Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_Octowave_Loader_03_2025

Detects opcodes found in Octowave loader DLLs and WAV steganography files

MalwareOctowaveSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Jai Minton (@CyberRaiju) - HuntressLabs
Date
2025-03-19
Modified
2025-03-21
Score / Quality
75 / 85

What this rule detects

Detects opcodes found in Octowave loader DLLs and WAV steganography files

Associated malware family: Octowave.

It defines 7 patterns (0 text, 7 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
octowave-loader-03-2025.yarDetection Rule License 1.1
rule SIGNATURE_BASE_Octowave_Loader_03_2025 : FILE
{
	meta:
		description = "Detects opcodes found in Octowave loader DLLs and WAV steganography files"
		author = "Jai Minton (@CyberRaiju) - HuntressLabs"
		id = "d583c416-be20-5fcf-848e-edd037e3b0d4"
		date = "2025-03-19"
		modified = "2025-03-21"
		reference = "https://yaratoolkit.securitybreak.io/"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_octowave_loader_mar25.yar#L1-L285"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "0504bfbacb6e10b81196f625f2fe37b33500e7bf65fd82d3510a2b178c6cd5bd"
		hash = "3a2db0cb9ee01549a6b660d58115d112d36a744d65705394b54d7d95287c7a74"
		hash = "eb50d06057fe123d6e9f7a76d3d1a4bc5307e8f15d017be8f6031e92136cf36a"
		hash = "24715920e749b014ba05f74c96627a27355c5860a14461c106aa48a7aba371ea"
		logic_hash = "266568d5f0f95cc805a833745a9e63689234ae927c2903230438c080f7ec2e56"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"

	strings:
		$opcode_1 = {
			55
			8B EC
			56
			57
			8B D1
			33 C0
			8B FA
			6A 06
			59
			AB
			AB
			AB
			AB
			8B 45 08
			8B FA
			83 62 10 00
			8B F0
			83 62 14 00
			F3 A5
			83 60 10 00
		}
		$opcode_2 = {
			55
			8B EC
			8B 55 ??
			56
			8B F1
			8B 46 ??
			8B 4E ??
			2B C1
			3B D0
			77 ??
			83 7E ?? 07
			53
			8D 1C 11
			57
			89 5E ??
			8B FE
			76 ??
			8B 3E
			8D 04 12
			50
			FF 75 ??
			8D 0C 4F
			51
			E8 ?? ?? ?? ??
			83 C4 0C
			33 C0
			66 89 04 5F
			8B C6
			5F
			5B
			EB ??
			52
			FF 75 ??
			8B CE
			FF 75 ??
			52
			E8 ?? ?? ?? ??
			5E
			5D
			C2 08 00
		}
		$opcode_3 = {
			55
			8B EC
			8B 4D 08
			83 C9 ??
			56
			3B 4D 10
			77 1C
			8B 75 0C
			8B D6
			8B 45 10
			D1 EA
			2B C2
			3B F0
			77 0C
			8D 04 32
			3B C8
			0F 42 C8
			8B C1
			EB 03
		}
		$opcode_4 = {
			56
			8B F1
			8B 46 14
			83 F8 ??
			76 ??
		}
		$opcode_5 = {
			50
			FF 36
			E8 ?? ?? ?? ??
			59
			59
			83 66 ?? 00
		}
		$opcode_6 = {
			C7 46 14 ?? 00 00 00
			66 89 06
			5E
			C3
		}
		$opcode_7 = {
			55
			8B EC
			51
			51
			A1 ?? ?? ?? ??
			33 C5
			89 45 FC
			8B 4D 0C
			8B 45 08
			89 45 F8
			81 F9 00 10 00 00
			72 ??
			8D 45 0C
			50
			8D 45 F8
			50
			E8 ?? ?? ?? ??
			8B 45 F8
			59
			59
		}

	condition:
		( uint16( 0 ) == ( 0x5a4d ) or uint32( 0 ) == 0x46464952 ) and filesize < 50000KB and all of them
}

Strings (7 patterns)

IdentifierTypeValueModifiers
$opcode_1hex{ 55 8B EC 56 57 8B D1 33 C0 8B FA 6A 06 59 AB AB AB AB 8B 45 08 8B FA 83 62 10 00 8B F0 83 62 14 00 F3 …
$opcode_2hex{ 55 8B EC 8B 55 ?? 56 8B F1 8B 46 ?? 8B 4E ?? 2B C1 3B D0 77 ?? 83 7E ?? 07 53 8D 1C 11 57 89 5E ?? 8B FE 76 …
$opcode_3hex{ 55 8B EC 8B 4D 08 83 C9 ?? 56 3B 4D 10 77 1C 8B 75 0C 8B D6 8B 45 10 D1 EA 2B C2 3B F0 77 0C 8D 04 32 3B C8 …
$opcode_4hex{ 56 8B F1 8B 46 14 83 F8 ?? 76 ?? }
$opcode_5hex{ 50 FF 36 E8 ?? ?? ?? ?? 59 59 83 66 ?? 00 }
$opcode_6hex{ C7 46 14 ?? 00 00 00 66 89 06 5E C3 }
$opcode_7hex{ 55 8B EC 51 51 A1 ?? ?? ?? ?? 33 C5 89 45 FC 8B 4D 0C 8B 45 08 89 45 F8 81 F9 00 10 00 00 72 ?? 8D 45 0C 50 8D 45 …

Condition

( uint16( 0 ) == ( 0x5a4d ) or uint32( 0 ) == 0x46464952 ) and filesize < 50000KB and all of them

In plain words (Heuristic)

  • The file must be smaller than 50000KB (a cheap guard that skips large files).
  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • 0504bfbacb6e10b81196f625f2fe37b33500e7bf65fd82d3510a2b178c6cd5bd
  • 3a2db0cb9ee01549a6b660d58115d112d36a744d65705394b54d7d95287c7a74
  • eb50d06057fe123d6e9f7a76d3d1a4bc5307e8f15d017be8f6031e92136cf36a
  • 24715920e749b014ba05f74c96627a27355c5860a14461c106aa48a7aba371ea

Licence & attribution

Author: Jai Minton (@CyberRaiju) - HuntressLabs

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (stated in the rule's own meta)

“Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: d583c416-be20-5fcf-848e-edd037e3b0d4

Tags:FILE

Related rules

More Octowave rules