(YARA) YARA_XOR_Hunt

Download Raw

rule XOR_hunt
{
  meta:
    author = "Thomas Roccia | @fr0gger_"
    description = "100DaysOfYara - An attempt to catch malicious/suspicious pe file using xor for some data"
    status = "experimental"

  strings:
    $s1 = "http://" xor
    $s2 = "https://" xor
    $s3 = "ftp://" xor
    $s4 = "This program cannot be run in DOS mode" xor
    $s5 = "Mozilla/5.0" xor
    $s6 = "cmd /c" xor
    $s7 = "-ep bypass" xor

  condition:
     uint16(0) == 0x5A4D and any of them
}

Associated Techniques

Technique Name Technique ID's Snippet(s) OS
XOR Operation U0701 E1027.m02

Matching Samples 10 most recent

Sample Name Matching Techniques First Seen Last Seen
Starter.exe 8 2025-03-26 4 days, 12 hours ago
br2c41.tmp 8 2025-03-26 4 days, 20 hours ago
zctzqljql.exe 1 2025-03-25 5 days, 8 hours ago
mmmm.exe 7 2025-03-23 1 week ago
FBH.dll 10 2025-03-22 1 week, 1 day ago
get_hwid.exe 4 2025-03-15 2 weeks, 1 day ago
MS-RPRN.exe 7 2025-03-12 2 weeks, 4 days ago
RustPatchlessCLRLoader.exe 8 2025-03-07 3 weeks, 2 days ago
OutlastDev hackvshack.net.dll 4 2025-03-02 4 weeks ago
Ragexe.exe 3 2025-03-01 4 weeks, 2 days ago
View All

Created

January 4, 2024

Last Revised

January 4, 2024