NCSC (via Open-Source-YARA-rules)

Repository

https://github.com/mikesxrs/Open-Source-YARA-rules

Commit

ec0056f767db98bf6d5fd63877ad51fb54d350e9

Abgerufen

2026-09-27

Lizenz

No licence (all rights reserved)

Veröffentlicht

Metadaten

Begründung

Unlicensed mirror repository and no licence in the rules: metadata and upstream link only.

Regeln von NCSC (via Open-Source-YARA-rules)

• NCSC_Sparrowdoor_ApipatchNur Metadaten

  Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_ClipshotNur Metadaten

  The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_ConfigNur Metadaten

  Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_LoaderNur Metadaten

  Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_ShellcodeNur Metadaten

  Targets code features of the reflective loader for SparrowDoor. Targeting in memory.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_Sleep_RoutineNur Metadaten

  SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_XorNur Metadaten

  Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_StringsNur Metadaten

  Strings that appear in SparrowDoor’s backdoor. Targeting in memory.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28