← Back to SOC feed Coverage →

Look for RIPEMD-160 constants

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-04-24T09:00:00Z · Confidence: medium

Hunt Hypothesis

The detection rule identifies potential use of RIPEMD-160 cryptographic constants, which may indicate adversarial activity involving custom or obfuscated code. SOC teams should proactively hunt for this behavior in Azure Sentinel to uncover stealthy malware or data exfiltration techniques that leverage RIPEMD-160 for obfuscation or encryption.

YARA Rule

rule RIPEMD160_Constants {
	meta:
		author = "phoul (@phoul)"
		description = "Look for RIPEMD-160 constants"
		date = "2014-01"
		version = "0.1"
	strings:
		$c0 = { 67452301 }
		$c1 = { EFCDAB89 }
		$c2 = { 98BADCFE }
		$c3 = { 10325476 }
		$c4 = { C3D2E1F0 }
		$c5 = { 01234567 }
		$c6 = { 89ABCDEF }
		$c7 = { FEDCBA98 }
		$c8 = { 76543210 }
		$c9 = { F0E1D2C3 }
	condition:
		5 of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 10 string patterns in its detection logic.

False Positive Guidance

Original source: https://github.com/Yara-Rules/rules/blob/main/crypto/crypto_signatures.yar