(YARA) YARA_XOR_Hunt

Download Raw

rule XOR_hunt
{
  meta:
    author = "Thomas Roccia | @fr0gger_"
    description = "100DaysOfYara - An attempt to catch malicious/suspicious pe file using xor for some data"
    status = "experimental"

  strings:
    $s1 = "http://" xor
    $s2 = "https://" xor
    $s3 = "ftp://" xor
    $s4 = "This program cannot be run in DOS mode" xor
    $s5 = "Mozilla/5.0" xor
    $s6 = "cmd /c" xor
    $s7 = "-ep bypass" xor

  condition:
     uint16(0) == 0x5A4D and any of them
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
XOR Operation U0701 E1027.m02

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
hmpalert.exe 8 2025-04-20 1 day, 7 hours ago
DarkComet Remover 2 Portable.exe 4 2025-04-19 1 day, 13 hours ago
cs2.exe 4 2025-04-19 2 days, 2 hours ago
DS4Windows.exe 9 2025-04-19 2 days, 11 hours ago
d2d1.dll 4 2025-04-18 3 days, 2 hours ago
xwizard.exe 6 2025-04-18 3 days, 2 hours ago
WdBoot.sys 7 2025-04-18 3 days, 2 hours ago
GET_ID.vmp.exe 2 2025-04-16 4 days, 17 hours ago
Key Maker.exe 1 2025-04-16 4 days, 17 hours ago
output.exe 4 2025-04-16 5 days, 6 hours ago
View All

Created

January 4, 2024

Last Revised

January 4, 2024