YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_MAL_DLL_Chrome_App_Bound_Encryption_Decryption_May25

Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies, passwords and payment methods from Chromium-based browsers. Seen being used by Katz stealer

MalwareSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X

Author: MAlGamy
Date: 2025-05-19
Modified: 2026-05-15
Score / Quality: 80 / 85

What this rule detects

Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies, passwords and payment methods from Chromium-based browsers. Seen being used by Katz stealer

Targets: Windows PE.

It defines 4 patterns (3 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar

mal-dll-chrome-app-bound-encryption-decryption-may25.yarDetection Rule License 1.1

rule SIGNATURE_BASE_MAL_DLL_Chrome_App_Bound_Encryption_Decryption_May25 : FILE
{
	meta:
		description = "Detects a DLL used to decrypt App-Bound Encrypted (ABE) cookies, passwords and payment methods from Chromium-based browsers. Seen being used by Katz stealer"
		author = "MAlGamy"
		id = "ee1e2584-7104-506f-93a9-89e97cf39a93"
		date = "2025-05-19"
		modified = "2026-05-15"
		reference = "Internal Research"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_katz_stealer.yar#L24-L43"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "6dc8e99da68b703e86fa90a8794add87614f254f804a8d5d65927e0676107a9d"
		logic_hash = "d5488728a3ee8f2f59ed9798b80d516f7f131e39b3d5099ad5168ffc8ff22718"
		score = 80
		quality = 85
		tags = "FILE"

	strings:
		$s1 = "Failed to set proxy blanket." ascii
		$s2 = "Decryption failed. Last error:" ascii
		$s3 = "\\Google\\Chrome\\User Data\\Local State" ascii
		$op1 = {48 39 F3 74 ?? 4C 89 E2 48 89 E9 E8 ?? ?? ?? ?? 48 89 C1 48 8B 00 B2 ?? 48 8B 40 ?? 48 C7 44 01 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 13 48 89 C1 E8 ?? ?? ?? ?? 48 FF C3 EB ?? 48 8D 54 24 ?? 48 89 F9 E8 ?? ?? ?? ?? 48 89 E9 E8 ?? ?? ?? ?? 48 89 F8 48 81 C4}

	condition:
		uint16( 0 ) == 0x5a4d and filesize < 2MB and $op1 and 1 of ( $s* )
}

Strings (4 patterns)

Identifier	Type	Value	Modifiers
$s1	text	"Failed to set proxy blanket."	ascii
$s2	text	"Decryption failed. Last error:"	ascii
$s3	text	"\\Google\\Chrome\\User Data\\Local State"	ascii
$op1	hex	{48 39 F3 74 ?? 4C 89 E2 48 89 E9 E8 ?? ?? ?? ?? 48 89 C1 48 8B 00 B2 ?? 48 8B 40 ?? 48 C7 44 01 ?? ?? ?? ?? ?? E8 ?? ?? ?? ?? 0F B6 13 48 89 C1 E8 ?? ?? ?? ?? …

Condition

uint16( 0 ) == 0x5a4d and filesize < 2MB and $op1 and 1 of ( $s* )

In plain words (Heuristic)

The file must start with “MZ” — a Windows executable (PE).
The file must be smaller than 2MB (a cheap guard that skips large files).
At least 1 patterns in ( $s* ) must match.
Pattern $op1 must be present.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

6dc8e99da68b703e86fa90a8794add87614f254f804a8d5d65927e0676107a9d

Licence & attribution

Author: MAlGamy

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (repository licence)

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: ee1e2584-7104-506f-93a9-89e97cf39a93

Tags:FILE