rule win_bankshot_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.bankshot." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bankshot" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8bf8 8d5101 8a01 41 84c0 75f9 57 } // n = 7, score = 300 // 8bf8 | je 0x12 // 8d5101 | push eax // 8a01 | mov eax, dword ptr [ebp + 8] // 41 | fld qword ptr [eax] // 84c0 | jmp 0xffffffca // 75f9 | mov dword ptr [ebp - 0x20], 0x1001bae8 // 57 | mov dword ptr [ebp - 0x20], 0x1001baf0 $sequence_1 = { 55 8bec 81ec48040000 a1???????? 33c5 8945f8 53 } // n = 7, score = 300 // 55 | jl 0x21 // 8bec | cmp dword ptr [edi*4 + 0x1001f180], esi // 81ec48040000 | jne 0x3a // a1???????? | // 33c5 | mov dword ptr [edi*4 + 0x1001f180], eax // 8945f8 | mov eax, dword ptr [esi + 0x1001f180] // 53 | test eax, eax $sequence_2 = { 8b4508 c700???????? 8b4508 898850030000 8b4508 59 c74048b8e40110 } // n = 7, score = 200 // 8b4508 | jne 0x17 // c700???????? | // 8b4508 | mov eax, dword ptr [ebp - 4] // 898850030000 | cmp dword ptr [eax + 0x48], 0x1001e4b8 // 8b4508 | je 0x17 // 59 | mov eax, dword ptr [ebp - 4] // c74048b8e40110 | cmp dword ptr [eax + 0x48], 0x1001e4b8 $sequence_3 = { 83c40c 0f57c0 81bde43fffff00200000 0f1185ac3affff 0f831c030000 8d8df03fffff } // n = 6, score = 200 // 83c40c | movups xmm0, xmmword ptr [esp + ecx + 0x538] // 0f57c0 | movaps xmm1, xmm2 // 81bde43fffff00200000 | pxor xmm0, xmm2 // 0f1185ac3affff | push ecx // 0f831c030000 | push eax // 8d8df03fffff | push 0 $sequence_4 = { e8???????? 83c40c e8???????? 99 b907000000 f7f9 } // n = 6, score = 200 // e8???????? | // 83c40c | dec eax // e8???????? | // 99 | mov ecx, edi // b907000000 | cmp eax, -1 // f7f9 | je 0x137 $sequence_5 = { e8???????? 83c40c 6b45e430 8945e0 8d80d0e10110 8945e4 803800 } // n = 7, score = 200 // e8???????? | // 83c40c | push 6 // 6b45e430 | lea edx, [eax + 0x1001e1c4] // 8945e0 | pop edi // 8d80d0e10110 | mov ax, word ptr [edx] // 8945e4 | lea edx, [edx + 2] // 803800 | mov word ptr [ecx], ax $sequence_6 = { 3bca 7d17 66660f1f840000000000 80b40c38050000aa } // n = 4, score = 200 // 3bca | mov dword ptr [ebp - 8], eax // 7d17 | push ebx // 66660f1f840000000000 | mov edi, eax // 80b40c38050000aa | lea edx, [ecx + 1] $sequence_7 = { e8???????? 83c404 89861c020000 8b45e0 8d4e0c 6a06 8d90c4e10110 } // n = 7, score = 200 // e8???????? | // 83c404 | mov ax, word ptr [edx] // 89861c020000 | imul eax, dword ptr [ebp - 0x1c], 0x30 // 8b45e0 | mov dword ptr [ebp - 0x20], eax // 8d4e0c | lea eax, [eax + 0x1001e1d0] // 6a06 | mov dword ptr [ebp - 0x1c], eax // 8d90c4e10110 | cmp byte ptr [eax], 0 $sequence_8 = { e9???????? 57 33ff 8bcf 8bc7 894de4 3998c0e10110 } // n = 7, score = 200 // e9???????? | // 57 | cmp edx, 0x100 // 33ff | jae 0x20 // 8bcf | mov al, byte ptr [edi + 0x1001e1bc] // 8bc7 | cmp dword ptr [eax + 0x48], 0x1001e4b8 // 894de4 | je 0x12 // 3998c0e10110 | push dword ptr [eax + 0x48] $sequence_9 = { 68e9fd0000 ff15???????? 8d8de83dffff 8bf0 8d5101 } // n = 5, score = 200 // 68e9fd0000 | mov esi, edx // ff15???????? | // 8d8de83dffff | sub esi, eax // 8bf0 | nop dword ptr [eax] // 8d5101 | nop word ptr [eax + eax] $sequence_10 = { 6a00 2bca 8d85e83dffff 51 50 6a00 68e9fd0000 } // n = 7, score = 200 // 6a00 | mov al, byte ptr [ecx] // 2bca | inc ecx // 8d85e83dffff | test al, al // 51 | jne 0 // 50 | push edi // 6a00 | sub esp, 0x448 // 68e9fd0000 | xor eax, ebp $sequence_11 = { 8bf2 2bf0 0f1f4000 660f1f840000000000 0f10840c38050000 0f28ca 660fefc2 } // n = 7, score = 200 // 8bf2 | push 0 // 2bf0 | sub ecx, edx // 0f1f4000 | lea eax, [ebp - 0xc218] // 660f1f840000000000 | push ecx // 0f10840c38050000 | push eax // 0f28ca | push 0 // 660fefc2 | push 0xfde9 $sequence_12 = { 817848b8e40110 7409 ff7048 e8???????? 59 c70701000000 } // n = 6, score = 200 // 817848b8e40110 | push 6 // 7409 | lea edx, [eax + 0x1001e1c4] // ff7048 | pop edi // e8???????? | // 59 | lea edx, [eax + 0x1001e1c4] // c70701000000 | pop edi $sequence_13 = { c74048b8e40110 8b4508 6689486c 8b4508 66898872010000 8b4508 83a04c03000000 } // n = 7, score = 200 // c74048b8e40110 | inc ecx // 8b4508 | add eax, 0x30 // 6689486c | mov dword ptr [ebp - 0x1c], ecx // 8b4508 | jmp 0x19 // 66898872010000 | cmp edx, 0x100 // 8b4508 | jae 0x1b // 83a04c03000000 | mov al, byte ptr [edi + 0x1001e1bc] $sequence_14 = { 80b40c38050000aa 41 3bca 7cf3 83fa0c 0f8ca4020000 } // n = 6, score = 200 // 80b40c38050000aa | mov dword ptr [ebp - 8], eax // 41 | push ebx // 3bca | cmp ecx, edx // 7cf3 | jge 0x1b // 83fa0c | nop word ptr [eax + eax] // 0f8ca4020000 | xor byte ptr [esp + ecx + 0x538], 0xaa $sequence_15 = { 6a00 681f000f00 50 ff5594 8bf0 } // n = 5, score = 100 // 6a00 | push ebx // 681f000f00 | push eax // 50 | mov eax, dword ptr [ebp - 0x14] // ff5594 | push dword ptr [eax + 0xc] // 8bf0 | call dword ptr [ebp - 0x18] $sequence_16 = { 83c702 57 e8???????? 83c404 8bd8 53 } // n = 6, score = 100 // 83c702 | push eax // 57 | mov eax, dword ptr [esp + 0x24] // e8???????? | // 83c404 | push ecx // 8bd8 | push 1 // 53 | lea edx, [esp + 0x14] $sequence_17 = { 0fbe02 83f82e 743f 83bde8feffff1a } // n = 4, score = 100 // 0fbe02 | mov dword ptr [ebp - 0x17], ecx // 83f82e | mov dword ptr [ebp - 0x13], ecx // 743f | mov word ptr [ebp - 0xf], cx // 83bde8feffff1a | mov byte ptr [ebp - 0xd], cl $sequence_18 = { 7c1f 3934bd80f10110 7531 e8???????? 8904bd80f10110 } // n = 5, score = 100 // 7c1f | jb 0xfffffffa // 3934bd80f10110 | mov eax, dword ptr [ebp + 8] // 7531 | mov dword ptr [eax + 0x350], ecx // e8???????? | // 8904bd80f10110 | mov eax, dword ptr [ebp + 8] $sequence_19 = { 488bfb f2ae 48f7d1 4803f1 33d2 488bcb } // n = 6, score = 100 // 488bfb | dec esp // f2ae | mov ebp, ecx // 48f7d1 | mov edx, 0x403c // 4803f1 | mov ecx, 0x40 // 33d2 | dec eax // 488bcb | mov edi, ebx $sequence_20 = { 8d542404 51 56 50 50 8b84249c000000 } // n = 6, score = 100 // 8d542404 | cdq // 51 | mov ecx, 7 // 56 | idiv ecx // 50 | mov eax, dword ptr [esp + 0x34] // 50 | mov ecx, dword ptr [esp + 0x28] // 8b84249c000000 | mov edx, dword ptr [esp + 0x24] $sequence_21 = { 8b8680f10110 85c0 740e 50 e8???????? } // n = 5, score = 100 // 8b8680f10110 | pop ecx // 85c0 | mov dword ptr [eax + 0x48], 0x1001e4b8 // 740e | mov eax, dword ptr [ebp + 8] // 50 | mov word ptr [eax + 0x6c], cx // e8???????? | $sequence_22 = { 7435 51 682e010000 8d85bcfeffff } // n = 4, score = 100 // 7435 | mov edi, eax // 51 | push 0xfde9 // 682e010000 | call dword ptr [ebp - 0xda0] // 8d85bcfeffff | mov eax, dword ptr [ebp - 0xd9c] $sequence_23 = { 8d8dfcf3ffff 51 6a00 ff15???????? 8985ecf3ffff 83bdecf3ffff00 } // n = 6, score = 100 // 8d8dfcf3ffff | cdq // 51 | mov ecx, 7 // 6a00 | idiv ecx // ff15???????? | // 8985ecf3ffff | add esp, 0xc // 83bdecf3ffff00 | cdq $sequence_24 = { c744242001000000 e8???????? 85c0 0f84ca010000 } // n = 4, score = 100 // c744242001000000 | repne scasb al, byte ptr es:[edi] // e8???????? | // 85c0 | dec eax // 0f84ca010000 | not ecx $sequence_25 = { 8b442434 8b4c2428 8b542424 50 8b442424 51 } // n = 6, score = 100 // 8b442434 | cdq // 8b4c2428 | mov ecx, 7 // 8b542424 | add esp, 0xc // 50 | cdq // 8b442424 | mov ecx, 7 // 51 | add esp, 0xc $sequence_26 = { ff15???????? 898588f8ffff c78574f8ffffffffffff c78560f8ffff00000000 c7858cf8ffff00000000 6802040000 } // n = 6, score = 100 // ff15???????? | // 898588f8ffff | cmp dword ptr [ebp - 0x678], 0 // c78574f8ffffffffffff | je 0x15 // c78560f8ffff00000000 | mov dword ptr [ebp - 0x680], 0 // c7858cf8ffff00000000 | jmp 0x16 // 6802040000 | mov dword ptr [ebp - 0x680], 2 $sequence_27 = { 89442440 e8???????? 85c0 0f84b9010000 } // n = 4, score = 100 // 89442440 | je 0x176 // e8???????? | // 85c0 | mov edx, dword ptr [esp + 0x44] // 0f84b9010000 | dec ecx $sequence_28 = { 894de5 894de9 894ded 66894df1 884df3 ff15???????? } // n = 6, score = 100 // 894de5 | mov ecx, 7 // 894de9 | add esp, 0xc // 894ded | cdq // 66894df1 | mov ecx, 7 // 884df3 | add esp, 0xc // ff15???????? | $sequence_29 = { 488bcf ff15???????? 83f8ff 0f842e010000 488d0d0f7f0000 } // n = 5, score = 100 // 488bcf | mov dword ptr [esp + 0x20], 1 // ff15???????? | // 83f8ff | test eax, eax // 0f842e010000 | je 0x1d0 // 488d0d0f7f0000 | test eax, eax $sequence_30 = { 0f8d35040000 8b0d???????? 038dd8fbffff 81e10f000080 7905 } // n = 5, score = 100 // 0f8d35040000 | push 0 // 8b0d???????? | // 038dd8fbffff | mov dword ptr [ebp - 0xc14], eax // 81e10f000080 | cmp dword ptr [ebp - 0xc14], 0 // 7905 | mov dword ptr [ebp - 0x1b], ecx $sequence_31 = { 8b148d40904100 33d0 a1???????? 33d0 33c0 8915???????? } // n = 6, score = 100 // 8b148d40904100 | push 4 // 33d0 | mov dword ptr [esp + 0x18], eax // a1???????? | // 33d0 | lea edx, [esp + 4] // 33c0 | push ecx // 8915???????? | $sequence_32 = { 6a01 8d542414 6a04 89442418 } // n = 4, score = 100 // 6a01 | cdq // 8d542414 | mov ecx, 7 // 6a04 | idiv ecx // 89442418 | add esp, 0xc $sequence_33 = { 8b4d08 51 0fb7956cd4ffff 83c21a 52 8b4d0c } // n = 6, score = 100 // 8b4d08 | jge 0x43b // 51 | add ecx, dword ptr [ebp - 0x428] // 0fb7956cd4ffff | and ecx, 0x8000000f // 83c21a | jns 0xd // 52 | movsx eax, byte ptr [edx] // 8b4d0c | cmp eax, 0x2e $sequence_34 = { 83c414 85c0 7503 83ceff } // n = 4, score = 100 // 83c414 | xor edx, eax // 85c0 | xor edx, eax // 7503 | xor eax, eax // 83ceff | pop ebp $sequence_35 = { c78564f7ffff082a3b00 8bcb 6808040000 50 e8???????? c78550f7ffff01000000 } // n = 6, score = 100 // c78564f7ffff082a3b00 | xor ecx, ecx // 8bcb | push 0x20000000 // 6808040000 | push eax // 50 | mov word ptr [ebp + eax*2 - 0xd90], cx // e8???????? | // c78550f7ffff01000000 | push 0 $sequence_36 = { 83bd88f9ffff00 740c c78580f9ffff00000000 eb0a c78580f9ffff02000000 } // n = 5, score = 100 // 83bd88f9ffff00 | cdq // 740c | mov ecx, 7 // c78580f9ffff00000000 | idiv ecx // eb0a | lea ecx, [ebp - 0xc04] // c78580f9ffff02000000 | push ecx $sequence_37 = { 8d83e60e0000 8bca 50 83e103 8d442448 68???????? } // n = 6, score = 100 // 8d83e60e0000 | push edi // 8bca | add esp, 4 // 50 | mov ebx, eax // 83e103 | push ebx // 8d442448 | mov edx, dword ptr [ecx*4 + 0x419040] // 68???????? | $sequence_38 = { 894ddc c745e064410110 e9???????? c745dc03000000 c745e070410110 e9???????? } // n = 6, score = 100 // 894ddc | inc ecx // c745e064410110 | test al, al // e9???????? | // c745dc03000000 | jne 3 // c745e070410110 | push edi // e9???????? | $sequence_39 = { 53 50 8b45ec ff700c ff55e8 8bf8 } // n = 6, score = 100 // 53 | sub esp, 0x448 // 50 | xor eax, ebp // 8b45ec | mov dword ptr [ebp - 8], eax // ff700c | push ebx // ff55e8 | mov ebp, esp // 8bf8 | sub esp, 0x448 $sequence_40 = { 68e9fd0000 ff9560f2ffff 8b8564f2ffff 33c9 6800000020 50 66898c4570f2ffff } // n = 7, score = 100 // 68e9fd0000 | xor eax, ebp // ff9560f2ffff | mov dword ptr [ebp - 8], eax // 8b8564f2ffff | push ebx // 33c9 | mov dword ptr [ebp - 0x24], ecx // 6800000020 | mov dword ptr [ebp - 0x20], 0x10014164 // 50 | mov dword ptr [ebp - 0x24], 3 // 66898c4570f2ffff | mov dword ptr [ebp - 0x20], 0x10014170 $sequence_41 = { 4889842470010000 488bfa 4c8be9 ba3c400000 b940000000 } // n = 5, score = 100 // 4889842470010000 | mov dword ptr [esp + 0x20], ebx // 488bfa | dec eax // 4c8be9 | mov dword ptr [esp + 0x170], eax // ba3c400000 | dec eax // b940000000 | mov edi, edx $sequence_42 = { 85c0 0f846e010000 8b542444 498bcc 2bf2 } // n = 5, score = 100 // 85c0 | dec eax // 0f846e010000 | add esi, ecx // 8b542444 | xor edx, edx // 498bcc | dec eax // 2bf2 | mov ecx, ebx $sequence_43 = { 8bf8 ff15???????? 81ff10030000 75d6 e8???????? 85c0 740a } // n = 7, score = 100 // 8bf8 | mov edi, eax // ff15???????? | // 81ff10030000 | cmp edi, 0x310 // 75d6 | jne 0xffffffd8 // e8???????? | // 85c0 | test eax, eax // 740a | je 0xc $sequence_44 = { 8b05???????? 488b4c2438 8947ff 895c2420 ff15???????? } // n = 5, score = 100 // 8b05???????? | // 488b4c2438 | dec eax // 8947ff | mov ecx, dword ptr [esp + 0x38] // 895c2420 | mov dword ptr [edi - 1], eax // ff15???????? | condition: 7 of them and filesize < 860160 }