Wei Yuan - RankMe

Year	Rank	Type	Title / Venue / Authors
2026	A*	`conf`	Do You Really Know What I Am Doing? Backdoor Attacks on Provenance-Based Intrusion Detection Systems. WWW Shaodi Xie, Wei Yuan, Haoyu Jiang, Zhu Gong, Haoran Wang, Heng Li, Tiejun Wu
2026	J	`jnl`	Improving the transferability of targeted adversarial examples by style-agnostic attack. Comput. Secur. Wei Zhou, Zimin Mao, Shuijun Yin, Hanwen Zhang, Zhicheng Huang, Heng Li, Tiejun Wu, Wei Yuan
2026	J	`jnl`	Ratio-Enhanced Feature Interaction for Few-Shot User Authentication Using Running Data in IoT Wearables. IEEE Internet Things J. Zhen Chen, Zhihua Ding, Niangen Ye, Jiayi Zhu, Wei Yuan, Weiqiang Sun
2026	J	`jnl`	Why Not Diversify Triggers? APK-Specific Backdoor Attack Against Android Malware Detection. IEEE Trans. Dependable Secur. Comput. Heng Li, Bang Wu, Zhiyuan Yao, Cuiying Gao, Wei Yuan, Beihao Xia, Xiapu Luo
2025	J	`jnl`	Adversarial Perturbations for Defeating Cryptographic Algorithm Identification. Big Data Cogn. Comput. Shuijun Yin, Di Wu, Haolan Zhang, Heng Li, Zhiyuan Yao, Wei Yuan
2025	J	`jnl`	An Efficient Adversarial Attack on FCG-Based Android Malware Detection Systems. IEEE Trans. Inf. Forensics Secur. Heng Li, Bang Wu, Wei Zhou, Wei Yuan, Cuiying Gao, Xinge You, Xiapu Luo
2025	A*	`conf`	Automated Mass Malware Factory: The Convergence of Piggybacking and Adversarial Example in Android Malicious Software Generation. NDSS Heng Li, Zhiyuan Yao, Bang Wu, Cuiying Gao, Teng Xu, Wei Yuan, Xiapu Luo
2025	A*	`conf`	Fighting Fire with Fire: Continuous Attack for Adversarial Android Malware Detection. USENIX Security Symposium Yinyuan Zhang, Cuiying Gao, Yueming Wu, Shihan Dou, Cong Wu, Ying Zhang, Wei Yuan, Yang Liu
2024	A*	`conf`	A Comprehensive Study of Learning-based Android Malware Detectors under Challenging Environments. ICSE Cuiying Gao, Gaozhun Huang, Heng Li, Bang Wu, Yueming Wu, Wei Yuan
2024	J	`jnl`	Concept drift adaptation with scarce labels: A novel approach based on diffusion and adversarial learning. Eng. Appl. Artif. Intell. Liheng Yuan, Fanghua Ye, Wei Zhou, Wei Yuan, Xinge You
2024	J	`jnl`	Enhancing robustness of person detection: A universal defense filter against adversarial patch attacks. Comput. Secur. Zimin Mao, Shuiyan Chen, Zhuang Miao, Heng Li, Beihao Xia, Junzhe Cai, Wei Yuan, Xinge You
2024	J	`jnl`	Semi-supervised anomaly detection with contamination-resilience and incremental training. Eng. Appl. Artif. Intell. Liheng Yuan, Fanghua Ye, Heng Li, Chenhao Zhang, Cuiying Gao, Chengqing Yu, Wei Yuan, Xinge You
2024	A*	`conf`	Trace-agnostic and Adversarial Training-resilient Website Fingerprinting Defense. INFOCOM Litao Qiao, Bang Wu, Heng Li, Cuiying Gao, Wei Yuan, Xiapu Luo
2024	A	`conf`	Uncovering and Mitigating the Impact of Code Obfuscation on Dataset Annotation with Antivirus Engines. ISSTA Cuiying Gao, Yueming Wu, Heng Li, Wei Yuan, Haoyu Jiang, Qidan He, Yang Liu
2023	A*	`conf`	Black-box Adversarial Example Attack towards FCG Based Android Malware Detection under Incomplete Feature Information. USENIX Security Symposium Heng Li, Zhang Cheng, Bang Wu, Liheng Yuan, Cuiying Gao, Wei Yuan, Xiapu Luo
2023	J	`jnl`	Black-box Adversarial Example Attack towards FCG Based Android Malware Detection under Incomplete Feature Information. CoRR Heng Li, Zhang Cheng, Bang Wu, Liheng Yuan, Cuiying Gao, Wei Yuan, Xiapu Luo
2023	J	`jnl`	Detecting Android Malware With Pre-Existing Image Classification Neural Networks. IEEE Signal Process. Lett. Chenhao Zhang, Shuijun Yin, Heng Li, Minghui Cai, Wei Yuan
2023	A*	`conf`	HARP: Let Object Detector Undergo Hyperplasia to Counter Adversarial Patches. ACM Multimedia Junzhe Cai, Shuiyan Chen, Heng Li, Beihao Xia, Zimin Mao, Wei Yuan
2023	J	`jnl`	Kernelized Similarity Learning and Embedding for Dynamic Texture Synthesis. IEEE Trans. Syst. Man Cybern. Syst. Shiming Chen, Peng Zhang, Guo-Sen Xie, Qinmu Peng, Zehong Cao, Wei Yuan, Xinge You
2023	J	`jnl`	MSN: Multi-Style Network for Trajectory Prediction. IEEE Trans. Intell. Transp. Syst. Conghao Wong, Beihao Xia, Qinmu Peng, Wei Yuan, Xinge You
2023	J	`jnl`	Obfuscation-Resilient Android Malware Analysis Based on Complementary Features. IEEE Trans. Inf. Forensics Secur. Cuiying Gao, Minghui Cai, Shuijun Yin, Gaozhun Huang, Heng Li, Wei Yuan, Xiapu Luo
2023	J	`jnl`	Resisting DNN-Based Website Fingerprinting Attacks Enhanced by Adversarial Training. IEEE Trans. Inf. Forensics Secur. Litao Qiao, Bang Wu, Shuijun Yin, Heng Li, Wei Yuan, Xiapu Luo
2022	J	`jnl`	CSCNet: Contextual Semantic Consistency Network for Trajectory Prediction in Crowded Spaces. CoRR Beihao Xia, Conghao Wong, Qinmu Peng, Wei Yuan, Xinge You
2022	J	`jnl`	CSCNet: Contextual semantic consistency network for trajectory prediction in crowded spaces. Pattern Recognit. Beihao Xia, Conghao Wong, Qinmu Peng, Wei Yuan, Xinge You
2022	J	`jnl`	Model scheduling and sample selection for ensemble adversarial example attacks. Pattern Recognit. Zichao Hu, Heng Li, Liheng Yuan, Zhang Cheng, Wei Yuan, Ming Zhu
2022	A*	`conf`	Recent Advances in Concept Drift Adaptation Methods for Deep Learning. IJCAI Liheng Yuan, Heng Li, Beihao Xia, Cuiying Gao, Mingyue Liu, Wei Yuan, Xinge You
2022	—	`conf`	View Vertically: A Hierarchical Network for Trajectory Prediction via Fourier Spectrums. ECCV (22) Conghao Wong, Beihao Xia, Ziming Hong, Qinmu Peng, Wei Yuan, Qiong Cao, Yibo Yang, Xinge You
2021	J	`jnl`	A Lightweight On-Device Detection Method for Android Malware. IEEE Trans. Syst. Man Cybern. Syst. Wei Yuan, Yuan Jiang, Heng Li, Minghui Cai
2021	J	`jnl`	Black-box attack against handwritten signature verification with region-restricted adversarial perturbations. Pattern Recognit. Haoyang Li, Heng Li, Hansong Zhang, Wei Yuan
2021	J	`jnl`	Learning features from enhanced function call graphs for Android malware detection. Neurocomputing Minghui Cai, Yuan Jiang, Cuiying Gao, Heng Li, Wei Yuan
2021	A*	`conf`	Robust Android Malware Detection against Adversarial Example Attacks. WWW Heng Li, Shiyao Zhou, Wei Yuan, Xiapu Luo, Cuiying Gao, Shuiyan Chen
2021	A*	`conf`	Structural Attack against Graph Based Android Malware Detection. CCS Kaifa Zhao, Hao Zhou, Yulin Zhu, Xian Zhan, Kai Zhou, Jianfeng Li, Le Yu, Wei Yuan, Xiapu Luo
2020	J	`jnl`	Adversarial-Example Attacks Toward Android Malware Detection System. IEEE Syst. J. Heng Li, Shiyao Zhou, Wei Yuan, Jiahuan Li, Henry Leung
2019	J	`jnl`	Multi-view common component discriminant analysis for cross-view classification. Pattern Recognit. Xinge You, Jiamiao Xu, Wei Yuan, Xiao-Yuan Jing, Dacheng Tao, Taiping Zhang
2018	J	`jnl`	Coarse-to-Fine Salient Object Detection with Low-Rank Matrix Recovery. CoRR Qi Zheng, Shujian Yu, Xinge You, Qinmu Peng, Wei Yuan
2018	J	`jnl`	Multi-view manifold learning with locality alignment. Pattern Recognit. Yue Zhao, Xinge You, Shujian Yu, Chang Xu, Wei Yuan, Xiao-Yuan Jing, Taiping Zhang, Dacheng Tao
2017	J	`jnl`	Coalition Formation and Spectrum Sharing of Cooperative Spectrum Sensing Participants. IEEE Trans. Cybern. Zhensheng Jiang, Wei Yuan, Henry Leung, Xinge You, Qi Zheng
2017	J	`jnl`	Competitive Charging Station Pricing for Plug-In Electric Vehicles. IEEE Trans. Smart Grid Wei Yuan, Jianwei Huang, Ying Jun (Angela) Zhang
2017	—	`conf`	Robust Multi-view Common Component Learning. CCCV (3) Jiamiao Xu, Xinge You, Shi Yin, Peng Zhang, Wei Yuan
2016	J	`jnl`	Multiobjective Optimization of Linear Cooperative Spectrum Sensing: Pareto Solutions and Refinement. IEEE Trans. Cybern. Wei Yuan, Xinge You, Jing Xu, Henry Leung, Tianhang Zhang, Chun-Lung Philip Chen
2015	J	`jnl`	Competitive Charging Station Pricing for Plug-in Electric Vehicles. CoRR Wei Yuan, Jianwei Huang, Ying Jun Zhang
2014	—	`conf`	Competitive charging station pricing for plug-in electric vehicles. SmartGridComm Wei Yuan, Jianwei Huang, Ying Jun (Angela) Zhang
2013	J	`jnl`	Access Point Selection under QoS Requirements in Variable Channel-Width WLANs. IEEE Wirel. Commun. Lett. Xiaohui Chen, Wei Yuan, Wenqing Cheng, Wei Liu, Henry Leung
2013	J	`jnl`	Channel assignment in heterogeneous multi-radio multi-channel wireless networks: A game theoretic approach. Comput. Networks Xiaohui Chen, Jing Xu, Wei Yuan, Wei Liu, Wenqing Cheng
2013	B	`conf`	Joint optimization of channel allocation and AP association in variable channel-width WLANs. WCNC Xiaohui Chen, Wenqing Cheng, Wei Yuan, Wei Liu, Jing Xu
2013	J	`jnl`	Variable-Width Channel Allocation for Access Points: A Game-Theoretic Perspective. IEEE Trans. Mob. Comput. Wei Yuan, Ping Wang, Wei Liu, Wenqing Cheng
2012	J	`jnl`	Participation in Repeated Cooperative Spectrum Sensing: A Game-Theoretic Perspective. IEEE Trans. Wirel. Commun. Wei Yuan, Henry Leung, Wenqing Cheng, Siyue Chen, Bokan Chen
2011	J	`jnl`	A Distributed Sensor Selection Mechanism for Cooperative Spectrum Sensing. IEEE Trans. Signal Process. Wei Yuan, Henry Leung, Siyue Chen, Wenqing Cheng
2011	J	`jnl`	Optimizing Voting Rule for Cooperative Spectrum Sensing Through Learning Automata. IEEE Trans. Veh. Technol. Wei Yuan, Henry Leung, Wenqing Cheng, Siyue Chen
2010	—	`conf`	Capacity Maximization for Variable-Width WLANs: A Game-Theoretic Approach. ICC Wei Yuan, Wei Liu, Wenqing Cheng
2010	B	`conf`	Maximize Secondary User Throughput via Optimal Sensing in Multi-Channel Cognitive Radio Networks. GLOBECOM Shimin Gong, Ping Wang, Wei Liu, Wei Yuan
2010	B	`conf`	Optimization of Cooperative Spectrum Sensing in Ad-Hoc Cognitive Radio Networks. GLOBECOM Wenfang Xia, Wei Yuan, Wenqing Cheng, Wei Liu, Shu Wang, Jing Xu
2009	B	`conf`	An energy-efficient cooperative MISO-based routing protocol for wireless sensor networks. WCNC Pan Zhou, Wei Liu, Wei Yuan, Wenqing Cheng, Shu Wang
2009	—	`conf`	Joint User-Centric and System-Centric Channel Allocation in Cognitive Radio Networks: A Game-Theoretic Perspective. CNSR Wei Yuan, Wei Liu, Wenqing Cheng, Shu Wang
2009	B	`conf`	Pipelined cooperative spectrum sensing in cognitive radio networks. WCNC Feng Gao, Wei Yuan, Wei Liu, Wenqing Cheng, Shu Wang
2009	—	`conf`	Threshold-Learning in Local Spectrum Sensing of Cognitive Radio. VTC Spring Shimin Gong, Wei Liu, Wei Yuan, Wenqing Cheng, Shu Wang
2009	—	`conf`	Variable-Width Channel Allocation in Wireless LAN: A Game-Theoretic Perspective. ICC Wei Yuan, Wei Liu, Wenqing Cheng, Shu Wang
2008	B	`conf`	A Cooperative Relay Scheme for Secondary Communication in Cognitive Radio Networks. GLOBECOM Xiaowen Gong, Wei Yuan, Wei Liu, Wenqing Cheng, Shu Wang
2008	—	`conf`	A Utility-Optimal Backoff Algorithm for Clustered Sensor Networks. VTC Spring Shengbin Liao, Wenqing Cheng, Zongkai Yang, Wei Liu, Wei Yuan
2008	B	`conf`	An Energy-Efficient V-BLAST Based Cooperative MIMO Transmission Scheme for Wireless Sensor Networks. WCNC Kanru Xu, Wei Yuan, Wenqing Cheng, Yi Ding, Zongkai Yang
2008	B	`conf`	Energy-Efficient Joint Power and Rate Control via Pricing in Wireless Data Networks. WCNC Pan Zhou, Wei Liu, Wei Yuan, Wenqing Cheng
2008	—	`conf`	Joint Power and Rate Control in Cognitive Radio Networks: A Game-Theoretical Approach. ICC Pan Zhou, Wei Yuan, Wei Liu, Wenqing Cheng
2008	J	`jnl`	Local Coordination Based Routing and Spectrum Assignment in Multi-hop Cognitive Radio Networks. Mob. Networks Appl. Zongkai Yang, Geng Cheng, Wei Liu, Wei Yuan, Wenqing Cheng

/*
 * YARA-Forge YARA Rule Package
 * https://github.com/YARAHQ/yara-forge
 * 
 * Rule Package Information
 * Name: extended 
 * Description: Default YARA Rule Package - Extended
 * YARA-Forge Version: 0.9.1
 * YARA-QA Commit: a3aa7a36859045e8de8a308a0c5f360b184ea470
 * Minimum Quality: 50
 * Force Include Importance Level: 70
 * Force Exclude Importance Level: 20
 * Minimum Age (in days): 1
 * Minimum Score: 60
 * Creation Date: 2026-01-04
 * Number of Rules: 10391
 * Skipped: 10 (age), 523 (quality), 771 (score), 0 (importance)
 */

import "math"
import "hash"
import "dotnet"
import "pe"


/*
 * YARA Rule Set
 * Repository Name: ReversingLabs
 * Repository: https://github.com/reversinglabs/reversinglabs-yara-rules/
 * Retrieval Date: 2026-01-04
 * Git Commit: e0a0be54aa1e11ccfd6854e4f19e9476f328fd84
 * Number of Rules: 1239
 * Skipped: 0 (age), 0 (quality), 1 (score), 0 (importance)
 *
 * 
 * LICENSE
 * 
 * Copyright (c) 2020 ReversingLabs

Permission is hereby granted, free of charge, to any person obtaining a copy of
this software and associated documentation files (the "Software"), to deal in
the Software without restriction, including without limitation the rights to
use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
of the Software, and to permit persons to whom the Software is furnished to do
so, subject to the following conditions:

The above copyright notice and this permission notice shall be included in all
copies or substantial portions of the Software.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
SOFTWARE.
 */
rule REVERSINGLABS_Win32_Infostealer_Multigrainpos : TC_DETECTION MALICIOUS MALWARE FILE
{
	meta:
		description = "Yara rule that detects MultigrainPOS infostealer."
		author = "ReversingLabs"
		id = "595c04af-802f-556d-b22b-23cac79b256e"
		date = "2020-07-15"
		modified = "2020-07-15"
		reference = "ReversingLabs"
		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/e0a0be54aa1e11ccfd6854e4f19e9476f328fd84/yara/infostealer/Win32.Infostealer.MultigrainPOS.yara#L1-L88"
		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/e0a0be54aa1e11ccfd6854e4f19e9476f328fd84/LICENSE"
		logic_hash = "9808c95b850a54677c4132057b8372cabf0159920b7e0e6834a83f0d39c088fa"
		score = 75
		quality = 90
		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
		status = "RELEASED"
		sharing = "TLP:WHITE"
		category = "MALWARE"
		tc_detection_type = "Infostealer"
		tc_detection_name = "MultigrainPOS"
		tc_detection_factor = 5
		importance = 25

	strings:
		$data_exfiltration_v10_1 = {
            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8B 1D ?? ?? ?? ?? 56 57 8B 3D ?? 
            ?? ?? ?? C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 6A ?? 8D 4D ?? 51 6A ?? 6A ?? 8D 45 ?? 0F 
            43 45 ?? 6A ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 75 ?? 8B 45 ?? 50 8B 70 ?? FF D7 81 
            FE ?? ?? ?? ?? 74 ?? 81 FE ?? ?? ?? ?? 75 ?? 83 7D ?? ?? 5F 5E 5B 72 ?? FF 75 ?? E8 
            ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 33 CD B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ?? 
            FF 75 ?? FF D7 68 ?? ?? ?? ?? FF D3 EB
        }
		$memory_scraping_v10_1 = {
            6A ?? 56 8B CF E8 ?? ?? ?? ?? 85 C0 75 ?? 6A ?? 56 8B CF E8 ?? ?? ?? ?? 8B 8D ?? ?? 
            ?? ?? EB ?? 3C ?? 7C ?? 3C ?? 7E ?? 8A 46 ?? 3C ?? 7C ?? 3C ?? 7E ?? 3C ?? 74
        }
		$process_search_v10_1 = {
            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 68 ?? ?? ?? ?? E8 
            ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? 
            ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 8D 85 ?? ?? ?? ?? 50 56 FF 15 ?? ?? ?? ?? 
            85 C0 74 ?? 8B 3D ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 56 FF D7 85 C0 74 ?? 8B 1D ?? ?? 
            ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 50 FF D3 85 C0 74 ?? 8D 
            85 ?? ?? ?? ?? 50 56 FF D7 85 C0 75
        }
		$service_creation_v10_1 = {
            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 8D 4C 24 ?? C7 44 24 ?? ?? ?? 
            ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 33 C0 5E 8B 4C 24 ?? 33 CC E8 ?? ?? 
            ?? ?? 8B E5 5D C3 8B 35 ?? ?? ?? ?? 68 ?? ?? ?? ?? FF D6 8D 44 24 ?? 50 C7 44 24 ?? 
            ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? 
            FF 15
        }
		$process_search_v11_1 = {
            55 8B EC 81 EC ?? ?? ?? ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 56 57 8B 7D ?? FF 15 ?? 
            ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? EB ?? 8D 49 ?? 68 ?? ?? ?? ?? 8D 85 ?? 
            ?? ?? ?? 6A ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? C7 85 ?? ?? ?? ?? ?? ?? ?? ?? 6A ?? 6A ?? 
            FF 15 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 F8 ?? 75 ?? 68 ?? ?? ?? ?? FF D3 EB ?? 8D 8D 
            ?? ?? ?? ?? 51 50 FF 15 ?? ?? ?? ?? 8B 9D ?? ?? ?? ?? 33 C0 68 ?? ?? ?? ?? 50 66 89 
            85 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 ?? 33 C9 EB ?? 8D A4 24 ?? 
            ?? ?? ?? EB ?? 8D 49 ?? 0F B7 84 0D ?? ?? ?? ?? 66 89 84 0D ?? ?? ?? ?? 8D 49 ?? 66 
            85 C0 75 ?? 8D 85 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 
            50 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 85 ?? ?? ?? ?? 50 FF 15
        }
		$memory_scraping_v11_1 = {
            6A ?? 56 8B CF E8 ?? ?? ?? ?? 6A ?? 56 8B CF E8 ?? ?? ?? ?? EB ?? 3C ?? 75 ?? 6A ?? 
            56 8B CF E8 ?? ?? ?? ?? 6A ?? 56 8B CF E8
        }
		$data_exfiltration_v11_1 = {
            55 8B EC 83 EC ?? A1 ?? ?? ?? ?? 33 C5 89 45 ?? 53 8A 5D ?? 56 57 8B 3D ?? ?? ?? ?? 
            C7 45 ?? ?? ?? ?? ?? 83 7D ?? ?? 6A ?? 8D 4D ?? 51 6A ?? 6A ?? 8D 45 ?? 0F 43 45 ?? 
            6A ?? 50 FF 15 ?? ?? ?? ?? 6A ?? 85 C0 75 ?? 8B 45 ?? 50 8B 70 ?? FF D7 81 FE ?? ?? 
            ?? ?? 74 ?? 81 FE ?? ?? ?? ?? 74 ?? 84 DB 74 ?? 33 F6 83 7D ?? ?? 72 ?? FF 75 ?? E8 
            ?? ?? ?? ?? 83 C4 ?? 8B 4D ?? 5F 8B C6 5E 33 CD 5B E8 ?? ?? ?? ?? 8B E5 5D C2 ?? ?? 
            FF 75 ?? FF D7 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 84 DB 74 ?? EB ?? BE ?? ?? ?? ?? EB
        }
		$service_creation_v11_1 = {
            68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 44 24 ?? 50 8D 4C 24 ?? C7 44 24 ?? ?? ?? 
            ?? ?? E8 ?? ?? ?? ?? 8D 4C 24 ?? E8 ?? ?? ?? ?? 33 C0 8B 4C 24 ?? 33 CC E8 ?? ?? ?? 
            ?? 8B E5 5D C3 8D 44 24 ?? 50 C7 44 24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? C7 44 
            24 ?? ?? ?? ?? ?? C7 44 24 ?? ?? ?? ?? ?? FF 15 
        }

	condition:
		uint16( 0 ) == 0x5A4D and ( ( $data_exfiltration_v10_1 and $memory_scraping_v10_1 and $process_search_v10_1 and $service_creation_v10_1 ) or ( $process_search_v11_1 and $memory_scraping_v11_1 and $data_exfiltration_v11_1 and $service_creation_v11_1 ) )
}
rule REVERSINGLABS_Win32_Infostealer_Projecthookpos : TC_DETECTION MALICIOUS MALWARE FILE
{
	meta:
		description = "Yara rule that detects ProjectHookPOS infostealer."
		author = "ReversingLabs"
		id = "dcb96a99-c8c0-5878-a3a5-fe3cfeec43c6"
		date = "2020-07-15"
		modified = "2020-07-15"
		reference = "ReversingLabs"
		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/e0a0be54aa1e11ccfd6854e4f19e9476f328fd84/yara/infostealer/Win32.Infostealer.ProjectHookPOS.yara#L1-L98"
		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/e0a0be54aa1e11ccfd6854e4f19e9476f328fd84/LICENSE"
		logic_hash = "b7534c9e905256aaf80f04b746a92c50689437b288f7e393ef13fde1740c4a4e"
		score = 75
		quality = 90
		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
		status = "RELEASED"
		sharing = "TLP:WHITE"
		category = "MALWARE"
		tc_detection_type = "Infostealer"
		tc_detection_name = "ProjectHookPOS"
		tc_detection_factor = 5
		importance = 25

	strings:
		$calc_luhn = {
            55 8B EC 83 C4 ?? 53 56 57 33 C9 89 4D ?? 89 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 55 
            68 ?? ?? ?? ?? 64 FF 30 64 89 20 C6 45 ?? ?? 33 C0 89 45 ?? 8B 45 ?? 85 C0 74 ?? 8B 
            D0 83 EA ?? 66 83 3A ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 ?? 
            8B 00 25 ?? ?? ?? ?? 79 ?? 48 83 C8 ?? 40 85 C0 0F 94 C3 8B 45 ?? 85 C0 74 ?? 8B D0 
            83 EA ?? 66 83 3A ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 ?? 8B 
            00 8B F0 85 F6 7E ?? BF ?? ?? ?? ?? 8D 45 ?? 8B 55 ?? 0F B7 54 7A ?? E8 ?? ?? ?? ?? 
            8B 45 ?? 83 CA ?? E8 ?? ?? ?? ?? 0F B6 D0 66 83 FA ?? 75 ?? C6 45 ?? ?? EB ?? 84 DB 
            74 ?? 0F B6 C0 0F B6 80 ?? ?? ?? ?? 01 45 ?? EB ?? 0F B6 C0 01 45 ?? 80 F3 ?? 47 4E 
            75 ?? 8B 45 ?? B9 ?? ?? ?? ?? 99 F7 F9 85 D2 75 ?? 80 7D ?? ?? 74 ?? 33 DB EB ?? B3 
            ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? ?? ?? 8D 45 ?? E8 ?? ?? 
            ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 8B C3 5F 5E 5B 8B E5 5D C3 
        }
		$track_1_reverse = {
            55 8B EC 83 C4 ?? 53 56 33 DB 89 5D ?? 8B F1 89 55 ?? 8B 45 ?? E8 ?? ?? ?? ?? 33 C0 
            55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 8B C6 33 D2 E8 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 
            8B D0 83 EA ?? 66 83 3A ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 85 C0 74 ?? 83 E8 
            ?? 8B 00 8B D8 83 FB ?? 7C ?? 8D 45 ?? 50 B9 ?? ?? ?? ?? 8B D3 8B 45 ?? E8 ?? ?? ?? 
            ?? 8B 55 ?? 8B C6 E8 ?? ?? ?? ?? 4B 85 DB 75 ?? 33 C0 5A 59 59 64 89 10 68 ?? ?? ?? 
            ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? C3 E9 ?? ?? ?? ?? EB ?? 5E 5B 59 59 5D C3 
        }
		$check_validity_1 = {
            8B D0 83 EA ?? 66 83 3A ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 66 83 38 ?? 75 ?? 
            8B 45 ?? 85 C0 74 ?? 8B D0 83 EA ?? 66 83 3A ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? 
            ?? 66 83 78 ?? ?? 0F 94 C0 EB ?? 33 C0 84 C0 0F 84 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 
            8B D0 83 EA ?? 66 83 3A ?? 74 ?? 8D 45 ?? 8B 55 ?? E8 ?? ?? ?? ?? 66 83 78 ?? ?? 0F 
            85 ?? ?? ?? ?? 8B 45 ?? 85 C0 74 ?? 8B D0 83 EA ?? 66 83 3A ?? 74 ?? 8D 45 ?? 8B 55 
            ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 66 81 78 ?? ?? ?? 73 ?? 0F B6 40 ?? 0F B6 C0 0F A3 
            06 72 ?? 33 C0 EB 
        }
		$encode_and_send_1 = {
            64 89 20 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 33 C9 B2 ?? A1 ?? ?? ?? ?? E8 ?? 
            ?? ?? ?? 8B F0 8D 4D ?? 8B 55 ?? 8B C7 E8 ?? ?? ?? ?? 8B 4D ?? 8D 45 ?? BA ?? ?? ?? 
            ?? E8 ?? ?? ?? ?? 8B 55 ?? 8B C3 8B 08 FF 51 ?? 8D 45 ?? 8B 4D ?? BA ?? ?? ?? ?? E8 
            ?? ?? ?? ?? 8B 55 ?? 8B C3 8B 08 FF 51 ?? 8D 45 ?? 8B 4D ?? BA ?? ?? ?? ?? E8 ?? ?? 
            ?? ?? 8B 55 ?? 8B C3 8B 08 FF 51 ?? 8D 45 ?? 8B 4D ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 
            8B 55 ?? 8B C3 8B 08 FF 51 ?? 8B C6 E8 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 
            C6 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 50 8B CB BA 
            ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B C6 E8
        }
		$form_create_1 = {
            8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 
            ?? E8 ?? ?? ?? ?? 8B D0 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 6A ?? 8D 55 
            ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 
            ?? ?? ?? ?? 50 8D 55 ?? A1 ?? ?? ?? ?? 8B 00 E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 
            50 E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 
            ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? 
            ?? ?? 84 C0 0F 84
        }
		$form_create_2 = {
            33 C9 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 8B C3 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 
            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 4D ?? BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8D 55 ?? 
            B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? 
            ?? ?? ?? 8B D0 8D 45 ?? E8 ?? ?? ?? ?? 8B 45 ?? 33 C9 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 
            8B C3 E8
        }
		$form_create_3 = {
            B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 33 C9 
            BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8D 55 ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8D 45 ?? 
            BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B 45 ?? E8 ?? ?? ?? ?? 8B D0 8D 45 ?? E8 ?? ?? ?? ?? 
            8B 4D ?? BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 33 C9 BA ?? ?? ?? 
            ?? 8B C3 E8 ?? ?? ?? ?? 33 C9 BA ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? ?? 8B C3 E8 ?? ?? ?? 
            ?? 8B C3 E8 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 8B 09 B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 
            A3 ?? ?? ?? ?? BA ?? ?? ?? ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 56 68 ?? ?? ?? ?? A1 ?? 
            ?? ?? ?? E8 ?? ?? ?? ?? B2 ?? A1 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B C6 E8 ?? ?? ?? ?? 84 
            C0 74
        }

	condition:
		uint16( 0 ) == 0x5A4D and ( $calc_luhn and $track_1_reverse and $check_validity_1 and $encode_and_send_1 and $form_create_1 and $form_create_2 and $form_create_3 )
}
rule REVERSINGLABS_Win32_Infostealer_Lumarstealer : TC_DETECTION MALICIOUS MALWARE FILE
{
	meta:
		description = "Yara rule that detects LumarStealer infostealer."
		author = "ReversingLabs"
		id = "a1358846-7cc2-53ac-89a9-c6c99f492284"
		date = "2023-12-07"
		modified = "2023-12-07"
		reference = "ReversingLabs"
		source_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/e0a0be54aa1e11ccfd6854e4f19e9476f328fd84/yara/infostealer/Win32.Infostealer.LumarStealer.yara#L1-L190"
		license_url = "https://github.com/reversinglabs/reversinglabs-yara-rules//blob/e0a0be54aa1e11ccfd6854e4f19e9476f328fd84/LICENSE"
		logic_hash = "0bc9e12396b1e85f69b965e9ea50960c59c50aba40317fb4de8f6abd092ec7d2"
		score = 75
		quality = 90
		tags = "TC_DETECTION, MALICIOUS, MALWARE, FILE"
		status = "RELEASED"
		sharing = "TLP:WHITE"
		category = "MALWARE"
		tc_detection_type = "Infostealer"
		tc_detection_name = "LumarStealer"
		tc_detection_factor = 5
		importance = 25

	strings:
		$collect_os_information_p1 = {
            55 8B EC 81 EC ?? ?? ?? ?? 53 56 B8 ?? ?? ?? ?? C1 E0 ?? 8B 88 ?? ?? ?? ?? FF D1 66
            A3 ?? ?? ?? ?? BA ?? ?? ?? ?? 66 89 55 ?? B8 ?? ?? ?? ?? 66 89 45 ?? B9 ?? ?? ?? ??
            66 89 4D ?? BA ?? ?? ?? ?? 66 89 55 ?? B8 ?? ?? ?? ?? 66 89 45 ?? B9 ?? ?? ?? ?? 66
            89 4D ?? BA ?? ?? ?? ?? 66 89 55 ?? B8 ?? ?? ?? ?? 66 89 45 ?? B9 ?? ?? ?? ?? 66 89
            4D ?? BA ?? ?? ?? ?? 66 89 55 ?? C6 45 ?? ?? EB ?? 8A 45 ?? 04 ?? 88 45 ?? 0F B6 4D
            ?? 83 F9 ?? 73 ?? 0F B6 55 ?? 0F B7 44 55 ?? 0F B7 0D ?? ?? ?? ?? 3B C1 75 ?? FF 25
            ?? ?? ?? ?? EB ?? C7 45 ?? ?? ?? ?? ?? 33 D2 89 55 ?? 89 55 ?? 89 55 ?? C7 45 ?? ??
            ?? ?? ?? 8D 75 ?? B8 ?? ?? ?? ?? 33 C9 0F A2 89 06 89 5E ?? 89 4E ?? 89 56 ?? B8 ??
            ?? ?? ?? 6B C8 ?? 8B 54 0D ?? 89 55 ?? C7 45 ?? ?? ?? ?? ?? EB ?? 8B 45 ?? 83 C0 ??
            89 45 ?? 8B 4D ?? 3B 4D ?? 77 ?? 8D 75 ?? 8B 45 ?? 33 C9 0F A2 89 06 89 5E ?? 89 4E
            ?? 89 56 ?? 81 7D ?? ?? ?? ?? ?? 75 ?? 6A ?? 8D 55 ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ??
            ?? 83 C4 ?? EB ?? 81 7D ?? ?? ?? ?? ?? 75 ?? 6A ?? 8D 45 ?? 50 68 ?? ?? ?? ?? E8 ??
            ?? ?? ?? 83 C4 ?? EB ?? 81 7D ?? ?? ?? ?? ?? 75 ?? 6A ?? 8D 4D ?? 51 68 ?? ?? ?? ??
            E8 ?? ?? ?? ?? 83 C4 ?? EB ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? C6 80 ?? ?? ??
            ?? ?? 8D 95 ?? ?? ?? ?? 52 B8 ?? ?? ?? ?? C1 E0 ?? 8B 88 ?? ?? ?? ?? FF D1 85 C0 74
            ?? 6A ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 85 ?? ?? ??
            ?? 50 B9 ?? ?? ?? ?? D1 E1 8B 91 ?? ?? ?? ?? FF D2 8B 45 ?? A3 ?? ?? ?? ?? C7 85 ??
            ?? ?? ?? ?? ?? ?? ?? 6A ?? 8D 8D ?? ?? ?? ?? 51 6A ?? 6A ?? BA ?? ?? ?? ?? 6B C2
        }
		$collect_os_information_p2 = {
            8B 88 ?? ?? ?? ?? FF D1 85 C0 74 ?? 68 ?? ?? ?? ?? 8D 95 ?? ?? ?? ?? 52 68 ?? ?? ??
            ?? E8 ?? ?? ?? ?? 83 C4 ?? 8D 45 ?? 50 B9 ?? ?? ?? ?? 6B D1 ?? 8B 82 ?? ?? ?? ?? FF
            D0 85 C0 74 ?? 6A ?? 68 ?