Règles YARA pour Sparrow Door
9 règles issues de 2 sources détectent Sparrow Door. Elles sont classées par compatibilité YARA-X, licence (texte complet d’abord), score et qualité. Principalement : Malware.
Le regroupement par famille est heuristique : vérifiez la description de chaque règle.
Scanner des fichiers avec toutes les règles Sparrow DoorRechercher des règles
autogenerated rule brought to you by yara-signator
MalwareMalpedia signator rules· Felix Bilstein - yara-signator at cocacoding dot com· 2026-05-04- NCSC_Sparrowdoor_ApipatchMétadonnées seules
Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_ClipshotMétadonnées seules
The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_ConfigMétadonnées seules
Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_LoaderMétadonnées seules
Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_ShellcodeMétadonnées seules
Targets code features of the reflective loader for SparrowDoor. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_Sleep_RoutineMétadonnées seules
SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_XorMétadonnées seules
Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28 - NCSC_Sparrowdoor_StringsMétadonnées seules
Strings that appear in SparrowDoor’s backdoor. Targeting in memory.
MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28