(YARA) YARA_XOR_Hunt

Download Raw

rule XOR_hunt
{
  meta:
    author = "Thomas Roccia | @fr0gger_"
    description = "100DaysOfYara - An attempt to catch malicious/suspicious pe file using xor for some data"
    status = "experimental"

  strings:
    $s1 = "http://" xor
    $s2 = "https://" xor
    $s3 = "ftp://" xor
    $s4 = "This program cannot be run in DOS mode" xor
    $s5 = "Mozilla/5.0" xor
    $s6 = "cmd /c" xor
    $s7 = "-ep bypass" xor

  condition:
     uint16(0) == 0x5A4D and any of them
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
XOR Operation U0701 E1027.m02

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
000.exe 7 2025-10-06 17 hours, 49 minutes ago
Fb2EDL.exe 5 2025-10-05 1 day, 2 hours ago
a.exe 7 2025-10-03 3 days ago
ida_keygen_v2 updated.exe 3 2025-10-03 3 days, 1 hour ago
ri_setup_full4134_UjiwJcEu.exe 7 2025-10-02 4 days, 11 hours ago
program.exe 6 2025-10-01 5 days, 16 hours ago
LoadThatPe.exe 5 2025-09-29 1 week ago
TV Logo Changer v1.1.0.exe 5 2025-09-28 1 week, 1 day ago
Lab01-04.exe 6 2025-09-26 1 week, 3 days ago
Lab01-02 4 2025-09-26 1 week, 3 days ago
View All

Created

January 4, 2024

Last Revised

January 4, 2024