rule win_ghostsocks_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.ghostsocks." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostsocks" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { e8???????? 8d3c24 8db424ac030000 e8???????? } // n = 4, score = 300 // e8???????? | // 8d3c24 | lea edi, [esp] // 8db424ac030000 | lea esi, [esp + 0x3ac] // e8???????? | $sequence_1 = { e8???????? 8b8424d4010000 8b08 8b9424ac000000 } // n = 4, score = 300 // e8???????? | // 8b8424d4010000 | mov eax, dword ptr [esp + 0x1d4] // 8b08 | mov ecx, dword ptr [eax] // 8b9424ac000000 | mov edx, dword ptr [esp + 0xac] $sequence_2 = { e8???????? 90 8b8424b0000000 890424 } // n = 4, score = 300 // e8???????? | // 90 | nop // 8b8424b0000000 | mov eax, dword ptr [esp + 0xb0] // 890424 | mov dword ptr [esp], eax $sequence_3 = { e8???????? 8b8c2484010000 898c24e0000000 8b9c2488010000 } // n = 4, score = 300 // e8???????? | // 8b8c2484010000 | mov ecx, dword ptr [esp + 0x184] // 898c24e0000000 | mov dword ptr [esp + 0xe0], ecx // 8b9c2488010000 | mov ebx, dword ptr [esp + 0x188] $sequence_4 = { e8???????? 8d3c24 8db424a0000000 e8???????? } // n = 4, score = 300 // e8???????? | // 8d3c24 | lea edi, [esp] // 8db424a0000000 | lea esi, [esp + 0xa0] // e8???????? | $sequence_5 = { e8???????? 8b842420010000 8907 8b5114 } // n = 4, score = 300 // e8???????? | // 8b842420010000 | mov eax, dword ptr [esp + 0x120] // 8907 | mov dword ptr [edi], eax // 8b5114 | mov edx, dword ptr [ecx + 0x14] $sequence_6 = { e8???????? 90 8b842488000000 8b4c2474 } // n = 4, score = 300 // e8???????? | // 90 | nop // 8b842488000000 | mov eax, dword ptr [esp + 0x88] // 8b4c2474 | mov ecx, dword ptr [esp + 0x74] $sequence_7 = { e8???????? 90 8b84242c010000 890424 89442404 8b8c2430010000 } // n = 6, score = 300 // e8???????? | // 90 | nop // 8b84242c010000 | mov eax, dword ptr [esp + 0x12c] // 890424 | mov dword ptr [esp], eax // 89442404 | mov dword ptr [esp + 4], eax // 8b8c2430010000 | mov ecx, dword ptr [esp + 0x130] $sequence_8 = { e8???????? 8985603efbff 8995643efbff 8b95bcaffcff } // n = 4, score = 100 // e8???????? | // 8985603efbff | mov dword ptr [ebp - 0x4c1a0], eax // 8995643efbff | mov dword ptr [ebp - 0x4c19c], edx // 8b95bcaffcff | mov edx, dword ptr [ebp - 0x35044] $sequence_9 = { e8???????? 8985603efaff 8995643efaff 0fbe15???????? } // n = 4, score = 100 // e8???????? | // 8985603efaff | mov dword ptr [ebp - 0x5c1a0], eax // 8995643efaff | mov dword ptr [ebp - 0x5c19c], edx // 0fbe15???????? | $sequence_10 = { e8???????? 89856026fcff 89956426fcff 0fb615???????? 0fb60d???????? d3fa 8815???????? } // n = 7, score = 100 // e8???????? | // 89856026fcff | mov dword ptr [ebp - 0x3d9a0], eax // 89956426fcff | mov dword ptr [ebp - 0x3d99c], edx // 0fb615???????? | // 0fb60d???????? | // d3fa | sar edx, cl // 8815???????? | $sequence_11 = { e8???????? 8985602efaff 8995642efaff 0fbe95e2e5faff } // n = 4, score = 100 // e8???????? | // 8985602efaff | mov dword ptr [ebp - 0x5d1a0], eax // 8995642efaff | mov dword ptr [ebp - 0x5d19c], edx // 0fbe95e2e5faff | movsx edx, byte ptr [ebp - 0x51a1e] $sequence_12 = { e8???????? 8985603cfeff 8995643cfeff 8b8544d8faff } // n = 4, score = 100 // e8???????? | // 8985603cfeff | mov dword ptr [ebp - 0x1c3a0], eax // 8995643cfeff | mov dword ptr [ebp - 0x1c39c], edx // 8b8544d8faff | mov eax, dword ptr [ebp - 0x527bc] $sequence_13 = { e8???????? 8985602cffff 8995642cffff 0fb685b391fcff } // n = 4, score = 100 // e8???????? | // 8985602cffff | mov dword ptr [ebp - 0xd3a0], eax // 8995642cffff | mov dword ptr [ebp - 0xd39c], edx // 0fb685b391fcff | movzx eax, byte ptr [ebp - 0x36e4d] $sequence_14 = { e8???????? 89856026fcff 89956426fcff 8b8d00f4feff 0fb601 0fb60d???????? } // n = 6, score = 100 // e8???????? | // 89856026fcff | mov dword ptr [ebp - 0x3d9a0], eax // 89956426fcff | mov dword ptr [ebp - 0x3d99c], edx // 8b8d00f4feff | mov ecx, dword ptr [ebp - 0x10c00] // 0fb601 | movzx eax, byte ptr [ecx] // 0fb60d???????? | $sequence_15 = { e8???????? 89856026fcff 89956426fcff a1???????? 0fb608 8b952805ffff } // n = 6, score = 100 // e8???????? | // 89856026fcff | mov dword ptr [ebp - 0x3d9a0], eax // 89956426fcff | mov dword ptr [ebp - 0x3d99c], edx // a1???????? | // 0fb608 | movzx ecx, byte ptr [eax] // 8b952805ffff | mov edx, dword ptr [ebp - 0xfad8] condition: 7 of them and filesize < 25016320 }