(YARA) YARA_XOR_Hunt
rule XOR_hunt
{
meta:
author = "Thomas Roccia | @fr0gger_"
description = "100DaysOfYara - An attempt to catch malicious/suspicious pe file using xor for some data"
status = "experimental"
strings:
$s1 = "http://" xor
$s2 = "https://" xor
$s3 = "ftp://" xor
$s4 = "This program cannot be run in DOS mode" xor
$s5 = "Mozilla/5.0" xor
$s6 = "cmd /c" xor
$s7 = "-ep bypass" xor
condition:
uint16(0) == 0x5A4D and any of them
}
Associated Techniques
Technique Name | Technique ID's | Snippet(s) | OS |
---|---|---|---|
XOR Operation | U0701 E1027.m02 |
Matching Samples 10 most recent
Sample Name | Matching Techniques | First Seen | Last Seen |
---|---|---|---|
Scalper_Telegram@Val1312q.dll | 8 | 2025-10-21 | 1 day, 19 hours ago |
NinzaCoUnlocker.dll | 1 | 2025-10-21 | 1 day, 19 hours ago |
cat.exe | 3 | 2025-10-20 | 2 days, 12 hours ago |
DgtAutoTTSMM.exe | 3 | 2025-10-20 | 2 days, 14 hours ago |
MBSetup (3).exe | 6 | 2025-10-18 | 4 days, 10 hours ago |
HogwartsLegacy.exe | 7 | 2025-10-16 | 6 days, 8 hours ago |
sb16du.exe | 5 | 2025-10-14 | 1 week, 1 day ago |
sb16du.exe | 4 | 2025-10-14 | 1 week, 1 day ago |
000.exe | 7 | 2025-10-06 | 2 weeks, 2 days ago |
Fb2EDL.exe | 5 | 2025-10-05 | 2 weeks, 3 days ago |
Created
January 4, 2024
Last Revised
January 4, 2024