rule win_cobalt_strike_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.cobalt_strike." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobalt_strike" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 3bc7 750d ff15???????? 3d33270000 } // n = 4, score = 1900 // 3bc7 | cmp eax, edi // 750d | jne 0xf // ff15???????? | // 3d33270000 | cmp eax, 0x2733 $sequence_1 = { e9???????? eb0a b801000000 e9???????? } // n = 4, score = 1900 // e9???????? | // eb0a | jmp 0xc // b801000000 | mov eax, 1 // e9???????? | $sequence_2 = { ff7508 ff15???????? 85c0 7416 395dfc 7711 68f4010000 } // n = 7, score = 1100 // ff7508 | push dword ptr [ebp + 8] // ff15???????? | // 85c0 | test eax, eax // 7416 | je 0x18 // 395dfc | cmp dword ptr [ebp - 4], ebx // 7711 | ja 0x13 // 68f4010000 | push 0x1f4 $sequence_3 = { ff35???????? ffd6 85c0 74e6 } // n = 4, score = 1100 // ff35???????? | // ffd6 | call esi // 85c0 | test eax, eax // 74e6 | je 0xffffffe8 $sequence_4 = { ff15???????? 85c0 741d ff15???????? 85c0 7513 } // n = 6, score = 1100 // ff15???????? | // 85c0 | mov eax, 1 // 741d | pop ecx // ff15???????? | // 85c0 | pop ecx // 7513 | mov edi, dword ptr [edi + 0x20] $sequence_5 = { ff7508 ff15???????? 59 59 85c0 751e } // n = 6, score = 1100 // ff7508 | push dword ptr [ebp + 8] // ff15???????? | // 59 | pop ecx // 59 | pop ecx // 85c0 | test eax, eax // 751e | jne 0x20 $sequence_6 = { ff7508 ff15???????? 03f8 03f0 83f8ff 740b 3b750c } // n = 7, score = 1100 // ff7508 | push dword ptr [ebp + 8] // ff15???????? | // 03f8 | add edi, eax // 03f0 | add esi, eax // 83f8ff | cmp eax, -1 // 740b | je 0xd // 3b750c | cmp esi, dword ptr [ebp + 0xc] $sequence_7 = { e8???????? 8b0d???????? 8901 8d45fc 50 687f660440 ff761c } // n = 7, score = 1100 // e8???????? | // 8b0d???????? | // 8901 | mov dword ptr [ecx], eax // 8d45fc | lea eax, [ebp - 4] // 50 | push eax // 687f660440 | push 0x4004667f // ff761c | push dword ptr [esi + 0x1c] $sequence_8 = { ff7508 ff15???????? 2410 33c9 3c10 0f94c1 8bc1 } // n = 7, score = 1100 // ff7508 | push dword ptr [ebp + 8] // ff15???????? | // 2410 | and al, 0x10 // 33c9 | xor ecx, ecx // 3c10 | cmp al, 0x10 // 0f94c1 | sete cl // 8bc1 | mov eax, ecx $sequence_9 = { 85c0 7405 e8???????? 8b0d???????? 85c9 } // n = 5, score = 1000 // 85c0 | cmp eax, 0x2733 // 7405 | jmp 0xc // e8???????? | // 8b0d???????? | // 85c9 | mov eax, 1 $sequence_10 = { e9???????? 833d????????01 7505 e8???????? } // n = 4, score = 900 // e9???????? | // 833d????????01 | // 7505 | jmp 0x6a // e8???????? | $sequence_11 = { 8bd0 e8???????? 85c0 7e0e } // n = 4, score = 900 // 8bd0 | mov dword ptr [ebp - 0x20], ecx // e8???????? | // 85c0 | mov eax, dword ptr [ebp - 0x20] // 7e0e | ror eax, 8 $sequence_12 = { ff04b0 488d4d97 e8???????? 8bd8 85c0 } // n = 5, score = 800 // ff04b0 | cmp eax, 0x2733 // 488d4d97 | jmp 0xc // e8???????? | // 8bd8 | mov eax, 1 // 85c0 | test eax, eax $sequence_13 = { c3 4c6309 4533c0 33d2 } // n = 4, score = 800 // c3 | je 0x21 // 4c6309 | test eax, eax // 4533c0 | jne 0x17 // 33d2 | test eax, eax $sequence_14 = { 4d8bc1 498bd6 488d4b01 c60300 e8???????? 418d7c2401 458bc5 } // n = 7, score = 800 // 4d8bc1 | jne 7 // 498bd6 | mov edx, eax // 488d4b01 | test eax, eax // c60300 | jle 0x12 // e8???????? | // 418d7c2401 | test eax, eax // 458bc5 | je 7 $sequence_15 = { e8???????? 488d4c2420 448bc7 488bd6 488bd8 e8???????? 488d4c2420 } // n = 7, score = 800 // e8???????? | // 488d4c2420 | test eax, eax // 448bc7 | je 7 // 488bd6 | test ecx, ecx // 488bd8 | jne 7 // e8???????? | // 488d4c2420 | jne 7 $sequence_16 = { 2500800000 7409 c745f040000000 eb07 c745f004000000 } // n = 5, score = 600 // 2500800000 | jne 0x26 // 7409 | push 0x10 // c745f040000000 | cmp eax, edi // eb07 | jne 0xf // c745f004000000 | cmp eax, 0x2733 $sequence_17 = { 52 8b4508 8b08 ffd1 85c0 } // n = 5, score = 400 // 52 | je 0xb // 8b4508 | mov dword ptr [ebp - 0x10], 0x40 // 8b08 | jmp 0x12 // ffd1 | mov dword ptr [ebp - 0x10], 4 // 85c0 | je 0xb $sequence_18 = { 7422 837d1000 761c 837d1404 } // n = 4, score = 400 // 7422 | test eax, eax // 837d1000 | jne 0x17 // 761c | test eax, eax // 837d1404 | je 0x21 $sequence_19 = { 51 8b5514 52 8b450c 8b4850 51 } // n = 6, score = 400 // 51 | jne 0x17 // 8b5514 | je 0x1f // 52 | test eax, eax // 8b450c | jne 0x15 // 8b4850 | test eax, eax // 51 | je 0x21 $sequence_20 = { 32c0 b940000000 f3aa 5f } // n = 4, score = 400 // 32c0 | test eax, eax // b940000000 | test eax, eax // f3aa | je 9 // 5f | test ecx, ecx $sequence_21 = { 8b4510 8b4850 8b550c 8d440ac0 } // n = 4, score = 400 // 8b4510 | mov ecx, dword ptr [ebp - 0x20] // 8b4850 | dec esp // 8b550c | mov eax, dword ptr [ebp - 0x30] // 8d440ac0 | dec eax $sequence_22 = { 6a20 8b4d10 51 8b550c } // n = 4, score = 400 // 6a20 | test eax, eax // 8b4d10 | je 9 // 51 | test ecx, ecx // 8b550c | dec esp $sequence_23 = { 56 57 8b4510 8b4850 } // n = 4, score = 400 // 56 | mov ecx, 1 // 57 | dec eax // 8b4510 | imul ecx, ecx, 1 // 8b4850 | and eax, 0x8000 $sequence_24 = { 488b542408 0fb70402 03c1 b9ff0f0000 488b1424 0fb712 } // n = 6, score = 300 // 488b542408 | dec eax // 0fb70402 | mov dword ptr [esp + 0x18], eax // 03c1 | dec eax // b9ff0f0000 | cmp dword ptr [esp + 0x28], 0 // 488b1424 | je 0x1aa // 0fb712 | dec eax $sequence_25 = { 486bc005 488b4c2448 488d840188000000 4889442418 488b442418 83780400 } // n = 6, score = 300 // 486bc005 | mov ecx, dword ptr [esp + 0x10] // 488b4c2448 | dec eax // 488d840188000000 | mov dword ptr [eax], ecx // 4889442418 | dec eax // 488b442418 | imul eax, eax, 5 // 83780400 | dec eax $sequence_26 = { 488bc1 4889442428 488b442428 813850450000 7502 } // n = 5, score = 300 // 488bc1 | mov dword ptr [esp + 8], eax // 4889442428 | dec eax // 488b442428 | mov eax, dword ptr [esp + 8] // 813850450000 | mov dword ptr [eax], 0 // 7502 | dec eax $sequence_27 = { 4889442428 488b442418 48ffc8 4889442418 48837c242800 0f8496010000 488b0424 } // n = 7, score = 300 // 4889442428 | mov dword ptr [esp + 0x18], eax // 488b442418 | dec eax // 48ffc8 | mov eax, dword ptr [esp + 0x18] // 4889442418 | cmp dword ptr [eax + 4], 0 // 48837c242800 | dec eax // 0f8496010000 | mov eax, ecx // 488b0424 | dec eax $sequence_28 = { 488bc1 4889442408 488b442408 c70000000000 } // n = 4, score = 300 // 488bc1 | mov ecx, dword ptr [esp + 0x48] // 4889442408 | dec eax // 488b442408 | lea eax, [ecx + eax + 0x88] // c70000000000 | dec eax $sequence_29 = { c644242f32 c644243000 c64424384c c64424396f c644243a61 } // n = 5, score = 300 // c644242f32 | mov byte ptr [esp + 0x2f], 0x32 // c644243000 | mov byte ptr [esp + 0x30], 0 // c64424384c | mov byte ptr [esp + 0x38], 0x4c // c64424396f | mov byte ptr [esp + 0x39], 0x6f // c644243a61 | mov byte ptr [esp + 0x3a], 0x61 $sequence_30 = { 4889542410 48894c2408 4883ec38 488b442448 488b4030 } // n = 5, score = 300 // 4889542410 | mov dword ptr [esp + 0x28], eax // 48894c2408 | dec eax // 4883ec38 | mov eax, dword ptr [esp + 0x18] // 488b442448 | dec eax // 488b4030 | dec eax $sequence_31 = { 3d00000020 7518 488b442468 488b4c2410 488908 } // n = 5, score = 300 // 3d00000020 | cmp eax, 0x20000000 // 7518 | jne 0x1a // 488b442468 | dec eax // 488b4c2410 | mov eax, dword ptr [esp + 0x68] // 488908 | dec eax condition: 7 of them and filesize < 1015808 }