YARA Detection Rule: Octowave_Loader_03_2025
Repository: Neo23x0/signature-base
Detects: Detects opcodes found in Octowave loader DLLs and WAV steganography files
Author: Jai Minton (@CyberRaiju) - HuntressLabs
Reference: https://x.com/CyberRaiju/status/[PII_REDACTED]24362946?t=u0X6ST2Qgnrf-ujjphGOSg&s=19

Pattern signatures:
$opcode_1 = {
			55
			8B EC
			56
			57
			8B D1
			33 C0
			8B FA
			6A 06
			59
			AB
			AB
			AB
			AB
			8B 45 08
			8B FA
			83 62 10 00
			8B F0
			83 62 14 00
			F3 A5
			83 60 10 00
		}
	/*
	0x3a6d 55                            push ebp
	0x3a6e 8BEC                          mov ebp, esp
	0x3a70 8B550C                        mov edx, dword ptr [ebp + 0ch]
	0x3a73 56                            push esi
	0x3a74 8BF1                          mov esi, ecx
	0x3a76 8B4614                        mov eax, dword ptr [esi + 14h]
	0x3a79 8B4E10                        mov ecx, dword ptr [esi + 10h]
	0x3a7c 2BC1                          sub eax, ecx
	0x3a7e 3BD0                          cmp edx, eax
	0x3a80 7731                          ja 3ab3h
	0x3a82 837E1407                      cmp dword ptr [esi + 14h], 7
	0x3a86 53                            push ebx
	0x3a87 8D1C11                        lea ebx, [ecx + edx]
	0x3a8a 57                            push edi
	0x3a8b 895E10               

Detection condition:
(uint16(0) == (0x5a4d) or uint32(0) == 0x46464952) 
		and filesize < 50000KB
		and all of them

Full rule:
rule Octowave_Loader_03_2025 {
    meta:
        description = "Detects opcodes found in Octowave loader DLLs and WAV steganography files"
        author = "Jai Minton (@CyberRaiju) - HuntressLabs"
        date = "2025-03-19"
		  score = 75
        license = "Detection Rule License 1.1 https://github.com/Neo23x0/signature-base/blob/master/LICENSE"
        reference = "https://x.com/CyberRaiju/status/[PII_REDACTED]24362946?t=u0X6ST2Qgnrf-ujjphGOSg&s=19"
        yt_reference = "https://www.youtube.com/watch?v=NiNIbkiuExU"
        hash1 = "0504BFBACB6E10B81196F625F2FE37B33500E7BF65FD82D3510A2B178C6CD5BD"
        hash2 = "3A2DB0CB9EE01549A6B660D58115D112D36A744D65705394B54D7D95287C7A74"
        hash3 = "EB50D06057FE123D6E9F7A76D3D1A4BC5307E8F15D017BE8F6031E92136CF36A"
        hash4 = "24715920E749B014BA05F74C96627A27355C5860A14461C106AA48A7ABA371EA"
        shoutout = "https://yaratoolkit.securitybreak.io/"
        id = "d583c416-be20-5fcf-848e-edd037e3b0d4"
	/*
	0x5bb1d 55                            push ebp
	0x5bb1e 8BEC                          mov ebp, esp
	0x5bb20 56                            push esi
	0x5bb21 57                            push edi
	0x5bb22 8BD1                          mov edx, ecx
	0x5bb24 33C0                          xor eax, eax
	0x5bb26 8BFA                          mov edi, edx
	0x5bb28 6A06                          push 6
	0x5bb2a 59                            pop ecx
	0x5bb2b AB                            stosd dword ptr es:[edi], eax
	0x5bb2c AB                            stosd dword ptr es:[edi], eax
	0x5bb2d AB                            stosd dword ptr es:[edi], eax
	0x5bb2e AB                            stosd dword ptr es:[edi], eax
	0x5bb2f 8B4508                        mov eax, dword ptr [ebp + 8]
	0x5bb32 8BFA                          mov edi, edx
	0x5bb34 83621000                      and dword ptr [edx + 10h], 0
	0x5bb38 8BF0                          mov esi, eax
	0x5bb3a 83621400                      and dword ptr [edx + 14h], 0