Skip to content
yararules.org
Menu

YARA · Cod3nym detection-rules

COD3NYM_SUSP_OBF_NET_Reactor_Indicators_Jan24

Detects indicators of .NET Reactors managed obfuscation. Reactor is a commercial obfuscation solution, pirated versions are often abused by threat actors.

Suspicious / huntingCod3nym detection-rulesDetection Rule License 1.1Compiles with YARA-X
Author
Jonathan Peters
Date
2024-01-09
Modified
2024-01-12
Score / Quality
65 / 80

What this rule detects

Detects indicators of .NET Reactors managed obfuscation. Reactor is a commercial obfuscation solution, pirated versions are often abused by threat actors.

Targets: Windows PE.

It defines 3 patterns (0 text, 3 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
susp-obf-net-reactor-indicators-jan24.yarDetection Rule License 1.1
rule COD3NYM_SUSP_OBF_NET_Reactor_Indicators_Jan24 : FILE
{
	meta:
		description = "Detects indicators of .NET Reactors managed obfuscation. Reactor is a commercial obfuscation solution, pirated versions are often abused by threat actors."
		author = "Jonathan Peters"
		id = "8dc07bbd-cbeb-5214-a27a-555a0d396197"
		date = "2024-01-09"
		modified = "2024-01-12"
		reference = "https://www.eziriz.com/dotnet_reactor.htm"
		source_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/yara/dotnet/obf_net_reactor.yar#L18-L34"
		license_url = "https://github.com/cod3nym/detection-rules//blob/86a04c4594cb48895192aad4af164f21f568c136/LICENSE.md"
		hash = "be842a9de19cfbf42ea5a94e3143d58390a1abd1e72ebfec5deeb8107dddf038"
		logic_hash = "40a03eb487e2c02a032c4bfb51580dbb764e0a49ceee5ae92c54a5ee3ede9696"
		score = 65
		quality = 80
		tags = "FILE"

	strings:
		$ = { 33 7B 00 [9] 00 2D 00 [9] 00 2D 00 [9] 00 2D 00 [9] 00 7D 00 }
		$ = { 3C 50 72 69 76 61 74 65 49 6D 70 6C 65 6D 65 6E 74 61 74 69 6F 6E 44 65 74 61 69 6C 73 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D }
		$ = { 3C 4D 6F 64 75 6C 65 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D }

	condition:
		uint16( 0 ) == 0x5a4d and 2 of them
}

Strings (3 patterns)

IdentifierTypeValueModifiers
$hex{ 33 7B 00 [9] 00 2D 00 [9] 00 2D 00 [9] 00 2D 00 [9] 00 7D 00 }
$hex{ 3C 50 72 69 76 61 74 65 49 6D 70 6C 65 6D 65 6E 74 61 74 69 6F 6E 44 65 74 61 69 6C 73 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D }
$hex{ 3C 4D 6F 64 75 6C 65 3E 7B [8] 2D [4] 2D [4] 2D [4] 2D [12] 7D }

Condition

uint16( 0 ) == 0x5a4d and 2 of them

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 2 patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • be842a9de19cfbf42ea5a94e3143d58390a1abd1e72ebfec5deeb8107dddf038

Licence & attribution

Author: Jonathan Peters

Source repository: Cod3nym detection-rules @ 86a04c4594

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 8dc07bbd-cbeb-5214-a27a-555a0d396197

Tags:FILE

Related rules