YARA · NCSC (via Open-Source-YARA-rules)
NCSC_Sparrowdoor_Config
Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key.
- Author
- NCSC
- Date
- 2022-02-28
- Modified
- 2022-07-06
- Score / Quality
- 75 / 80
What this rule detects
Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key.
Associated malware family: Sparrow Door.
It has no patterns: the condition alone decides (modules, file properties or other rules).
Summary generated from the rule's metadata and condition.
Rule source
Rule text not reproduced
This rule comes from NCSC (via Open-Source-YARA-rules), which does not grant a licence to redistribute its rules (No licence (all rights reserved)). We show its metadata only. Read the original rule upstream:
Sample hashes
Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).
- c1890a6447c991880467b86a013dbeaa66cc615f
Licence & attribution
Author: NCSC
Source repository: NCSC (via Open-Source-YARA-rules) @ ec0056f767
Licence: No licence (all rights reserved) (repository licence)
Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.
Rule id: 16eec5b6-c77a-585d-88f3-2c86abdbf2bd
Tags:FILE
Related rules
- NCSC_Sparrowdoor_ApipatchMetadata onlyMalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
- NCSC_Sparrowdoor_ClipshotMetadata onlyMalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
- NCSC_Sparrowdoor_LoaderMetadata onlyMalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
- NCSC_Sparrowdoor_ShellcodeMetadata onlyMalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
- NCSC_Sparrowdoor_Sleep_RoutineMetadata onlyMalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
- NCSC_Sparrowdoor_XorMetadata onlyMalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
- NCSC_Sparrowdoor_StringsMetadata onlyMalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
- MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04