rule win_latrodectus_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.latrodectus." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.latrodectus" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { e8???????? 89442424 8b442428 39442424 7404 33c0 eb47 } // n = 7, score = 6900 // e8???????? | // 89442424 | mov ecx, dword ptr [esp + 0xd0] // 8b442428 | dec eax // 39442424 | mov dword ptr [esp + 0x40], 0 // 7404 | mov edx, 0x250 // 33c0 | dec eax // eb47 | lea ecx, [esp + 0x90] $sequence_1 = { 4533c9 440fb7442470 488b542468 488b4c2440 ff15???????? 4889442448 48837c244800 } // n = 7, score = 6900 // 4533c9 | mov ecx, dword ptr [esp + 0x20] // 440fb7442470 | inc esp // 488b542468 | mov ecx, ecx // 488b4c2440 | inc ebp // ff15???????? | // 4889442448 | xor ecx, ecx // 48837c244800 | inc esp $sequence_2 = { e9???????? 48c744244000000000 ba50020000 488d8c2490000000 e8???????? 488d942490000000 488b4c2420 } // n = 7, score = 6900 // e9???????? | // 48c744244000000000 | and eax, 0xff // ba50020000 | sub eax, edx // 488d8c2490000000 | dec eax // e8???????? | // 488d942490000000 | mov ecx, dword ptr [esp + 0x40] // 488b4c2420 | mov dword ptr [ecx + 0x108], eax $sequence_3 = { 488b4c2440 488b09 e8???????? 8b4c2420 448bc9 } // n = 5, score = 6900 // 488b4c2440 | dec eax // 488b09 | mov ecx, dword ptr [esp + 0x40] // e8???????? | // 8b4c2420 | dec eax // 448bc9 | mov ecx, dword ptr [ecx] $sequence_4 = { 488b842488000000 4889442428 488d442458 4889442420 4533c9 4533c0 33d2 } // n = 7, score = 6900 // 488b842488000000 | dec eax // 4889442428 | mov eax, dword ptr [esp + 0x40] // 488d442458 | mov ecx, 0x64 // 4889442420 | xor edx, edx // 4533c9 | dec eax // 4533c0 | mov ecx, dword ptr [esp + 0xd0] // 33d2 | dec eax $sequence_5 = { b964000000 e8???????? e9???????? 33d2 488b8c24d0000000 ff15???????? 488b8c24d0000000 } // n = 7, score = 6900 // b964000000 | mov dword ptr [esp + 0x48], eax // e8???????? | // e9???????? | // 33d2 | dec eax // 488b8c24d0000000 | cmp dword ptr [esp + 0x48], 0 // ff15???????? | // 488b8c24d0000000 | add eax, edx $sequence_6 = { 03c2 25ff000000 2bc2 488b4c2440 898108010000 488b442440 } // n = 6, score = 6900 // 03c2 | movzx eax, word ptr [esp + 0x70] // 25ff000000 | dec eax // 2bc2 | mov edx, dword ptr [esp + 0x68] // 488b4c2440 | dec eax // 898108010000 | mov ecx, dword ptr [esp + 0x40] // 488b442440 | dec eax $sequence_7 = { 0f84c9000000 488b442428 8b4c2458 8908 488b4c2460 e8???????? } // n = 6, score = 6900 // 0f84c9000000 | dec eax // 488b442428 | lea edx, [esp + 0x90] // 8b4c2458 | dec eax // 8908 | mov ecx, dword ptr [esp + 0x20] // 488b4c2460 | dec eax // e8???????? | $sequence_8 = { 0faee8 e8???????? 8b451b 894304 0f10451f 0f114308 0f104d2f } // n = 7, score = 100 // 0faee8 | mov edx, dword ptr [esp + 0x78] // e8???????? | // 8b451b | dec eax // 894304 | lea ecx, [esp + 0x28] // 0f10451f | dec eax // 0f114308 | mov ecx, dword ptr [esp + 0x78] // 0f104d2f | dec eax $sequence_9 = { 48634804 48837c314800 450f45f5 440b743110 440bf3 4183e617 4489743110 } // n = 7, score = 100 // 48634804 | xor eax, eax // 48837c314800 | dec eax // 450f45f5 | mov ecx, dword ptr [esp + 0x40] // 440b743110 | dec eax // 440bf3 | arpl word ptr [ecx + 0x108], cx // 4183e617 | dec eax // 4489743110 | mov edx, dword ptr [esp + 0x40] $sequence_10 = { 3bd1 7d43 2bca 4863f9 85c9 7e3a 0f1f00 } // n = 7, score = 100 // 3bd1 | movzx ecx, byte ptr [edx + ecx] // 7d43 | add eax, ecx // 2bca | cdq // 4863f9 | and edx, 0xff // 85c9 | dec eax // 7e3a | lea ecx, [esp + 0x28] // 0f1f00 | dec eax $sequence_11 = { 483bfd 75c6 488bac2490000000 498bc6 49891e 488b4c2458 4833cc } // n = 7, score = 100 // 483bfd | dec eax // 75c6 | cmp dword ptr [esp + 0x20], 0 // 488bac2490000000 | jne 0x1d // 498bc6 | mov eax, dword ptr [esp] // 49891e | dec eax // 488b4c2458 | mov ecx, dword ptr [esp + 0x20] // 4833cc | movsx eax, byte ptr [ecx + eax] $sequence_12 = { 4157 488dac2430fcffff 4881ecd0040000 488b05???????? 4833c4 488985c0030000 498bd8 } // n = 7, score = 100 // 4157 | test eax, eax // 488dac2430fcffff | jne 0xf // 4881ecd0040000 | jmp 0x1e // 488b05???????? | // 4833c4 | mov eax, dword ptr [esp] // 488985c0030000 | cmp eax, 0x7a // 498bd8 | jg 0x11 $sequence_13 = { 4883781807 7603 488b00 ba14000000 895c2428 4889442420 4d8b4d38 } // n = 7, score = 100 // 4883781807 | mov ecx, dword ptr [esp + 0x40] // 7603 | dec eax // 488b00 | mov dword ptr [esp + 0x48], eax // ba14000000 | dec eax // 895c2428 | cmp dword ptr [esp + 0x48], 0 // 4889442420 | jne 0xf // 4d8b4d38 | jmp 0x15 $sequence_14 = { 0f1145f8 f20f104f10 f20f114d08 8b4718 894510 48634714 85c0 } // n = 7, score = 100 // 0f1145f8 | add esp, 0x38 // f20f104f10 | ret // f20f114d08 | dec eax // 8b4718 | mov dword ptr [esp + 8], ecx // 894510 | dec eax // 48634714 | sub esp, 0x18 // 85c0 | mov dword ptr [esp], 0 $sequence_15 = { 0f95c0 84c0 741e 4885c9 750b 488d0d90110700 48894b40 } // n = 7, score = 100 // 0f95c0 | movsx eax, byte ptr [esp + 0x20] // 84c0 | sub eax, 0x47 // 741e | mov word ptr [esp + 0x24], ax // 4885c9 | jmp 0x1b // 750b | dec eax // 488d0d90110700 | mov eax, dword ptr [esp + 0x40] // 48894b40 | jne 8 condition: 7 of them and filesize < 2467840 }