WITHSECURELABS_LOOKVALPS

rule WITHSECURELABS_LOOKVALPS
{
	meta:
		description = "Detects common strings found across samples obfuscated with LOOKVALPS"
		author = "WithSecure"
		id = "9dec92aa-123c-5c32-beb6-308b8c936ca4"
		date = "2026-05-28"
		modified = "2026-05-28"
		reference = "https://github.com/WithSecureLabs/iocs"
		source_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/GREYVIBE/greyvibe.yara#L26-L36"
		license_url = "https://github.com/WithSecureLabs/iocs/blob/1a8384468dd292c6d2c5114c32e42dc0da1f5ae1/LICENSE"
		logic_hash = "ef694f6fee59578d9ccd909ca506771ec5cda94a64232895558cc141a09cf6e3"
		score = 75
		quality = 75
		tags = ""

	strings:
		$a = "currentValue = $LookupTable" ascii wide
		$b = "foreach($b in $data){$d+=[char]($b -bxor $key)}" ascii wide

	condition:
		any of them
}