DoejoCrypt.yar

rule DoejoCrypt {
  meta:
    description = "DoejoCrypt Detection"
    author = "James Quinn"
    date = "March 12 2021"
    tlp = "White"
  strings:
    $s1 = {C7 ?? 01 23 45 67 C7 ?? ?? 89 AB CD EF C7 ?? ?? FE DC BA 98 C7 ?? ?? 76 54 32 10}
    $s2 = {7C ?? 3C 5A 7E ?? 3C 63 0F ?? ?? ?? ?? ?? 3C 7A}
    $s3 = {2B C7 03 C2 3D 14 05 00 00}
  condition:
    all of them
}