rule win_blindingcan_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.blindingcan." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blindingcan" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { c745e0d29c1f7b c745e4ef0dfff5 c745e85acd9c1d c745ec36c2f964 c745f0a70d9fae c745f48f2aedf1 c745f8fee389dd } // n = 7, score = 300 // c745e0d29c1f7b | mov dword ptr [ebp - 0x20], 0x7b1f9cd2 // c745e4ef0dfff5 | mov dword ptr [ebp - 0x1c], 0xf5ff0def // c745e85acd9c1d | mov dword ptr [ebp - 0x18], 0x1d9ccd5a // c745ec36c2f964 | mov dword ptr [ebp - 0x14], 0x64f9c236 // c745f0a70d9fae | mov dword ptr [ebp - 0x10], 0xae9f0da7 // c745f48f2aedf1 | mov dword ptr [ebp - 0xc], 0xf1ed2a8f // c745f8fee389dd | mov dword ptr [ebp - 8], 0xdd89e3fe $sequence_1 = { c78560feffff9cab4ad6 c78564feffff67cf2900 c78568feffff02dbaeb5 c7856cfeffffebe25848 c78570feffff94df7544 } // n = 5, score = 300 // c78560feffff9cab4ad6 | mov dword ptr [ebp - 0x1a0], 0xd64aab9c // c78564feffff67cf2900 | mov dword ptr [ebp - 0x19c], 0x29cf67 // c78568feffff02dbaeb5 | mov dword ptr [ebp - 0x198], 0xb5aedb02 // c7856cfeffffebe25848 | mov dword ptr [ebp - 0x194], 0x4858e2eb // c78570feffff94df7544 | mov dword ptr [ebp - 0x190], 0x4475df94 $sequence_2 = { c745902cab593c c74594a5337503 c745983e2c2bef c7459c506c3615 c745a07aea9b06 c745a4a603ff93 } // n = 6, score = 300 // c745902cab593c | mov dword ptr [ebp - 0x70], 0x3c59ab2c // c74594a5337503 | mov dword ptr [ebp - 0x6c], 0x37533a5 // c745983e2c2bef | mov dword ptr [ebp - 0x68], 0xef2b2c3e // c7459c506c3615 | mov dword ptr [ebp - 0x64], 0x15366c50 // c745a07aea9b06 | mov dword ptr [ebp - 0x60], 0x69bea7a // c745a4a603ff93 | mov dword ptr [ebp - 0x5c], 0x93ff03a6 $sequence_3 = { c785ccfcffffff6fc2bb c785d0fcffff54cdf11d c785d4fcffff53c2aa64 c785d8fcffffd30dedae c785dcfcffff955ef1b3 c785e0fcfffff682fbb9 } // n = 6, score = 300 // c785ccfcffffff6fc2bb | mov dword ptr [ebp - 0x334], 0xbbc26fff // c785d0fcffff54cdf11d | mov dword ptr [ebp - 0x330], 0x1df1cd54 // c785d4fcffff53c2aa64 | mov dword ptr [ebp - 0x32c], 0x64aac253 // c785d8fcffffd30dedae | mov dword ptr [ebp - 0x328], 0xaeed0dd3 // c785dcfcffff955ef1b3 | mov dword ptr [ebp - 0x324], 0xb3f15e95 // c785e0fcfffff682fbb9 | mov dword ptr [ebp - 0x320], 0xb9fb82f6 $sequence_4 = { 56 57 8bf1 6a2e } // n = 4, score = 300 // 56 | push esi // 57 | push edi // 8bf1 | mov esi, ecx // 6a2e | push 0x2e $sequence_5 = { c74598f6e3e7dd c7459c52b86f28 c745a0b5c9a315 c745a453e8ba52 c745a8b67dbc8f } // n = 5, score = 300 // c74598f6e3e7dd | mov dword ptr [ebp - 0x68], 0xdde7e3f6 // c7459c52b86f28 | mov dword ptr [ebp - 0x64], 0x286fb852 // c745a0b5c9a315 | mov dword ptr [ebp - 0x60], 0x15a3c9b5 // c745a453e8ba52 | mov dword ptr [ebp - 0x5c], 0x52bae853 // c745a8b67dbc8f | mov dword ptr [ebp - 0x58], 0x8fbc7db6 $sequence_6 = { c785f0fcffffb219e08f c785f4fcffff7939d39d c785f8fcffffe25fcedf c785fcfcfffff15112b2 c78500fdffffc2840aa6 } // n = 5, score = 300 // c785f0fcffffb219e08f | mov dword ptr [ebp - 0x310], 0x8fe019b2 // c785f4fcffff7939d39d | mov dword ptr [ebp - 0x30c], 0x9dd33979 // c785f8fcffffe25fcedf | mov dword ptr [ebp - 0x308], 0xdfce5fe2 // c785fcfcfffff15112b2 | mov dword ptr [ebp - 0x304], 0xb21251f1 // c78500fdffffc2840aa6 | mov dword ptr [ebp - 0x300], 0xa60a84c2 $sequence_7 = { c785bcfdffff661fcba8 c785c0fdffffc0f0d181 c785c4fdffff1f08c3d4 c785c8fdffff28edbc6a c785ccfdffff12aff210 c785d0fdffff860f38a4 c785d4fdffffb5d65e3e } // n = 7, score = 300 // c785bcfdffff661fcba8 | mov dword ptr [ebp - 0x244], 0xa8cb1f66 // c785c0fdffffc0f0d181 | mov dword ptr [ebp - 0x240], 0x81d1f0c0 // c785c4fdffff1f08c3d4 | mov dword ptr [ebp - 0x23c], 0xd4c3081f // c785c8fdffff28edbc6a | mov dword ptr [ebp - 0x238], 0x6abced28 // c785ccfdffff12aff210 | mov dword ptr [ebp - 0x234], 0x10f2af12 // c785d0fdffff860f38a4 | mov dword ptr [ebp - 0x230], 0xa4380f86 // c785d4fdffffb5d65e3e | mov dword ptr [ebp - 0x22c], 0x3e5ed6b5 $sequence_8 = { f7fe 8bca e8???????? 85c0 7409 e8???????? } // n = 6, score = 200 // f7fe | idiv esi // 8bca | mov ecx, edx // e8???????? | // 85c0 | test eax, eax // 7409 | je 0xb // e8???????? | $sequence_9 = { 410fb70411 6685c0 740c 668902 4883c202 4d2bc5 75de } // n = 7, score = 100 // 410fb70411 | mov esi, edx // 6685c0 | xor edx, edx // 740c | dec ebp // 668902 | test esp, esp // 4883c202 | je 0xb // 4d2bc5 | dec ecx // 75de | mov ecx, esp $sequence_10 = { 897c2420 ff15???????? 48894308 4885c0 7507 33c0 e9???????? } // n = 7, score = 100 // 897c2420 | dec eax // ff15???????? | // 48894308 | and dword ptr [edx], 0 // 4885c0 | dec eax // 7507 | and dword ptr [esp + 0x40], 0 // 33c0 | dec eax // e9???????? | $sequence_11 = { 488b05???????? 4833c4 48898590010000 48832200 488364244000 488bf2 33d2 } // n = 7, score = 100 // 488b05???????? | // 4833c4 | xor ecx, ecx // 48898590010000 | dec esp // 48832200 | mov dword ptr [esp + 0x28], esp // 488364244000 | dec esp // 488bf2 | lea eax, [0xffffeb79] // 33d2 | inc esp $sequence_12 = { 4d85e4 7409 498bcc ff15???????? 8bc3 488b8d80010000 4833cc } // n = 7, score = 100 // 4d85e4 | mov dword ptr [esp + 0x20], esp // 7409 | je 0x67 // 498bcc | dec eax // ff15???????? | // 8bc3 | xor eax, esp // 488b8d80010000 | dec eax // 4833cc | mov dword ptr [ebp + 0x190], eax $sequence_13 = { 4c8d45c0 4183c9ff 8bc8 488d85c0010000 33d2 89742428 4889442420 } // n = 7, score = 100 // 4c8d45c0 | xor eax, eax // 4183c9ff | dec esp // 8bc8 | lea eax, [ebp - 0x40] // 488d85c0010000 | inc ecx // 33d2 | or ecx, 0xffffffff // 89742428 | mov ecx, eax // 4889442420 | dec eax $sequence_14 = { 33c9 443925???????? 4c89642428 4c8d0579ebffff 4489642420 7459 ff15???????? } // n = 7, score = 100 // 33c9 | lea eax, [ebp + 0x1c0] // 443925???????? | // 4c89642428 | xor edx, edx // 4c8d0579ebffff | mov dword ptr [esp + 0x28], esi // 4489642420 | dec eax // 7459 | mov dword ptr [esp + 0x20], eax // ff15???????? | $sequence_15 = { ff15???????? 488bcf 8bd8 ff15???????? 8bc3 eb02 33c0 } // n = 7, score = 100 // ff15???????? | // 488bcf | dec eax // 8bd8 | mov ecx, edi // ff15???????? | // 8bc3 | mov ebx, eax // eb02 | mov eax, ebx // 33c0 | jmp 4 condition: 7 of them and filesize < 363520 }