rule win_prometei_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.prometei." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prometei" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 011d???????? 03c8 8b5de4 a1???????? } // n = 4, score = 100 // 011d???????? | // 03c8 | add ecx, eax // 8b5de4 | mov ebx, dword ptr [ebp - 0x1c] // a1???????? | $sequence_1 = { 0482 b02c dc8cbc6c1c55bb 8cc6 4b } // n = 5, score = 100 // 0482 | add al, 0x82 // b02c | mov al, 0x2c // dc8cbc6c1c55bb | fmul qword ptr [esp + edi*4 - 0x44aae394] // 8cc6 | mov esi, es // 4b | dec ebx $sequence_2 = { 2aba2191fab2 2125???????? 346d 2a91020a2292 b5fd } // n = 5, score = 100 // 2aba2191fab2 | sub bh, byte ptr [edx - 0x4d056edf] // 2125???????? | // 346d | xor al, 0x6d // 2a91020a2292 | sub dl, byte ptr [ecx - 0x6dddf5fe] // b5fd | mov ch, 0xfd $sequence_3 = { 014368 81434400020000 c7434000000000 83534800 } // n = 4, score = 100 // 014368 | add dword ptr [ebx + 0x68], eax // 81434400020000 | add dword ptr [ebx + 0x44], 0x200 // c7434000000000 | mov dword ptr [ebx + 0x40], 0 // 83534800 | adc dword ptr [ebx + 0x48], 0 $sequence_4 = { 014358 8b45f0 01435c 8b45fc } // n = 4, score = 100 // 014358 | add dword ptr [ebx + 0x58], eax // 8b45f0 | mov eax, dword ptr [ebp - 0x10] // 01435c | add dword ptr [ebx + 0x5c], eax // 8b45fc | mov eax, dword ptr [ebp - 4] $sequence_5 = { 55 bb8c132400 4a af } // n = 4, score = 100 // 55 | push ebp // bb8c132400 | mov ebx, 0x24138c // 4a | dec edx // af | scasd eax, dword ptr es:[edi] $sequence_6 = { 8b75fc 894808 89500c b801000000 f745c000020000 0f44f8 8b45e0 } // n = 7, score = 100 // 8b75fc | mov esi, dword ptr [ebp - 4] // 894808 | mov dword ptr [eax + 8], ecx // 89500c | mov dword ptr [eax + 0xc], edx // b801000000 | mov eax, 1 // f745c000020000 | test dword ptr [ebp - 0x40], 0x200 // 0f44f8 | cmove edi, eax // 8b45e0 | mov eax, dword ptr [ebp - 0x20] $sequence_7 = { f745c000020000 660f7f45b0 0f44f9 c745c000000000 33c9 897dd8 0fa2 } // n = 7, score = 100 // f745c000020000 | test dword ptr [ebp - 0x40], 0x200 // 660f7f45b0 | movdqa xmmword ptr [ebp - 0x50], xmm0 // 0f44f9 | cmove edi, ecx // c745c000000000 | mov dword ptr [ebp - 0x40], 0 // 33c9 | xor ecx, ecx // 897dd8 | mov dword ptr [ebp - 0x28], edi // 0fa2 | cpuid $sequence_8 = { 01435c 8b45fc 014360 8b45f4 } // n = 4, score = 100 // 01435c | add dword ptr [ebx + 0x5c], eax // 8b45fc | mov eax, dword ptr [ebp - 4] // 014360 | add dword ptr [ebx + 0x60], eax // 8b45f4 | mov eax, dword ptr [ebp - 0xc] $sequence_9 = { 83feff 741f 6a00 8d45d8 50 } // n = 5, score = 100 // 83feff | cmp esi, -1 // 741f | je 0x21 // 6a00 | push 0 // 8d45d8 | lea eax, [ebp - 0x28] // 50 | push eax $sequence_10 = { 013d???????? 8b04b5c8054400 0500080000 3bc8 } // n = 4, score = 100 // 013d???????? | // 8b04b5c8054400 | mov eax, dword ptr [esi*4 + 0x4405c8] // 0500080000 | add eax, 0x800 // 3bc8 | cmp ecx, eax $sequence_11 = { c745f800000000 33c9 c745c000000000 53 } // n = 4, score = 100 // c745f800000000 | mov dword ptr [ebp - 8], 0 // 33c9 | xor ecx, ecx // c745c000000000 | mov dword ptr [ebp - 0x40], 0 // 53 | push ebx $sequence_12 = { 014354 8b45e8 014358 8b45f0 } // n = 4, score = 100 // 014354 | add dword ptr [ebx + 0x54], eax // 8b45e8 | mov eax, dword ptr [ebp - 0x18] // 014358 | add dword ptr [ebx + 0x58], eax // 8b45f0 | mov eax, dword ptr [ebp - 0x10] $sequence_13 = { 014364 8b45e4 014368 5b } // n = 4, score = 100 // 014364 | add dword ptr [ebx + 0x64], eax // 8b45e4 | mov eax, dword ptr [ebp - 0x1c] // 014368 | add dword ptr [ebx + 0x68], eax // 5b | pop ebx $sequence_14 = { 014360 8b45f4 014364 8b45e4 } // n = 4, score = 100 // 014360 | add dword ptr [ebx + 0x60], eax // 8b45f4 | mov eax, dword ptr [ebp - 0xc] // 014364 | add dword ptr [ebx + 0x64], eax // 8b45e4 | mov eax, dword ptr [ebp - 0x1c] $sequence_15 = { 7532 33c0 85ff 742c 8b75d8 03f2 0fbe5405b8 } // n = 7, score = 100 // 7532 | jne 0x34 // 33c0 | xor eax, eax // 85ff | test edi, edi // 742c | je 0x2e // 8b75d8 | mov esi, dword ptr [ebp - 0x28] // 03f2 | add esi, edx // 0fbe5405b8 | movsx edx, byte ptr [ebp + eax - 0x48] condition: 7 of them and filesize < 51014656 }