Skip to content
yararules.org
Menu

YARA · dr4k0nia yara-rules

DR4K0NIA_Msil_Susp_Obf_Antidump

No description has been set in the source file - Dr4k0nia

Suspicious / huntingdr4k0nia yara-rulesDetection Rule License 1.1Compiles with YARA-X
Author
dr4k0nia
Date
2023-12-03
Modified
2023-03-13
Score / Quality
65 / 85

What this rule detects

No description has been set in the source file - Dr4k0nia

Targets: Windows PE, .NET assembly.

It defines 6 patterns (3 text, 3 hex, 0 regex). YARA modules used: dotnet.

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

Includes the imports needed to compile it on its own.

msil-susp-obf-antidump.yarDetection Rule License 1.1
import "dotnet"

rule DR4K0NIA_Msil_Susp_Obf_Antidump : FILE
{
	meta:
		description = "No description has been set in the source file - Dr4k0nia"
		author = "dr4k0nia"
		id = "d9217ade-a016-548e-b63f-f6ee78ff8775"
		date = "2023-12-03"
		modified = "2023-03-13"
		reference = "https://github.com/dr4k0nia/yara-rules"
		source_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/dotnet/msil_susp_obf_antidump.yar#L7-L39"
		license_url = "https://github.com/dr4k0nia/yara-rules/blob/4b10f9b79a4cfb3ec9cb5675f32cc7ee6885fbd8/LICENSE.md"
		hash = "ef7bb2464a2b430aa98bd65a1a40b851b57cb909ac0aea3e53729c0ff900fa42"
		logic_hash = "18cfc720f54b2178398f8214591a3fb777ea11e67a8a6d2ce26cc4891a62fd35"
		score = 65
		quality = 85
		tags = "FILE"
		version = "1.0"

	strings:
		$import0 = "ZeroMemory"
		$import1 = "VirtualProtect"
		$importt2 = "GetCurrentProcess"
		$array0 = {08 00 00 00 0c 00 00 00 10 00 00 00 14 00 00 00
		18 00 00 00 1c 00 00 00 24 00 00 00}
		$array1 = {04 00 00 00 16 00 00 00 18 00 00 00 40 00 00 00
		42 00 00 00 44 00 00 00 46 00 00 00 48 00 00 00
		4a 00 00 00 4c 00 00 00 5c 00 00 00 5e 00 00 00}
		$array2 = {00 00 00 00 08 00 00 00 0c 00 00 00 10 00 00 00
		16 00 00 00 1c 00 00 00 20 00 00 00 28 00 00 00
		2c 00 00 00 34 00 00 00 3c 00 00 00 4c 00 00 00
		50 00 00 00 54 00 00 00 58 00 00 00 60 00 00 00
		64 00 00 00 68 00 00 00 6c 00 00 00 70 00 00 00
		74 00 00 00 04 01 00 00 08 01 00 00 0c 01 00 00
		10 01 00 00 14 01 00 00 1c 01 00 00}

	condition:
		uint16( 0 ) == 0x5a4d and dotnet.is_dotnet and all of them
}

Strings (6 patterns)

IdentifierTypeValueModifiers
$import0text"ZeroMemory"
$import1text"VirtualProtect"
$importt2text"GetCurrentProcess"
$array0hex{08 00 00 00 0c 00 00 00 10 00 00 00 14 00 00 00 18 00 00 00 1c 00 00 00 24 00 00 00}
$array1hex{04 00 00 00 16 00 00 00 18 00 00 00 40 00 00 00 42 00 00 00 44 00 00 00 46 00 00 00 48 00 00 00 4a 00 00 00 4c 00 00 00 5c 00 00 00 5e 00 00 00}
$array2hex{00 00 00 00 08 00 00 00 0c 00 00 00 10 00 00 00 16 00 00 00 1c 00 00 00 20 00 00 00 28 00 00 00 2c 00 00 00 34 00 00 00 3c 00 00 00 4c 00 00 00 50 00 00 …

Condition

uint16( 0 ) == 0x5a4d and dotnet.is_dotnet and all of them

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • All patterns in the rule must match.
  • Uses the dotnet module.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • ef7bb2464a2b430aa98bd65a1a40b851b57cb909ac0aea3e53729c0ff900fa42

Licence & attribution

Author: dr4k0nia

Source repository: dr4k0nia yara-rules @ 4b10f9b79a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: d9217ade-a016-548e-b63f-f6ee78ff8775

Metadata

version1.0

Tags:FILE

Related rules