(YARA) YARA_XOR_Hunt

Download Raw

rule XOR_hunt
{
  meta:
    author = "Thomas Roccia | @fr0gger_"
    description = "100DaysOfYara - An attempt to catch malicious/suspicious pe file using xor for some data"
    status = "experimental"

  strings:
    $s1 = "http://" xor
    $s2 = "https://" xor
    $s3 = "ftp://" xor
    $s4 = "This program cannot be run in DOS mode" xor
    $s5 = "Mozilla/5.0" xor
    $s6 = "cmd /c" xor
    $s7 = "-ep bypass" xor

  condition:
     uint16(0) == 0x5A4D and any of them
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
XOR Operation U0701 E1027.m02

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
cat.exe 1 2025-05-30 1 day, 1 hour ago
5.exe 9 2025-05-30 1 day, 8 hours ago
q.apk.exe 8 2025-05-30 1 day, 8 hours ago
loader.exe 8 2025-05-29 2 days, 18 hours ago
cobalt_sample.exe 13 2025-05-25 1 week ago
flushes.exe 7 2025-05-24 1 week ago
CursorFreeVIP_1.11.01_windows.exe 4 2025-05-19 1 week, 5 days ago
unload_sysmon_x64.exe 6 2025-05-18 1 week, 6 days ago
familyhook hackvshack.net.dll 5 2025-05-15 2 weeks, 2 days ago
DP_Simple_Player.exe 5 2025-05-13 2 weeks, 4 days ago
View All

Created

January 4, 2024

Last Revised

January 4, 2024