Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_Mal_Babbleloader_Win_Jan24

This rule detects intrinsic patterns of BabbleLoader.

MalwareSignature Base (Florian Roth / Nextron)Creative Commons Attribution 4.0Compiles with YARA-X
Author
0x0d4y
Date
2025-01-27
Modified
2026-05-15
Score / Quality
100 / 85

What this rule detects

This rule detects intrinsic patterns of BabbleLoader.

Targets: Windows PE.

It defines 5 patterns (0 text, 5 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
mal-babbleloader-win-jan24.yarCreative Commons Attribution 4.0
rule SIGNATURE_BASE_Mal_Babbleloader_Win_Jan24 : FILE
{
	meta:
		description = "This rule detects intrinsic patterns of BabbleLoader."
		author = "0x0d4y"
		id = "b2f18ab3-b4df-4e2f-aa23-de8694beb221"
		date = "2025-01-27"
		modified = "2026-05-15"
		reference = "https://0x0d4y.blog/babbleloader-technical-malware-analysis/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_babbleloader_win_jan24.yar#L1-L24"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "fa3d03c319a7597712eeff1338dabf92"
		logic_hash = "d4f7915146b1f3fe50febc231247e14323e9d68a94b2b9c8149a5727c06162ca"
		score = 100
		quality = 85
		tags = "FILE"
		license = "CC BY 4.0"
		rule_matching_tlp = "TLP:WHITE"
		rule_sharing_tlp = "TLP:WHITE"

	strings:
		$str_decryption_algorithm = { 48 63 44 24 ?? 48 8b 4c 24 ?? 0f b6 04 ?? 33 44 ?? ?? 0f b6 4c ?? ?? d2 c8 48 63 4c ?? ?? 48 8b 54 ?? ?? 88 04 0a 6b 44 24 ?? ?? 89 44 ?? ?? 8b 44 24 ?? ff c0 89 44 24 }
		$hashing_algorithm = { 48 8b 44 24 ?? 0f be ?? 89 44 24 ?? 8b 44 24 ?? 89 44 24 ?? 48 8b 44 24 ?? 48 ff c0 48 89 44 24 ?? 83 7c 24 08 ?? ?? ?? 8b 44 24 ?? 8b 0c ?? 03 c8 8b c1 89 04 24 8b 44 24 ?? 05 ?? ?? ?? ?? 8b 0c 24 0f af c8 8b c1 89 04 }
		$halos_gate = { 48 8b 44 24 ?? 0f b6 ?? 83 f8 4c 0f ?? ?? ?? ?? ?? 48 8b 44 ?? ?? 0f b6 ?? ?? 3d 8b ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 3d d1 ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 3d b8 ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 85 c0 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 85c0 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 88 44 ?? ?? 48 8b 44 24 ?? 0f b6 40 ?? 88 44 ?? ?? 0f b6 44 ?? ?? c1 e0 08 0f b6 4c ?? ?? 0b c1 48 8b 8c ?? ?? ?? ?? ?? 89 01 ?? ?? ?? ?? ?? 48 8b 44 ?? ?? 0f b6 00 3d e9 }
		$get_syscall_offset = { 4d 33 db 4c 8b d9 c3 }
		$jump_syscall_offset = { 4c 8b d1 41 8b 03 41 ff 63 ?? }

	condition:
		uint16( 0 ) == 0x5a4d and $str_decryption_algorithm and $hashing_algorithm and ( 1 of ( $halos_gate , $get_syscall_offset , $jump_syscall_offset ) )
}

Strings (5 patterns)

IdentifierTypeValueModifiers
$str_decryption_algorithmhex{ 48 63 44 24 ?? 48 8b 4c 24 ?? 0f b6 04 ?? 33 44 ?? ?? 0f b6 4c ?? ?? d2 c8 48 63 4c ?? ?? 48 8b 54 ?? ?? 88 04 0a 6b 44 24 ?? ?? 89 44 ?? ?? 8b 44 24 ?? ff c0 …
$hashing_algorithmhex{ 48 8b 44 24 ?? 0f be ?? 89 44 24 ?? 8b 44 24 ?? 89 44 24 ?? 48 8b 44 24 ?? 48 ff c0 48 89 44 24 ?? 83 7c 24 08 ?? ?? ?? 8b 44 24 ?? 8b 0c ?? 03 c8 8b c1 89 04 …
$halos_gatehex{ 48 8b 44 24 ?? 0f b6 ?? 83 f8 4c 0f ?? ?? ?? ?? ?? 48 8b 44 ?? ?? 0f b6 ?? ?? 3d 8b ?? ?? ?? 75 ?? 48 8b 44 ?? ?? 0f b6 40 ?? 3d d1 ?? ?? ?? 75 ?? 48 8b 44 ?? …
$get_syscall_offsethex{ 4d 33 db 4c 8b d9 c3 }
$jump_syscall_offsethex{ 4c 8b d1 41 8b 03 41 ff 63 ?? }

Condition

uint16( 0 ) == 0x5a4d and $str_decryption_algorithm and $hashing_algorithm and ( 1 of ( $halos_gate , $get_syscall_offset , $jump_syscall_offset ) )

In plain words (Heuristic)

  • The file must start with “MZ” — a Windows executable (PE).
  • At least 1 patterns in ( $halos_gate , $get_syscall_offset , $jump_syscall_offset ) must match.
  • Pattern $str_decryption_algorithm must be present.
  • Pattern $hashing_algorithm must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • fa3d03c319a7597712eeff1338dabf92

Licence & attribution

Author: 0x0d4y

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Creative Commons Attribution 4.0 (stated in the rule's own meta)

“CC BY 4.0”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: b2f18ab3-b4df-4e2f-aa23-de8694beb221

Metadata

rule_matching_tlpTLP:WHITE
rule_sharing_tlpTLP:WHITE

Tags:FILE

Related rules