YARA-Regeln für Sparrow Door
9 Regeln aus 2 Quellen erkennen Sparrow Door. Sortiert nach YARA-X-Kompatibilität, Lizenz (Volltext zuerst), Score und Qualität. Überwiegend: Malware.
Die Gruppierung nach Familie ist heuristisch: Prüfen Sie die Beschreibung jeder Regel.
Dateien mit allen Sparrow Door-Regeln scannenRegeln suchen
autogenerated rule brought to you by yara-signator
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04- NCSC_Sparrowdoor_ApipatchNur Metadaten
Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_ClipshotNur Metadaten
The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_ConfigNur Metadaten
Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_LoaderNur Metadaten
Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_ShellcodeNur Metadaten
Targets code features of the reflective loader for SparrowDoor. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_Sleep_RoutineNur Metadaten
SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_XorNur Metadaten
Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_StringsNur Metadaten
Strings that appear in SparrowDoor’s backdoor. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28