rule win_amadey_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.amadey." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 83f802 7427 e8???????? 83f810 741d } // n = 5, score = 900 // 83f802 | cmp eax, 2 // 7427 | je 0x29 // e8???????? | // 83f810 | cmp eax, 0x10 // 741d | je 0x1f $sequence_1 = { 68e8030000 ff15???????? 8b551c 83fa10 } // n = 4, score = 900 // 68e8030000 | push 0x3e8 // ff15???????? | // 8b551c | mov edx, dword ptr [ebp + 0x1c] // 83fa10 | cmp edx, 0x10 $sequence_2 = { 8b3e 8a0402 88040f 41 8b7dfc } // n = 5, score = 900 // 8b3e | mov edi, dword ptr [esi] // 8a0402 | mov al, byte ptr [edx + eax] // 88040f | mov byte ptr [edi + ecx], al // 41 | inc ecx // 8b7dfc | mov edi, dword ptr [ebp - 4] $sequence_3 = { 83c408 837d3410 8d4520 68???????? 0f434520 50 e8???????? } // n = 7, score = 900 // 83c408 | add esp, 8 // 837d3410 | cmp dword ptr [ebp + 0x34], 0x10 // 8d4520 | lea eax, [ebp + 0x20] // 68???????? | // 0f434520 | cmovae eax, dword ptr [ebp + 0x20] // 50 | push eax // e8???????? | $sequence_4 = { 8bcc 68???????? e8???????? 8d4dcc e8???????? 83c418 } // n = 6, score = 900 // 8bcc | mov ecx, esp // 68???????? | // e8???????? | // 8d4dcc | lea ecx, [ebp - 0x34] // e8???????? | // 83c418 | add esp, 0x18 $sequence_5 = { 1bc0 f7d8 8bd0 e8???????? } // n = 4, score = 900 // 1bc0 | sbb eax, eax // f7d8 | neg eax // 8bd0 | mov edx, eax // e8???????? | $sequence_6 = { 0f820f010000 8b4d50 42 8bc1 81fa00100000 0f82f3000000 } // n = 6, score = 900 // 0f820f010000 | jb 0x115 // 8b4d50 | mov ecx, dword ptr [ebp + 0x50] // 42 | inc edx // 8bc1 | mov eax, ecx // 81fa00100000 | cmp edx, 0x1000 // 0f82f3000000 | jb 0xf9 $sequence_7 = { 83ec18 8bcc 68???????? e8???????? 8d4db4 e8???????? 83c418 } // n = 7, score = 900 // 83ec18 | sub esp, 0x18 // 8bcc | mov ecx, esp // 68???????? | // e8???????? | // 8d4db4 | lea ecx, [ebp - 0x4c] // e8???????? | // 83c418 | add esp, 0x18 $sequence_8 = { 8bcc 68???????? e8???????? 8d4d98 e8???????? 83c418 } // n = 6, score = 800 // 8bcc | mov ecx, esp // 68???????? | // e8???????? | // 8d4d98 | lea ecx, [ebp - 0x68] // e8???????? | // 83c418 | add esp, 0x18 $sequence_9 = { 83fa10 722f 8b8d78feffff 42 8bc1 } // n = 5, score = 800 // 83fa10 | cmp edx, 0x10 // 722f | jb 0x31 // 8b8d78feffff | mov ecx, dword ptr [ebp - 0x188] // 42 | inc edx // 8bc1 | mov eax, ecx $sequence_10 = { e8???????? 40 895c2408 89442404 8b4508 } // n = 5, score = 700 // e8???????? | // 40 | inc eax // 895c2408 | mov dword ptr [esp + 8], ebx // 89442404 | mov dword ptr [esp + 4], eax // 8b4508 | mov eax, dword ptr [ebp + 8] $sequence_11 = { c745fcffffffff c745f800000000 8b4508 803800 7451 } // n = 5, score = 700 // c745fcffffffff | mov dword ptr [ebp - 4], 0xffffffff // c745f800000000 | mov dword ptr [ebp - 8], 0 // 8b4508 | mov eax, dword ptr [ebp + 8] // 803800 | cmp byte ptr [eax], 0 // 7451 | je 0x53 $sequence_12 = { 7514 c7442404???????? c70424???????? e8???????? 6683bd28ffffff00 } // n = 5, score = 700 // 7514 | jne 0x16 // c7442404???????? | // c70424???????? | // e8???????? | // 6683bd28ffffff00 | cmp word ptr [ebp - 0xd8], 0 $sequence_13 = { 89442404 c70424???????? e8???????? 837d0801 7530 c7442404???????? c70424???????? } // n = 7, score = 700 // 89442404 | mov dword ptr [esp + 4], eax // c70424???????? | // e8???????? | // 837d0801 | cmp dword ptr [ebp + 8], 1 // 7530 | jne 0x32 // c7442404???????? | // c70424???????? | $sequence_14 = { 56 57 8b3d???????? 83ec18 } // n = 4, score = 700 // 56 | push esi // 57 | push edi // 8b3d???????? | // 83ec18 | sub esp, 0x18 $sequence_15 = { 890424 e8???????? c70424???????? e8???????? 89442404 8d85e8feffff 890424 } // n = 7, score = 700 // 890424 | mov dword ptr [esp], eax // e8???????? | // c70424???????? | // e8???????? | // 89442404 | mov dword ptr [esp + 4], eax // 8d85e8feffff | lea eax, [ebp - 0x118] // 890424 | mov dword ptr [esp], eax $sequence_16 = { 89442404 891424 e8???????? 83ec20 c70424???????? e8???????? } // n = 6, score = 700 // 89442404 | mov dword ptr [esp + 4], eax // 891424 | mov dword ptr [esp], edx // e8???????? | // 83ec20 | sub esp, 0x20 // c70424???????? | // e8???????? | $sequence_17 = { 8d45fc ff00 8b450c 890424 } // n = 4, score = 700 // 8d45fc | lea eax, [ebp - 4] // ff00 | inc dword ptr [eax] // 8b450c | mov eax, dword ptr [ebp + 0xc] // 890424 | mov dword ptr [esp], eax $sequence_18 = { ebe6 e8???????? 890424 e8???????? ebd7 } // n = 5, score = 700 // ebe6 | jmp 0xffffffe8 // e8???????? | // 890424 | mov dword ptr [esp], eax // e8???????? | // ebd7 | jmp 0xffffffd9 $sequence_19 = { 5d c3 68???????? e8???????? e8???????? 68???????? e8???????? } // n = 7, score = 700 // 5d | pop ebp // c3 | ret // 68???????? | // e8???????? | // e8???????? | // 68???????? | // e8???????? | $sequence_20 = { 83fa10 722f 8b8d60feffff 42 } // n = 4, score = 600 // 83fa10 | cmp edx, 0x10 // 722f | jb 0x31 // 8b8d60feffff | mov ecx, dword ptr [ebp - 0x1a0] // 42 | inc edx $sequence_21 = { 51 e8???????? 83c408 8b9514feffff } // n = 4, score = 600 // 51 | push ecx // e8???????? | // 83c408 | add esp, 8 // 8b9514feffff | mov edx, dword ptr [ebp - 0x1ec] condition: 7 of them and filesize < 908288 }