Skip to content
yararules.org
Menu

YARA rules for Sparrow Door

9 rules from 2 sources detect Sparrow Door. Rules are ranked by YARA-X compatibility, licence (full text first), score and quality. Mostly: Malware.

Family grouping is heuristic: check each rule's description.

Scan files with all Sparrow Door rulesSearch rules

  • MALPEDIA_Win_Sparrow_Door_Auto

    autogenerated rule brought to you by yara-signator

    MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04
  • NCSC_Sparrowdoor_ApipatchMetadata only

    Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory.

    MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
  • NCSC_Sparrowdoor_ClipshotMetadata only

    The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file.

    MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
  • NCSC_Sparrowdoor_ConfigMetadata only

    Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key.

    MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
  • NCSC_Sparrowdoor_LoaderMetadata only

    Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant.

    MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
  • NCSC_Sparrowdoor_ShellcodeMetadata only

    Targets code features of the reflective loader for SparrowDoor. Targeting in memory.

    MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
  • NCSC_Sparrowdoor_Sleep_RoutineMetadata only

    SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header.

    MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
  • NCSC_Sparrowdoor_XorMetadata only

    Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory.

    MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
  • NCSC_Sparrowdoor_StringsMetadata only

    Strings that appear in SparrowDoor’s backdoor. Targeting in memory.

    MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28