Skip to content
yararules.org
Menu

YARA · Signature Base (Florian Roth / Nextron)

SIGNATURE_BASE_Octowave_Loader_Supporting_File_03_2025

Detects supporting file used by Octowave loader containing hardcoded values

MalwareOctowaveSignature Base (Florian Roth / Nextron)Detection Rule License 1.1Compiles with YARA-X
Author
Jai Minton (@CyberRaiju) - HuntressLabs
Date
2025-03-19
Modified
2025-03-21
Score / Quality
75 / 85

What this rule detects

Detects supporting file used by Octowave loader containing hardcoded values

Associated malware family: Octowave.

It defines 3 patterns (2 text, 1 hex, 0 regex).

Summary generated from the rule's metadata and condition.

Rule source

Download .yar
octowave-loader-supporting-file-03-2025.yarDetection Rule License 1.1
rule SIGNATURE_BASE_Octowave_Loader_Supporting_File_03_2025 : FILE
{
	meta:
		description = "Detects supporting file used by Octowave loader containing hardcoded values"
		author = "Jai Minton (@CyberRaiju) - HuntressLabs"
		id = "2c81c8b8-4b4d-55c9-9285-556e8b5303bd"
		date = "2025-03-19"
		modified = "2025-03-21"
		reference = "https://x.com/CyberRaiju/status/1893450184224362946?t=u0X6ST2Qgnrf-ujjphGOSg&s=19"
		source_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/yara/mal_octowave_loader_mar25.yar#L287-L312"
		license_url = "https://github.com/Neo23x0/signature-base/blob/94a1c48d7ab499879287ff611dfe7f9c56376030/LICENSE"
		hash = "c4cbaa7e4521fa0ed9cc634c5e2bacbf41f46842ca4526b7904d98843a7e9db9"
		hash = "f5cfb2e634539d5dc7ffe202ffdc422ef7457100401ba1fbc21dd05558719865"
		hash = "56f1967f7177c166386d864807cdf03d5bbd3f118a285ce67ea226d02e5cf58c"
		hash = "11ee5ad8a81ae85e5b7ddf93adf6edd20de8460c755bf0426dfcbc7f658d7e85"
		hash = "d218b65493e4d9d85cbc2f7b608f4f7e501708014bc04af27d33d995aa54a703"
		hash = "0c112f9dfe27211b357c74f358d9c144ea10cc0d92d6420b8742b72a65562c5a"
		logic_hash = "42abd38e704a17ef81b423829c2dd356749873a5d036e43cc2746debfb3f5434"
		score = 75
		quality = 85
		tags = "FILE"
		license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"

	strings:
		$unique_key = {1D 1C 1F 1E 01 01 03 02 05 04 07 06 09 D4 0E 0A 0D 0C 0F 0E 31 30 31 32 35 34 36 36 39 38 DC 3F 3D 3C 3E}
		$unique_string = "MLONqpsrutwvyx"
		$unique_string2 = "A@CBEDGFIHKJMLONqpsrutwvyx"

	condition:
		uint16( 0 ) != 0x5a4d and filesize < 10000KB and all of them
}

Strings (3 patterns)

IdentifierTypeValueModifiers
$unique_keyhex{1D 1C 1F 1E 01 01 03 02 05 04 07 06 09 D4 0E 0A 0D 0C 0F 0E 31 30 31 32 35 34 36 36 39 38 DC 3F 3D 3C 3E}
$unique_stringtext"MLONqpsrutwvyx"
$unique_string2text"A@CBEDGFIHKJMLONqpsrutwvyx"

Condition

uint16( 0 ) != 0x5a4d and filesize < 10000KB and all of them

In plain words (Heuristic)

  • The file must be smaller than 10000KB (a cheap guard that skips large files).
  • All patterns in the rule must match.

Test this rule in your browser

Drop a file to scan it with this rule using YARA-X compiled to WebAssembly. Nothing is uploaded.

Drop a file here or click to chooseScanned locally with YARA-X. Files up to 200 MB.

Open in editor

References

Sample hashes

Hashes of samples the author lists in the rule's meta (look them up in your threat-intelligence platform).

  • c4cbaa7e4521fa0ed9cc634c5e2bacbf41f46842ca4526b7904d98843a7e9db9
  • f5cfb2e634539d5dc7ffe202ffdc422ef7457100401ba1fbc21dd05558719865
  • 56f1967f7177c166386d864807cdf03d5bbd3f118a285ce67ea226d02e5cf58c
  • 11ee5ad8a81ae85e5b7ddf93adf6edd20de8460c755bf0426dfcbc7f658d7e85
  • d218b65493e4d9d85cbc2f7b608f4f7e501708014bc04af27d33d995aa54a703
  • 0c112f9dfe27211b357c74f358d9c144ea10cc0d92d6420b8742b72a65562c5a

Licence & attribution

Author: Jai Minton (@CyberRaiju) - HuntressLabs

Source repository: Signature Base (Florian Roth / Nextron) @ 94a1c48d7a

Licence: Detection Rule License 1.1 (stated in the rule's own meta)

“Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE”

Original rule

Mirrored via YARA Forge 20260927, which prefixes rule names with the source and adds normalised meta fields.

Rule id: 2c81c8b8-4b4d-55c9-9285-556e8b5303bd

Tags:FILE

Related rules

More Octowave rules