Reglas YARA para Sparrow Door
9 reglas de 2 fuentes detectan Sparrow Door. Se ordenan por compatibilidad con YARA-X, licencia (texto completo primero), puntuación y calidad. Sobre todo: Malware.
La agrupación por familia es heurística: revisa la descripción de cada regla.
Escanear archivos con todas las reglas de Sparrow DoorBuscar reglas
autogenerated rule brought to you by yara-signator
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04- NCSC_Sparrowdoor_ApipatchSolo metadatos
Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_ClipshotSolo metadatos
The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_ConfigSolo metadatos
Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_LoaderSolo metadatos
Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_ShellcodeSolo metadatos
Targets code features of the reflective loader for SparrowDoor. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_Sleep_RoutineSolo metadatos
SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_XorSolo metadatos
Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_StringsSolo metadatos
Strings that appear in SparrowDoor’s backdoor. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28