YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_EXPL_RAR_Archive_With_Path_Traversal_Aug25

Detects RAR archives abused for path traversal like CVE-2025-8088 and CVE-2025-6218

ExploitSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: Arnim Rupp (Nextron Systems)
Date: 2025-08-11
Modified: 2026-05-15
Score / Quality: 70 / 85

What this rule detects

Detects RAR archives abused for path traversal like CVE-2025-8088 and CVE-2025-6218

It defines 3 patterns (3 text, 0 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

expl-rar-archive-with-path-traversal-aug25.yarDetection Rule License 1.1

rule SIGNATURE_BASE_EXPL_RAR_Archive_With_Path_Traversal_Aug25 : CVE_2025_8088 CVE_2025_6218 FILE
{
	meta:
		description = "Detects RAR archives abused for path traversal like CVE-2025-8088 and CVE-2025-6218"
		author = "Arnim Rupp (Nextron Systems)"
		id = "641c7e18-a887-5367-8584-2dc41c7ead53"
		date = "2025-08-11"
		modified = "2026-05-15"
		reference = "https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/exploit_rar_archive_with_path_traversal_aug25.yar#L1-L25"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "2a8fafa01f6d3863c87f20905736ebab28d6a5753ab708760c0b6cf3970828c3"
		hash = "dfab2f25c9d870f30bbc4abb873d155cf4904ece536714fb9cd32b2e0126dfab"
		hash = "107f3d1fe28b67397d21a6acca5b6b35def1aeb62a67bc10109bd73d567f9806"
		logic_hash = "eedc5cb144e516a1d50aa8cb2fa386cb44d4c6c2de89267dc1c4d14da972069d"
		score = 70
		quality = 85
		tags = "CVE-2025-8088, CVE-2025-6218, FILE"

	strings:
		$s1 = "..\\\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
		$s2 = "..//../AppData/Roaming/Microsoft/Windows/Start Menu"
		$s3 = "/.. /.. /AppData/Roaming/Microsoft/Windows/Start Menu/"

	condition:
		1 of ( $s* ) and ( uint16( 0 ) == 0x4B50 or int32 ( 0 ) == 0x21726152 )
}

Strings (3 patterns)

Identifier	Type	Value
$s1	text	"..\\\\..\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu"
$s2	text	"..//../AppData/Roaming/Microsoft/Windows/Start Menu"
$s3	text	"/.. /.. /AppData/Roaming/Microsoft/Windows/Start Menu/"

Condition

1 of ( $s* ) and ( uint16( 0 ) == 0x4B50 or int32 ( 0 ) == 0x21726152 )

In plain words (Heuristic)

The file must start with “PK” — a ZIP archive (also Office Open XML, JAR, APK).
At least 1 patterns in ( $s* ) must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/#the-discovery-of-cve-2025-8088

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

2a8fafa01f6d3863c87f20905736ebab28d6a5753ab708760c0b6cf3970828c3
dfab2f25c9d870f30bbc4abb873d155cf4904ece536714fb9cd32b2e0126dfab
107f3d1fe28b67397d21a6acca5b6b35def1aeb62a67bc10109bd73d567f9806

Licence & attribution

Author: Arnim Rupp (Nextron Systems)

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 641c7e18-a887-5367-8584-2dc41c7ead53

Tags:CVE_2025_8088 CVE_2025_6218 FILE