NCSC (via Open-Source-YARA-rules)

Dépôt

https://github.com/mikesxrs/Open-Source-YARA-rules

Commit

ec0056f767db98bf6d5fd63877ad51fb54d350e9

Récupéré le

2026-09-27

Licence

No licence (all rights reserved)

Publication

Métadonnées

Justification

Unlicensed mirror repository and no licence in the rules: metadata and upstream link only.

Règles de NCSC (via Open-Source-YARA-rules)

• NCSC_Sparrowdoor_ApipatchMétadonnées seules

  Identifies code segments in SparrowDoor responsible for patching APIs. No MZ/PE match as the backdoor has no header. Targeting in memory.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_ClipshotMétadonnées seules

  The SparrowDoor loader contains a feature it calls clipshot, which logs clipboard data to a file.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_ConfigMétadonnées seules

  Targets the XOR encoded loader config and shellcode in the file libhost.dll using the known position of the XOR key.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_LoaderMétadonnées seules

  Targets code features of the SparrowDoor loader. This rule detects the previous variant and this new variant.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_ShellcodeMétadonnées seules

  Targets code features of the reflective loader for SparrowDoor. Targeting in memory.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_Sleep_RoutineMétadonnées seules

  SparrowDoor implements a Sleep routine with value seeded on GetTickCount. This signature detects the previous and this variant of SparrowDoor. No MZ/PE match as the backdoor has no header.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_XorMétadonnées seules

  Highlights XOR routines in SparrowDoor. No MZ/PE match as the backdoor has no header. Targeting in memory.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28
• NCSC_Sparrowdoor_StringsMétadonnées seules

  Strings that appear in SparrowDoor’s backdoor. Targeting in memory.

  MalwareNCSC (via Open-Source-YARA-rules)· NCSC· 2022-02-28