rule win_karius_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.karius." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karius" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 85db 0f8477000000 8bb424b0000000 418b10 } // n = 4, score = 400 // 85db | je 0x9d // 0f8477000000 | dec ecx // 8bb424b0000000 | mov ecx, esi // 418b10 | call ebx $sequence_1 = { 8bb424b0000000 418b10 8bcd 4903d6 0fb602 } // n = 5, score = 400 // 8bb424b0000000 | mov edx, dword ptr [eax] // 418b10 | mov ecx, ebp // 8bcd | dec ecx // 4903d6 | add edx, esi // 0fb602 | movzx eax, byte ptr [edx] $sequence_2 = { 498bce ffd3 4183bf8c00000000 0f84b3000000 458b9f88000000 } // n = 5, score = 400 // 498bce | mov ebx, dword ptr [ebx + 0x18] // ffd3 | test ebx, ebx // 4183bf8c00000000 | je 0xa5 // 0f84b3000000 | inc ecx // 458b9f88000000 | cmp dword ptr [ebx + 0x14], 0 $sequence_3 = { 488b05???????? 4885c0 7512 ff15???????? 488905???????? } // n = 5, score = 400 // 488b05???????? | // 4885c0 | inc ecx // 7512 | cmp dword ptr [ebx + 0x14], 0 // ff15???????? | // 488905???????? | $sequence_4 = { 0f8492000000 458b4320 458b5324 33ed } // n = 4, score = 400 // 0f8492000000 | dec ebp // 458b4320 | add ebx, esi // 458b5324 | inc ecx // 33ed | mov ebx, dword ptr [ebx + 0x18] $sequence_5 = { 41b830000000 488bcf ff15???????? 4885c0 } // n = 4, score = 400 // 41b830000000 | mov ecx, esi // 488bcf | call ebx // ff15???????? | // 4885c0 | inc ecx $sequence_6 = { 418b5b18 85db 0f849d000000 41837b1400 0f8492000000 } // n = 5, score = 400 // 418b5b18 | inc ecx // 85db | mov ebx, dword ptr [ebx + 0x18] // 0f849d000000 | test ebx, ebx // 41837b1400 | je 0xa3 // 0f8492000000 | inc ecx $sequence_7 = { c3 85c0 7505 e8???????? b801000000 } // n = 5, score = 400 // c3 | inc ecx // 85c0 | mov ebx, dword ptr [ebx + 0x18] // 7505 | test ebx, ebx // e8???????? | // b801000000 | je 0xa5 $sequence_8 = { 33ed 4d03c6 4d03d6 448bcd 85db 0f8477000000 } // n = 6, score = 400 // 33ed | mov edx, dword ptr [ebx + 0x24] // 4d03c6 | dec ebp // 4d03d6 | add edx, esi // 448bcd | inc esp // 85db | mov ecx, ebp // 0f8477000000 | test ebx, ebx $sequence_9 = { 488bc8 ff15???????? 4c8be8 498bce ff15???????? } // n = 5, score = 300 // 488bc8 | mov ecx, ebp // ff15???????? | // 4c8be8 | dec ecx // 498bce | add edx, esi // ff15???????? | $sequence_10 = { 4d8bcf 33d2 41b800001000 488bce } // n = 4, score = 300 // 4d8bcf | je 0xa3 // 33d2 | inc ecx // 41b800001000 | cmp dword ptr [ebx + 0x14], 0 // 488bce | je 0x9d $sequence_11 = { 8bf0 83c40c 85f6 7427 8bff 8a06 84c0 } // n = 7, score = 300 // 8bf0 | je 0xac // 83c40c | inc ecx // 85f6 | cmp dword ptr [ebx + 0x14], 0 // 7427 | je 0xac // 8bff | je 0xa3 // 8a06 | inc ecx // 84c0 | cmp dword ptr [ebx + 0x14], 0 $sequence_12 = { 3c66 0f8fa2000000 0fbec8 83e957 } // n = 4, score = 300 // 3c66 | call ebx // 0f8fa2000000 | inc ecx // 0fbec8 | cmp dword ptr [edi + 0x8c], 0 // 83e957 | je 0xd5 $sequence_13 = { 3c30 7c04 3c39 7ee3 803f2e 752c 8a4701 } // n = 7, score = 300 // 3c30 | dec eax // 7c04 | test eax, eax // 3c39 | jne 0x17 // 7ee3 | inc ecx // 803f2e | mov ebx, dword ptr [ebx + 0x18] // 752c | test ebx, ebx // 8a4701 | je 0xa3 $sequence_14 = { 7405 f60001 7502 33c0 } // n = 4, score = 300 // 7405 | inc ecx // f60001 | cmp dword ptr [ebx + 0x14], 0 // 7502 | dec eax // 33c0 | test eax, eax $sequence_15 = { eb06 803900 0f94c0 84c0 0f85a1000000 8a6514 } // n = 6, score = 300 // eb06 | inc ecx // 803900 | cmp dword ptr [ebx + 0x14], 0 // 0f94c0 | je 0xa3 // 84c0 | dec esp // 0f85a1000000 | mov eax, dword ptr [esp + 0xa0] // 8a6514 | mov edi, 1 $sequence_16 = { ff15???????? 488bf8 4885c0 7505 8d4701 } // n = 5, score = 300 // ff15???????? | // 488bf8 | add edx, esi // 4885c0 | inc esp // 7505 | mov ecx, ebp // 8d4701 | test ebx, ebx $sequence_17 = { 33d2 488bce ff15???????? 4c8bf0 } // n = 4, score = 300 // 33d2 | mov ecx, ebp // 488bce | dec ecx // ff15???????? | // 4c8bf0 | add edx, esi $sequence_18 = { 803e5d 7508 5f 5b 8d4601 5e } // n = 6, score = 300 // 803e5d | cmp dword ptr [edi + 0x8c], 0 // 7508 | inc ecx // 5f | cmp dword ptr [edi + 0x8c], 0 // 5b | je 0xc1 // 8d4601 | inc ebp // 5e | mov ebx, dword ptr [edi + 0x88] $sequence_19 = { 488d4b10 488d542450 41b804000000 c6430f68 } // n = 4, score = 300 // 488d4b10 | inc ebp // 488d542450 | mov ebx, dword ptr [edi + 0x88] // 41b804000000 | dec ebp // c6430f68 | add ebx, esi $sequence_20 = { d9ca d8c9 dec2 3c30 7c04 3c39 } // n = 6, score = 300 // d9ca | je 0x9d // d8c9 | inc ebp // dec2 | mov eax, dword ptr [ebx + 0x20] // 3c30 | inc ebp // 7c04 | mov edx, dword ptr [ebx + 0x24] // 3c39 | dec ecx $sequence_21 = { 6683f809 7505 8d7b02 eb09 6685c0 } // n = 5, score = 300 // 6683f809 | inc ecx // 7505 | mov ebx, dword ptr [ebx + 0x18] // 8d7b02 | test ebx, ebx // eb09 | je 0x7d // 6685c0 | mov esi, dword ptr [esp + 0xb0] $sequence_22 = { 8806 8ac2 4e 243f 0c80 c1ea06 8806 } // n = 7, score = 300 // 8806 | jne 0x17 // 8ac2 | dec esp // 4e | mov eax, dword ptr [esp + 0xa0] // 243f | mov edi, 1 // 0c80 | mov edx, edi // c1ea06 | dec ecx // 8806 | mov ecx, esi $sequence_23 = { 4d8bcc 4d8bc7 488bd0 488bce } // n = 4, score = 300 // 4d8bcc | je 0x7d // 4d8bc7 | mov esi, dword ptr [esp + 0xb0] // 488bd0 | inc ecx // 488bce | mov edx, dword ptr [eax] $sequence_24 = { 85c9 7521 85c0 750f ff15???????? a3???????? 85c0 } // n = 7, score = 300 // 85c9 | mov edx, edi // 7521 | dec ecx // 85c0 | mov ecx, esi // 750f | call ebx // ff15???????? | // a3???????? | // 85c0 | inc ecx $sequence_25 = { 8bc7 ffc8 7416 ffc8 7522 } // n = 5, score = 300 // 8bc7 | inc ecx // ffc8 | mov ebx, dword ptr [ebx + 0x18] // 7416 | mov esi, dword ptr [esp + 0xb0] // ffc8 | inc ecx // 7522 | mov edx, dword ptr [eax] condition: 7 of them and filesize < 434176 }