }
    $b77 = { 04 0e 04 03 12 1a 28 07 05 18 11 1e 1b 12 05 }
    $b78 = { 0b 01 0b 0c 1d 15 27 08 0a 17 1e 11 14 1d 0a }
    $b79 = { 0a 00 0a 0d 1c 14 26 09 0b 16 1f 10 15 1c 0b }
    $b7a = { 09 03 09 0e 1f 17 25 0a 08 15 1c 13 16 1f 08 }
    $b7b = { 08 02 08 0f 1e 16 24 0b 09 14 1d 12 17 1e 09 }
    $b7c = { 0f 05 0f 08 19 11 23 0c 0e 13 1a 15 10 19 0e }
    $b7d = { 0e 04 0e 09 18 10 22 0d 0f 12 1b 14 11 18 0f }
    $b7e = { 0d 07 0d 0a 1b 13 21 0e 0c 11 18 17 12 1b 0c }
    $b7f = { 0c 06 0c 0b 1a 12 20 0f 0d 10 19 16 13 1a 0d }
    $b80 = { f3 f9 f3 f4 e5 ed df f0 f2 ef e6 e9 ec e5 f2 }
    $b81 = { f2 f8 f2 f5 e4 ec de f1 f3 ee e7 e8 ed e4 f3 }
    $b82 = { f1 fb f1 f6 e7 ef dd f2 f0 ed e4 eb ee e7 f0 }
    $b83 = { f0 fa f0 f7 e6 ee dc f3 f1 ec e5 ea ef e6 f1 }
    $b84 = { f7 fd f7 f0 e1 e9 db f4 f6 eb e2 ed e8 e1 f6 }
    $b85 = { f6 fc f6 f1 e0 e8 da f5 f7 ea e3 ec e9 e0 f7 }
    $b86 = { f5 ff f5 f2 e3 eb d9 f6 f4 e9 e0 ef ea e3 f4 }
    $b87 = { f4 fe f4 f3 e2 ea d8 f7 f5 e8 e1 ee eb e2 f5 }
    $b88 = { fb f1 fb fc ed e5 d7 f8 fa e7 ee e1 e4 ed fa }
    $b89 = { fa f0 fa fd ec e4 d6 f9 fb e6 ef e0 e5 ec fb }
    $b8a = { f9 f3 f9 fe ef e7 d5 fa f8 e5 ec e3 e6 ef f8 }
    $b8b = { f8 f2 f8 ff ee e6 d4 fb f9 e4 ed e2 e7 ee f9 }
    $b8c = { ff f5 ff f8 e9 e1 d3 fc fe e3 ea e5 e0 e9 fe }
    $b8d = { fe f4 fe f9 e8 e0 d2 fd ff e2 eb e4 e1 e8 ff }
    $b8e = { fd f7 fd fa eb e3 d1 fe fc e1 e8 e7 e2 eb fc }
    $b8f = { fc f6 fc fb ea e2 d0 ff fd e0 e9 e6 e3 ea fd }
    $b90 = { e3 e9 e3 e4 f5 fd cf e0 e2 ff f6 f9 fc f5 e2 }
    $b91 = { e2 e8 e2 e5 f4 fc ce e1 e3 fe f7 f8 fd f4 e3 }
    $b92 = { e1 eb e1 e6 f7 ff cd e2 e0 fd f4 fb fe f7 e0 }
    $b93 = { e0 ea e0 e7 f6 fe cc e3 e1 fc f5 fa ff f6 e1 }
    $b94 = { e7 ed e7 e0 f1 f9 cb e4 e6 fb f2 fd f8 f1 e6 }
    $b95 = { e6 ec e6 e1 f0 f8 ca e5 e7 fa f3 fc f9 f0 e7 }
    $b96 = { e5 ef e5 e2 f3 fb c9 e6 e4 f9 f0 ff fa f3 e4 }
    $b97 = { e4 ee e4 e3 f2 fa c8 e7 e5 f8 f1 fe fb f2 e5 }
    $b98 = { eb e1 eb ec fd f5 c7 e8 ea f7 fe f1 f4 fd ea }
    $b99 = { ea e0 ea ed fc f4 c6 e9 eb f6 ff f0 f5 fc eb }
    $b9a = { e9 e3 e9 ee ff f7 c5 ea e8 f5 fc f3 f6 ff e8 }
    $b9b = { e8 e2 e8 ef fe f6 c4 eb e9 f4 fd f2 f7 fe e9 }
    $b9c = { ef e5 ef e8 f9 f1 c3 ec ee f3 fa f5 f0 f9 ee }
    $b9d = { ee e4 ee e9 f8 f0 c2 ed ef f2 fb f4 f1 f8 ef }
    $b9e = { ed e7 ed ea fb f3 c1 ee ec f1 f8 f7 f2 fb ec }
    $b9f = { ec e6 ec eb fa f2 c0 ef ed f0 f9 f6 f3 fa ed }
    $ba0 = { d3 d9 d3 d4 c5 cd ff d0 d2 cf c6 c9 cc c5 d2 }
    $ba1 = { d2 d8 d2 d5 c4 cc fe d1 d3 ce c7 c8 cd c4 d3 }
    $ba2 = { d1 db d1 d6 c7 cf fd d2 d0 cd c4 cb ce c7 d0 }
    $ba3 = { d0 da d0 d7 c6 ce fc d3 d1 cc c5 ca cf c6 d1 }
    $ba4 = { d7 dd d7 d0 c1 c9 fb d4 d6 cb c2 cd c8 c1 d6 }
    $ba5 = { d6 dc d6 d1 c0 c8 fa d5 d7 ca c3 cc c9 c0 d7 }
    $ba6 = { d5 df d5 d2 c3 cb f9 d6 d4 c9 c0 cf ca c3 d4 }
    $ba7 = { d4 de d4 d3 c2 ca f8 d7 d5 c8 c1 ce cb c2 d5 }
    $ba8 = { db d1 db dc cd c5 f7 d8 da c7 ce c1 c4 cd da }
    $ba9 = { da d0 da dd cc c4 f6 d9 db c6 cf c0 c5 cc db }
    $baa = { d9 d3 d9 de cf c7 f5 da d8 c5 cc c3 c6 cf d8 }
    $bab = { d8 d2 d8 df ce c6 f4 db d9 c4 cd c2 c7 ce d9 }
    $bac = { df d5 df d8 c9 c1 f3 dc de c3 ca c5 c0 c9 de }
    $bad = { de d4 de d9 c8 c0 f2 dd df c2 cb c4 c1 c8 df }
    $bae = { dd d7 dd da cb c3 f1 de dc c1 c8 c7 c2 cb dc }
    $baf = { dc d6 dc db ca c2 f0 df dd c0 c9 c6 c3 ca dd }
    $bb0 = { c3 c9 c3 c4 d5 dd ef c0 c2 df d6 d9 dc d5 c2 }
    $bb1 = { c2 c8 c2 c5 d4 dc ee c1 c3 de d7 d8 dd d4 c3 }
    $bb2 = { c1 cb c1 c6 d7 df ed c2 c0 dd d4 db de d7 c0 }
    $bb3 = { c0 ca c0 c7 d6 de ec c3 c1 dc d5 da df d6 c1 }
    $bb4 = { c7 cd c7 c0 d1 d9 eb c4 c6 db d2 dd d8 d1 c6 }
    $bb5 = { c6 cc c6 c1 d0 d8 ea c5 c7 da d3 dc d9 d0 c7 }
    $bb6 = { c5 cf c5 c2 d3 db e9 c6 c4 d9 d0 df da d3 c4 }
    $bb7 = { c4 ce c4 c3 d2 da e8 c7 c5 d8 d1 de db d2 c5 }
    $bb8 = { cb c1 cb cc dd d5 e7 c8 ca d7 de d1 d4 dd ca }
    $bb9 = { ca c0 ca cd dc d4 e6 c9 cb d6 df d0 d5 dc cb }
    $bba = { c9 c3 c9 ce df d7 e5 ca c8 d5 dc d3 d6 df c8 }
    $bbb = { c8 c2 c8 cf de d6 e4 cb c9 d4 dd d2 d7 de c9 }
    $bbc = { cf c5 cf c8 d9 d1 e3 cc ce d3 da d5 d0 d9 ce }
    $bbd = { ce c4 ce c9 d8 d0 e2 cd cf d2 db d4 d1 d8 cf }
    $bbe = { cd c7 cd ca db d3 e1 ce cc d1 d8 d7 d2 db cc }
    $bbf = { cc c6 cc cb da d2 e0 cf cd d0 d9 d6 d3 da cd }
    $bc0 = { b3 b9 b3 b4 a5 ad 9f b0 b2 af a6 a9 ac a5 b2 }
    $bc1 = { b2 b8 b2 b5 a4 ac 9e b1 b3 ae a7 a8 ad a4 b3 }
    $bc2 = { b1 bb b1 b6 a7 af 9d b2 b0 ad a4 ab ae a7 b0 }
    $bc3 = { b0 ba b0 b7 a6 ae 9c b3 b1 ac a5 aa af a6 b1 }
    $bc4 = { b7 bd b7 b0 a1 a9 9b b4 b6 ab a2 ad a8 a1 b6 }
    $bc5 = { b6 bc b6 b1 a0 a8 9a b5 b7 aa a3 ac a9 a0 b7 }
    $bc6 = { b5 bf b5 b2 a3 ab 99 b6 b4 a9 a0 af aa a3 b4 }
    $bc7 = { b4 be b4 b3 a2 aa 98 b7 b5 a8 a1 ae ab a2 b5 }
    $bc8 = { bb b1 bb bc ad a5 97 b8 ba a7 ae a1 a4 ad ba }
    $bc9 = { ba b0 ba bd ac a4 96 b9 bb a6 af a0 a5 ac bb }
    $bca = { b9 b3 b9 be af a7 95 ba b8 a5 ac a3 a6 af b8 }
    $bcb = { b8 b2 b8 bf ae a6 94 bb b9 a4 ad a2 a7 ae b9 }
    $bcc = { bf b5 bf b8 a9 a1 93 bc be a3 aa a5 a0 a9 be }
    $bcd = { be b4 be b9 a8 a0 92 bd bf a2 ab a4 a1 a8 bf }
    $bce = { bd b7 bd ba ab a3 91 be bc a1 a8 a7 a2 ab bc }
    $bcf = { bc b6 bc bb aa a2 90 bf bd a0 a9 a6 a3 aa bd }
    $bd0 = { a3 a9 a3 a4 b5 bd 8f a0 a2 bf b6 b9 bc b5 a2 }
    $bd1 = { a2 a8 a2 a5 b4 bc 8e a1 a3 be b7 b8 bd b4 a3 }
    $bd2 = { a1 ab a1 a6 b7 bf 8d a2 a0 bd b4 bb be b7 a0 }
    $bd3 = { a0 aa a0 a7 b6 be 8c a3 a1 bc b5 ba bf b6 a1 }
    $bd4 = { a7 ad a7 a0 b1 b9 8b a4 a6 bb b2 bd b8 b1 a6 }
    $bd5 = { a6 ac a6 a1 b0 b8 8a a5 a7 ba b3 bc b9 b0 a7 }
    $bd6 = { a5 af a5 a2 b3 bb 89 a6 a4 b9 b0 bf ba b3 a4 }
    $bd7 = { a4 ae a4 a3 b2 ba 88 a7 a5 b8 b1 be bb b2 a5 }
    $bd8 = { ab a1 ab ac bd b5 87 a8 aa b7 be b1 b4 bd aa }
    $bd9 = { aa a0 aa ad bc b4 86 a9 ab b6 bf b0 b5 bc ab }
    $bda = { a9 a3 a9 ae bf b7 85 aa a8 b5 bc b3 b6 bf a8 }
    $bdb = { a8 a2 a8 af be b6 84 ab a9 b4 bd b2 b7 be a9 }
    $bdc = { af a5 af a8 b9 b1 83 ac ae b3 ba b5 b0 b9 ae }
    $bdd = { ae a4 ae a9 b8 b0 82 ad af b2 bb b4 b1 b8 af }
    $bde = { ad a7 ad aa bb b3 81 ae ac b1 b8 b7 b2 bb ac }
    $bdf = { ac a6 ac ab ba b2 80 af ad b0 b9 b6 b3 ba ad }
    $be0 = { 93 99 93 94 85 8d bf 90 92 8f 86 89 8c 85 92 }
    $be1 = { 92 98 92 95 84 8c be 91 93 8e 87 88 8d 84 93 }
    $be2 = { 91 9b 91 96 87 8f bd 92 90 8d 84 8b 8e 87 90 }
    $be3 = { 90 9a 90 97 86 8e bc 93 91 8c 85 8a 8f 86 91 }
    $be4 = { 97 9d 97 90 81 89 bb 94 96 8b 82 8d 88 81 96 }
    $be5 = { 96 9c 96 91 80 88 ba 95 97 8a 83 8c 89 80 97 }
    $be6 = { 95 9f 95 92 83 8b b9 96 94 89 80 8f 8a 83 94 }
    $be7 = { 94 9e 94 93 82 8a b8 97 95 88 81 8e 8b 82 95 }
    $be8 = { 9b 91 9b 9c 8d 85 b7 98 9a 87 8e 81 84 8d 9a }
    $be9 = { 9a 90 9a 9d 8c 84 b6 99 9b 86 8f 80 85 8c 9b }
    $bea = { 99 93 99 9e 8f 87 b5 9a 98 85 8c 83 86 8f 98 }
    $beb = { 98 92 98 9f 8e 86 b4 9b 99 84 8d 82 87 8e 99 }
    $bec = { 9f 95 9f 98 89 81 b3 9c 9e 83 8a 85 80 89 9e }
    $bed = { 9e 94 9e 99 88 80 b2 9d 9f 82 8b 84 81 88 9f }
    $bee = { 9d 97 9d 9a 8b 83 b1 9e 9c 81 88 87 82 8b 9c }
    $bef = { 9c 96 9c 9b 8a 82 b0 9f 9d 80 89 86 83 8a 9d }
    $bf0 = { 83 89 83 84 95 9d af 80 82 9f 96 99 9c 95 82 }
    $bf1 = { 82 88 82 85 94 9c ae 81 83 9e 97 98 9d 94 83 }
    $bf2 = { 81 8b 81 86 97 9f ad 82 80 9d 94 9b 9e 97 80 }
    $bf3 = { 80 8a 80 87 96 9e ac 83 81 9c 95 9a 9f 96 81 }
    $bf4 = { 87 8d 87 80 91 99 ab 84 86 9b 92 9d 98 91 86 }
    $bf5 = { 86 8c 86 81 90 98 aa 85 87 9a 93 9c 99 90 87 }
    $bf6 = { 85 8f 85 82 93 9b a9 86 84 99 90 9f 9a 93 84 }
    $bf7 = { 84 8e 84 83 92 9a a8 87 85 98 91 9e 9b 92 85 }
    $bf8 = { 8b 81 8b 8c 9d 95 a7 88 8a 97 9e 91 94 9d 8a }
    $bf9 = { 8a 80 8a 8d 9c 94 a6 89 8b 96 9f 90 95 9c 8b }
    $bfa = { 89 83 89 8e 9f 97 a5 8a 88 95 9c 93 96 9f 88 }
    $bfb = { 88 82 88 8f 9e 96 a4 8b 89 94 9d 92 97 9e 89 }
    $bfc = { 8f 85 8f 88 99 91 a3 8c 8e 93 9a 95 90 99 8e }
    $bfd = { 8e 84 8e 89 98 90 a2 8d 8f 92 9b 94 91 98 8f }
    $bfe = { 8d 87 8d 8a 9b 93 a1 8e 8c 91 98 97 92 9b 8c }
    $bff = { 8c 86 8c 8b 9a 92 a0 8f 8d 90 99 96 93 9a 8d }

    $c00 = "osascript"
    $c01 = "nr`rbshqu"
    $c02 = "mqcqapkrv"
    $c03 = "lpbp`qjsw"
    $c04 = "kwewgvmtp"
    $c05 = "jvdvfwluq"
    $c06 = "iuguetovr"
    $c07 = "htftdunws"
    $c08 = "g{i{kzax|"
    $c09 = "fzhzj{`y}"
    $c0a = "eykyixcz~"
    $c0b = { 64 78 6a 78 68 79 62 7b 7f }
    $c0c = { 63 7f 6d 7f 6f 7e 65 7c 78 }
    $c0d = { 62 7e 6c 7e 6e 7f 64 7d 79 }
    $c0e = "a}o}m|g~z"
    $c0f = { 60 7c 6e 7c 6c 7d 66 7f 7b }
    $c10 = { 7f 63 71 63 73 62 79 60 64 }
    $c11 = "~bpbrcxae"
    $c12 = "}asaq`{bf"
    $c13 = "|`r`pazcg"
    $c14 = "{gugwf}d`"
    $c15 = "zftfvg|ea"
    $c16 = { 79 65 77 65 75 64 7f 66 62 }
    $c17 = "xdvdte~gc"
    $c18 = "wkyk{jqhl"
    $c19 = "vjxjzkpim"
    $c1a = "ui{iyhsjn"
    $c1b = "thzhxirko"
    $c1c = { 73 6f 7d 6f 7f 6e 75 6c 68 }
    $c1d = "rn|n~otmi"
    $c1e = { 71 6d 7f 6d 7d 6c 77 6e 6a }
    $c1f = "pl~l|mvok"
    $c20 = "OSASCRIPT"
    $c21 = "NR@RBSHQU"
    $c22 = "MQCQAPKRV"
    $c23 = "LPBP@QJSW"
    $c24 = "KWEWGVMTP"
    $c25 = "JVDVFWLUQ"
    $c26 = "IUGUETOVR"
    $c27 = "HTFTDUNWS"
    $c28 = "G[I[KZAX\\"
    $c29 = "FZHZJ[@Y]"
    $c2a = "EYKYIXCZ^"
    $c2b = "DXJXHYB[_"
    $c2c = "C_M_O^E\\X"
    $c2d = "B^L^N_D]Y"
    $c2e = "A]O]M\\G^Z"
    $c2f = "@\\N\\L]F_["
    $c30 = "_CQCSBY@D"
    $c31 = "^BPBRCXAE"
    $c32 = "]ASAQ@[BF"
    $c33 = "\\@R@PAZCG"
    $c34 = "[GUGWF]D@"
    $c35 = "ZFTFVG\\EA"
    $c36 = "YEWEUD_FB"
    $c37 = "XDVDTE^GC"
    $c38 = "WKYK[JQHL"
    $c39 = "VJXJZKPIM"
    $c3a = "UI[IYHSJN"
    $c3b = "THZHXIRKO"
    $c3c = "SO]O_NULH"
    $c3d = "RN\\N^OTMI"
    $c3e = "QM_M]LWNJ"
    $c3f = "PL^L\\MVOK"
    $c40 = "/3!3#2)04"
    $c41 = ".2 2\"3(15"
    $c42 = "-1#1!0+26"
    $c43 = ",0\"0 1*37"
    $c44 = "+7%7'6-40"
    $c45 = "*6$6&7,51"
    $c46 = ")5'5%4/62"
    $c47 = "(4&4$5.73"
    $c48 = "';);+:!8<"
    $c49 = "&:(:*; 9="
    $c4a = "%9+9)8#:>"
    $c4b = "$8*8(9\";?"
    $c4c = "#?-?/>%<8"
    $c4d = "\">,>.?$=9"
    $c4e = "!=/=-<'>:"
    $c4f = " <.<,=&?;"
    $c50 = "?#1#3\"9 $"
    $c51 = ">\"0\"2#8!%"
    $c52 = "=!3!1 ;\"&"
    $c53 = "< 2 0!:#'"
    $c54 = ";'5'7&=$ "
    $c55 = ":&4&6'<%!"
    $c56 = "9%7%5$?&\""
    $c57 = "8$6$4%>'#"
    $c58 = "7+9+;*1(,"
    $c59 = "6*8*:+0)-"
    $c5a = "5);)9(3*."
    $c5b = "4(:(8)2+/"
    $c5c = "3/=/?.5,("
    $c5d = "2.<.>/4-)"
    $c5e = "1-?-=,7.*"
    $c5f = "0,>,<-6/+"
    $c60 = { 0f 13 01 13 03 12 09 10 14 }
    $c61 = { 0e 12 00 12 02 13 08 11 15 }
    $c62 = { 0d 11 03 11 01 10 0b 12 16 }
    $c63 = { 0c 10 02 10 00 11 0a 13 17 }
    $c64 = { 0b 17 05 17 07 16 0d 14 10 }
    $c65 = { 0a 16 04 16 06 17 0c 15 11 }
    $c66 = { 09 15 07 15 05 14 0f 16 12 }
    $c67 = { 08 14 06 14 04 15 0e 17 13 }
    $c68 = { 07 1b 09 1b 0b 1a 01 18 1c }
    $c69 = { 06 1a 08 1a 0a 1b 00 19 1d }
    $c6a = { 05 19 0b 19 09 18 03 1a 1e }
    $c6b = { 04 18 0a 18 08 19 02 1b 1f }
    $c6c = { 03 1f 0d 1f 0f 1e 05 1c 18 }
    $c6d = { 02 1e 0c 1e 0e 1f 04 1d 19 }
    $c6e = { 01 1d 0f 1d 0d 1c 07 1e 1a }
    $c6f = { 00 1c 0e 1c 0c 1d 06 1f 1b }
    $c70 = { 1f 03 11 03 13 02 19 00 04 }
    $c71 = { 1e 02 10 02 12 03 18 01 05 }
    $c72 = { 1d 01 13 01 11 00 1b 02 06 }
    $c73 = { 1c 00 12 00 10 01 1a 03 07 }
    $c74 = { 1b 07 15 07 17 06 1d 04 00 }
    $c75 = { 1a 06 14 06 16 07 1c 05 01 }
    $c76 = { 19 05 17 05 15 04 1f 06 02 }
    $c77 = { 18 04 16 04 14 05 1e 07 03 }
    $c78 = { 17 0b 19 0b 1b 0a 11 08 0c }
    $c79 = { 16 0a 18 0a 1a 0b 10 09 0d }
    $c7a = { 15 09 1b 09 19 08 13 0a 0e }
    $c7b = { 14 08 1a 08 18 09 12 0b 0f }
    $c7c = { 13 0f 1d 0f 1f 0e 15 0c 08 }
    $c7d = { 12 0e 1c 0e 1e 0f 14 0d 09 }
    $c7e = { 11 0d 1f 0d 1d 0c 17 0e 0a }
    $c7f = { 10 0c 1e 0c 1c 0d 16 0f 0b }
    $c80 = { ef f3 e1 f3 e3 f2 e9 f0 f4 }
    $c81 = { ee f2 e0 f2 e2 f3 e8 f1 f5 }
    $c82 = { ed f1 e3 f1 e1 f0 eb f2 f6 }
    $c83 = { ec f0 e2 f0 e0 f1 ea f3 f7 }
    $c84 = { eb f7 e5 f7 e7 f6 ed f4 f0 }
    $c85 = { ea f6 e4 f6 e6 f7 ec f5 f1 }
    $c86 = { e9 f5 e7 f5 e5 f4 ef f6 f2 }
    $c87 = { e8 f4 e6 f4 e4 f5 ee f7 f3 }
    $c88 = { e7 fb e9 fb eb fa e1 f8 fc }
    $c89 = { e6 fa e8 fa ea fb e0 f9 fd }
    $c8a = { e5 f9 eb f9 e9 f8 e3 fa fe }
    $c8b = { e4 f8 ea f8 e8 f9 e2 fb ff }
    $c8c = { e3 ff ed ff ef fe e5 fc f8 }
    $c8d = { e2 fe ec fe ee ff e4 fd f9 }
    $c8e = { e1 fd ef fd ed fc e7 fe fa }
    $c8f = { e0 fc ee fc ec fd e6 ff fb }
    $c90 = { ff e3 f1 e3 f3 e2 f9 e0 e4 }
    $c91 = { fe e2 f0 e2 f2 e3 f8 e1 e5 }
    $c92 = { fd e1 f3 e1 f1 e0 fb e2 e6 }
    $c93 = { fc e0 f2 e0 f0 e1 fa e3 e7 }
    $c94 = { fb e7 f5 e7 f7 e6 fd e4 e0 }
    $c95 = { fa e6 f4 e6 f6 e7 fc e5 e1 }
    $c96 = { f9 e5 f7 e5 f5 e4 ff e6 e2 }
    $c97 = { f8 e4 f6 e4 f4 e5 fe e7 e3 }
    $c98 = { f7 eb f9 eb fb ea f1 e8 ec }
    $c99 = { f6 ea f8 ea fa eb f0 e9 ed }
    $c9a = { f5 e9 fb e9 f9 e8 f3 ea ee }
    $c9b = { f4 e8 fa e8 f8 e9 f2 eb ef }
    $c9c = { f3 ef fd ef ff ee f5 ec e8 }
    $c9d = { f2 ee fc ee fe ef f4 ed e9 }
    $c9e = { f1 ed ff ed fd ec f7 ee ea }
    $c9f = { f0 ec fe ec fc ed f6 ef eb }
    $ca0 = { cf d3 c1 d3 c3 d2 c9 d0 d4 }
    $ca1 = { ce d2 c0 d2 c2 d3 c8 d1 d5 }
    $ca2 = { cd d1 c3 d1 c1 d0 cb d2 d6 }
    $ca3 = { cc d0 c2 d0 c0 d1 ca d3 d7 }
    $ca4 = { cb d7 c5 d7 c7 d6 cd d4 d0 }
    $ca5 = { ca d6 c4 d6 c6 d7 cc d5 d1 }
    $ca6 = { c9 d5 c7 d5 c5 d4 cf d6 d2 }
    $ca7 = { c8 d4 c6 d4 c4 d5 ce d7 d3 }
    $ca8 = { c7 db c9 db cb da c1 d8 dc }
    $ca9 = { c6 da c8 da ca db c0 d9 dd }
    $caa = { c5 d9 cb d9 c9 d8 c3 da de }
    $cab = { c4 d8 ca d8 c8 d9 c2 db df }
    $cac = { c3 df cd df cf de c5 dc d8 }
    $cad = { c2 de cc de ce df c4 dd d9 }
    $cae = { c1 dd cf dd cd dc c7 de da }
    $caf = { c0 dc ce dc cc dd c6 df db }
    $cb0 = { df c3 d1 c3 d3 c2 d9 c0 c4 }
    $cb1 = { de c2 d0 c2 d2 c3 d8 c1 c5 }
    $cb2 = { dd c1 d3 c1 d1 c0 db c2 c6 }
    $cb3 = { dc c0 d2 c0 d0 c1 da c3 c7 }
    $cb4 = { db c7 d5 c7 d7 c6 dd c4 c0 }
    $cb5 = { da c6 d4 c6 d6 c7 dc c5 c1 }
    $cb6 = { d9 c5 d7 c5 d5 c4 df c6 c2 }
    $cb7 = { d8 c4 d6 c4 d4 c5 de c7 c3 }
    $cb8 = { d7 cb d9 cb db ca d1 c8 cc }
    $cb9 = { d6 ca d8 ca da cb d0 c9 cd }
    $cba = { d5 c9 db c9 d9 c8 d3 ca ce }
    $cbb = { d4 c8 da c8 d8 c9 d2 cb cf }
    $cbc = { d3 cf dd cf df ce d5 cc c8 }
    $cbd = { d2 ce dc ce de cf d4 cd c9 }
    $cbe = { d1 cd df cd dd cc d7 ce ca }
    $cbf = { d0 cc de cc dc cd d6 cf cb }
    $cc0 = { af b3 a1 b3 a3 b2 a9 b0 b4 }
    $cc1 = { ae b2 a0 b2 a2 b3 a8 b1 b5 }
    $cc2 = { ad b1 a3 b1 a1 b0 ab b2 b6 }
    $cc3 = { ac b0 a2 b0 a0 b1 aa b3 b7 }
    $cc4 = { ab b7 a5 b7 a7 b6 ad b4 b0 }
    $cc5 = { aa b6 a4 b6 a6 b7 ac b5 b1 }
    $cc6 = { a9 b5 a7 b5 a5 b4 af b6 b2 }
    $cc7 = { a8 b4 a6 b4 a4 b5 ae b7 b3 }
    $cc8 = { a7 bb a9 bb ab ba a1 b8 bc }
    $cc9 = { a6 ba a8 ba aa bb a0 b9 bd }
    $cca = { a5 b9 ab b9 a9 b8 a3 ba be }
    $ccb = { a4 b8 aa b8 a8 b9 a2 bb bf }
    $ccc = { a3 bf ad bf af be a5 bc b8 }
    $ccd = { a2 be ac be ae bf a4 bd b9 }
    $cce = { a1 bd af bd ad bc a7 be ba }
    $ccf = { a0 bc ae bc ac bd a6 bf bb }
    $cd0 = { bf a3 b1 a3 b3 a2 b9 a0 a4 }
    $cd1 = { be a2 b0 a2 b2 a3 b8 a1 a5 }
    $cd2 = { bd a1 b3 a1 b1 a0 bb a2 a6 }
    $cd3 = { bc a0 b2 a0 b0 a1 ba a3 a7 }
    $cd4 = { bb a7 b5 a7 b7 a6 bd a4 a0 }
    $cd5 = { ba a6 b4 a6 b6 a7 bc a5 a1 }
    $cd6 = { b9 a5 b7 a5 b5 a4 bf a6 a2 }
    $cd7 = { b8 a4 b6 a4 b4 a5 be a7 a3 }
    $cd8 = { b7 ab b9 ab bb aa b1 a8 ac }
    $cd9 = { b6 aa b8 aa ba ab b0 a9 ad }
    $cda = { b5 a9 bb a9 b9 a8 b3 aa ae }
    $cdb = { b4 a8 ba a8 b8 a9 b2 ab af }
    $cdc = { b3 af bd af bf ae b5 ac a8 }
    $cdd = { b2 ae bc ae be af b4 ad a9 }
    $cde = { b1 ad bf ad bd ac b7 ae aa }
    $cdf = { b0 ac be ac bc ad b6 af ab }
    $ce0 = { 8f 93 81 93 83 92 89 90 94 }
    $ce1 = { 8e 92 80 92 82 93 88 91 95 }
    $ce2 = { 8d 91 83 91 81 90 8b 92 96 }
    $ce3 = { 8c 90 82 90 80 91 8a 93 97 }
    $ce4 = { 8b 97 85 97 87 96 8d 94 90 }
    $ce5 = { 8a 96 84 96 86 97 8c 95 91 }
    $ce6 = { 89 95 87 95 85 94 8f 96 92 }
    $ce7 = { 88 94 86 94 84 95 8e 97 93 }
    $ce8 = { 87 9b 89 9b 8b 9a 81 98 9c }
    $ce9 = { 86 9a 88 9a 8a 9b 80 99 9d }
    $cea = { 85 99 8b 99 89 98 83 9a 9e }
    $ceb = { 84 98 8a 98 88 99 82 9b 9f }
    $cec = { 83 9f 8d 9f 8f 9e 85 9c 98 }
    $ced = { 82 9e 8c 9e 8e 9f 84 9d 99 }
    $cee = { 81 9d 8f 9d 8d 9c 87 9e 9a }
    $cef = { 80 9c 8e 9c 8c 9d 86 9f 9b }
    $cf0 = { 9f 83 91 83 93 82 99 80 84 }
    $cf1 = { 9e 82 90 82 92 83 98 81 85 }
    $cf2 = { 9d 81 93 81 91 80 9b 82 86 }
    $cf3 = { 9c 80 92 80 90 81 9a 83 87 }
    $cf4 = { 9b 87 95 87 97 86 9d 84 80 }
    $cf5 = { 9a 86 94 86 96 87 9c 85 81 }
    $cf6 = { 99 85 97 85 95 84 9f 86 82 }
    $cf7 = { 98 84 96 84 94 85 9e 87 83 }
    $cf8 = { 97 8b 99 8b 9b 8a 91 88 8c }
    $cf9 = { 96 8a 98 8a 9a 8b 90 89 8d }
    $cfa = { 95 89 9b 89 99 88 93 8a 8e }
    $cfb = { 94 88 9a 88 98 89 92 8b 8f }
    $cfc = { 93 8f 9d 8f 9f 8e 95 8c 88 }
    $cfd = { 92 8e 9c 8e 9e 8f 94 8d 89 }
    $cfe = { 91 8d 9f 8d 9d 8c 97 8e 8a }
    $cff = { 90 8c 9e 8c 9c 8d 96 8f 8b }

  condition:
    BINARYALERT_Macho_PRIVATE and (any of ($a*) or (any of ($b*) and any of ($c*))) and filesize < 2MB
}
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

38a361b2-dfef-476b-adc0-b8d23a9bb665
Propose edits, view related rules, and engage with the community through comments.
Executable code, not a declarative rule
This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.
Rejected pattern present
[[ reason ]]
What does this mean?
Format & documentation suggestions
Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.
[[ reason ]]
What do these messages mean?
[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion
