rule win_broomstick_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.broomstick." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.broomstick" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 2bc2 83c002 99 83e203 03c2 } // n = 5, score = 2200 // 2bc2 | sub eax, edx // 83c002 | add eax, 2 // 99 | cdq // 83e203 | and edx, 3 // 03c2 | add eax, edx $sequence_1 = { 8b45d4 8b75d0 2bc6 894ddc 51 52 3bc8 } // n = 7, score = 2100 // 8b45d4 | mov eax, dword ptr [ebp - 0x2c] // 8b75d0 | mov esi, dword ptr [ebp - 0x30] // 2bc6 | sub eax, esi // 894ddc | mov dword ptr [ebp - 0x24], ecx // 51 | push ecx // 52 | push edx // 3bc8 | cmp ecx, eax $sequence_2 = { c6400100 8808 eb13 ff75e8 } // n = 4, score = 2100 // c6400100 | mov byte ptr [eax + 1], 0 // 8808 | mov byte ptr [eax], cl // eb13 | jmp 0x15 // ff75e8 | push dword ptr [ebp - 0x18] $sequence_3 = { 80b9????????3f 76f3 2bc2 83c002 } // n = 4, score = 2100 // 80b9????????3f | // 76f3 | jbe 0xfffffff5 // 2bc2 | sub eax, edx // 83c002 | add eax, 2 $sequence_4 = { 03f0 56 e8???????? 8b45dc 83c40c c6040600 } // n = 6, score = 2100 // 03f0 | add esi, eax // 56 | push esi // e8???????? | // 8b45dc | mov eax, dword ptr [ebp - 0x24] // 83c40c | add esp, 0xc // c6040600 | mov byte ptr [esi + eax], 0 $sequence_5 = { 83c40c c6040600 eb10 c645dc00 } // n = 4, score = 2100 // 83c40c | add esp, 0xc // c6040600 | mov byte ptr [esi + eax], 0 // eb10 | jmp 0x12 // c645dc00 | mov byte ptr [ebp - 0x24], 0 $sequence_6 = { 51 50 51 8bce e8???????? 8b4dec } // n = 6, score = 2100 // 51 | push ecx // 50 | push eax // 51 | push ecx // 8bce | mov ecx, esi // e8???????? | // 8b4dec | mov ecx, dword ptr [ebp - 0x14] $sequence_7 = { 83c408 33c0 c7467000000000 c7467407000000 66894660 } // n = 5, score = 2100 // 83c408 | add esp, 8 // 33c0 | xor eax, eax // c7467000000000 | mov dword ptr [esi + 0x70], 0 // c7467407000000 | mov dword ptr [esi + 0x74], 7 // 66894660 | mov word ptr [esi + 0x60], ax $sequence_8 = { 49898688490300 488d4c2420 41ffd4 4889f1 } // n = 4, score = 100 // 49898688490300 | and edx, 3 // 488d4c2420 | jbe 0xfffffff5 // 41ffd4 | sub eax, edx // 4889f1 | add eax, 2 $sequence_9 = { ba01000000 488bf0 ff15???????? 4533c9 } // n = 4, score = 100 // ba01000000 | mov edx, 0xf774fe // 488bf0 | dec eax // ff15???????? | // 4533c9 | mov ecx, edi $sequence_10 = { 49898688420300 48b8111ed81f4f83a99f 49898690420300 488d4c2420 } // n = 4, score = 100 // 49898688420300 | push dword ptr [ebp - 0x24] // 48b8111ed81f4f83a99f | push ecx // 49898690420300 | lea ecx, [ebp - 0x40] // 488d4c2420 | mov byte ptr [eax + 1], 0 $sequence_11 = { 49898688410300 b9f0712400 4c8b25???????? 41ffd4 } // n = 4, score = 100 // 49898688410300 | mov eax, dword ptr [ebp - 0x2c] // b9f0712400 | mov esi, dword ptr [ebp - 0x30] // 4c8b25???????? | // 41ffd4 | sub eax, esi $sequence_12 = { ba01000000 488d8120630400 ffd0 488b05???????? } // n = 4, score = 100 // ba01000000 | dec eax // 488d8120630400 | lea ecx, [ebp + 0x580] // ffd0 | mov edx, 1 // 488b05???????? | $sequence_13 = { ba01000000 49898565230300 488bce 48b8234a9581780326f6 } // n = 4, score = 100 // ba01000000 | mov edi, eax // 49898565230300 | dec eax // 488bce | mov eax, 0x6d1f6421 // 48b8234a9581780326f6 | inc ecx $sequence_14 = { 49898688680300 4889f1 4889fa 4c8b2d???????? } // n = 4, score = 100 // 49898688680300 | mov dword ptr [esi + 0x70], 0 // 4889f1 | mov dword ptr [esi + 0x74], 7 // 4889fa | mov word ptr [esi + 0x60], ax // 4c8b2d???????? | $sequence_15 = { ba01000000 49898602940300 488bcf 48b81e53fbe65dc7397c } // n = 4, score = 100 // ba01000000 | adc bl, bh // 49898602940300 | dec eax // 488bcf | lea ecx, [ebp + 0x4f8] // 48b81e53fbe65dc7397c | dec eax $sequence_16 = { 668930 488d9300010000 4883bb1801000007 7607 } // n = 4, score = 100 // 668930 | add esp, 0xc // 488d9300010000 | mov byte ptr [esi + eax], 0 // 4883bb1801000007 | jmp 0x19 // 7607 | mov byte ptr [ebp - 0x24], 0 $sequence_17 = { ba01000000 488bf8 ff15???????? 488d8d80050000 } // n = 4, score = 100 // ba01000000 | mov ecx, ebx // 488bf8 | mov edx, 1 // ff15???????? | // 488d8d80050000 | dec eax $sequence_18 = { 668930 488d5320 48837b3807 7604 } // n = 4, score = 100 // 668930 | mov dword ptr [esi + 0x70], 0 // 488d5320 | mov dword ptr [esi + 0x74], 7 // 48837b3807 | sub eax, edx // 7604 | add eax, 2 $sequence_19 = { ba01000000 488bd8 ff15???????? 488bd6 } // n = 4, score = 100 // ba01000000 | dec eax // 488bd8 | mov ecx, edi // ff15???????? | // 488bd6 | mov edx, 1 $sequence_20 = { ba01000000 488bcf ff15???????? ba93383100 488bcf } // n = 5, score = 100 // ba01000000 | mov edx, 1 // 488bcf | dec eax // ff15???????? | // ba93383100 | mov ecx, edi // 488bcf | mov edx, 0x313893 $sequence_21 = { 49898688320300 b9bc474300 41ffd4 4889c7 4889c1 } // n = 5, score = 100 // 49898688320300 | push edx // b9bc474300 | cmp ecx, eax // 41ffd4 | mov eax, dword ptr [ebp - 0x24] // 4889c7 | add esp, 0xc // 4889c1 | mov byte ptr [esi + eax], 0 $sequence_22 = { 49898688430300 4889f1 ba97000000 41b8cb000000 } // n = 4, score = 100 // 49898688430300 | cmp ecx, 0x1000 // 4889f1 | jb 0x25 // ba97000000 | mov edx, dword ptr [eax - 4] // 41b8cb000000 | sub eax, edx $sequence_23 = { 668930 488b542438 4883fa07 7637 488d145502000000 488b4c2420 488bc1 } // n = 7, score = 100 // 668930 | push esi // 488b542438 | mov eax, dword ptr [ebp - 0x24] // 4883fa07 | add esp, 0xc // 7637 | mov byte ptr [esi + eax], 0 // 488d145502000000 | push ecx // 488b4c2420 | push eax // 488bc1 | push ecx $sequence_24 = { 49898688360300 488d4c2420 41ffd7 4889f1 } // n = 4, score = 100 // 49898688360300 | mov eax, dword ptr [ebp - 0x24] // 488d4c2420 | add esp, 0xc // 41ffd7 | mov byte ptr [esi + eax], 0 // 4889f1 | jmp 0x19 $sequence_25 = { ba01000000 49898612ff0300 488bcf 48b81f58d5789b9e337f } // n = 4, score = 100 // ba01000000 | mov eax, 0x93eb2949 // 49898612ff0300 | mov edx, 1 // 488bcf | dec eax // 48b81f58d5789b9e337f | mov edi, eax $sequence_26 = { 668930 488d9320010000 4883bb3801000007 7607 } // n = 4, score = 100 // 668930 | ja 0x30 // 488d9320010000 | add esp, 8 // 4883bb3801000007 | xor eax, eax // 7607 | mov dword ptr [esi + 0x70], 0 $sequence_27 = { 668930 488d5517 48837d2f07 480f475517 } // n = 4, score = 100 // 668930 | add esp, 0xc // 488d5517 | mov byte ptr [esi + eax], 0 // 48837d2f07 | jmp 0x1d // 480f475517 | mov eax, dword ptr [ebp - 0x2c] $sequence_28 = { 498986885f0300 4889f1 ba02000000 ffd3 } // n = 4, score = 100 // 498986885f0300 | mov byte ptr [esi + eax], 0 // 4889f1 | jmp 0x12 // ba02000000 | mov byte ptr [ebp - 0x24], 0 // ffd3 | push dword ptr [ebp - 0x24] $sequence_29 = { 668930 488d5340 48837b5807 7604 } // n = 4, score = 100 // 668930 | jbe 0xfffffff6 // 488d5340 | sub eax, edx // 48837b5807 | push esi // 7604 | mov eax, dword ptr [ebp - 0x24] $sequence_30 = { 668930 488b559f 4883fa07 7636 } // n = 4, score = 100 // 668930 | mov ecx, esi // 488b559f | mov ecx, dword ptr [ebp - 0x14] // 4883fa07 | push esi // 7636 | mov eax, dword ptr [ebp - 0x24] condition: 7 of them and filesize < 1567744 }