← Back to SOC feed Coverage →

Finds the custom xor decode loop for <PolishBankRAT_srservice>

yara LOW Yara-Rules
backdoorcommunity
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-06-28T11:00:00Z · Confidence: medium

Hunt Hypothesis

This hunt targets adversaries deploying the PolishBankRAT malware by identifying its unique XOR decoding loop within the srservice process to confirm active payload execution. Proactively hunting for this signature in Azure Sentinel is critical because it enables early detection of banking sector threats before they establish persistence or exfiltrate sensitive financial data.

YARA Rule

rule PolishBankRAT_srservice_xorloop 
{
	meta:
	
		author = "Booz Allen Hamilton Dark Labs"
		description = "Finds the custom xor decode loop for <PolishBankRAT_srservice>"
	
	strings:

		$loop = { 48 8B CD E8 60 FF FF FF 48 FF C3 32 44 1E FF 48 FF CF 88 43 FF }

	condition:

		(uint16(0) == 0x5A4D and uint32(uint32(0x3C)) == 0x00004550) and $loop
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 4 specific false positive scenarios for the PolishBankRAT_srservice XOR decode detection rule in an enterprise environment:

Original source: https://github.com/Yara-Rules/rules/blob/main/malware/MALW_PolishBankRat.yar