rule win_doppeldridex_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.doppeldridex." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doppeldridex" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 43 33c9 0fb6db 8bb42414020000 } // n = 4, score = 1200 // 43 | inc ebx // 33c9 | xor ecx, ecx // 0fb6db | movzx ebx, bl // 8bb42414020000 | mov esi, dword ptr [esp + 0x214] $sequence_1 = { ffb4249c010000 ffb424b4010000 ffb42498000000 56 8d4c2428 8d91e0000000 } // n = 6, score = 1200 // ffb4249c010000 | push dword ptr [esp + 0x19c] // ffb424b4010000 | push dword ptr [esp + 0x1b4] // ffb42498000000 | push dword ptr [esp + 0x98] // 56 | push esi // 8d4c2428 | lea ecx, [esp + 0x28] // 8d91e0000000 | lea edx, [ecx + 0xe0] $sequence_2 = { 8b4178 89442404 660fd6442408 8b9998010000 } // n = 4, score = 1200 // 8b4178 | mov eax, dword ptr [ecx + 0x78] // 89442404 | mov dword ptr [esp + 4], eax // 660fd6442408 | movq qword ptr [esp + 8], xmm0 // 8b9998010000 | mov ebx, dword ptr [ecx + 0x198] $sequence_3 = { ffb4249c000000 8d9820010000 53 8d50f8 e8???????? } // n = 5, score = 1200 // ffb4249c000000 | push dword ptr [esp + 0x9c] // 8d9820010000 | lea ebx, [eax + 0x120] // 53 | push ebx // 8d50f8 | lea edx, [eax - 8] // e8???????? | $sequence_4 = { 8d50f8 e8???????? 85c0 0f85b2010000 } // n = 4, score = 1200 // 8d50f8 | lea edx, [eax - 8] // e8???????? | // 85c0 | test eax, eax // 0f85b2010000 | jne 0x1b8 $sequence_5 = { 8bda 2bf8 2bd8 0bfb 0f8429040000 8d942498000000 8b02 } // n = 7, score = 1200 // 8bda | mov ebx, edx // 2bf8 | sub edi, eax // 2bd8 | sub ebx, eax // 0bfb | or edi, ebx // 0f8429040000 | je 0x42f // 8d942498000000 | lea edx, [esp + 0x98] // 8b02 | mov eax, dword ptr [edx] $sequence_6 = { 83ec20 a1???????? 85c0 7419 } // n = 4, score = 1200 // 83ec20 | sub esp, 0x20 // a1???????? | // 85c0 | test eax, eax // 7419 | je 0x1b $sequence_7 = { 8b0d???????? 8910 8b15???????? 894804 895008 8b0d???????? 8b15???????? } // n = 7, score = 1200 // 8b0d???????? | // 8910 | mov dword ptr [eax], edx // 8b15???????? | // 894804 | mov dword ptr [eax + 4], ecx // 895008 | mov dword ptr [eax + 8], edx // 8b0d???????? | // 8b15???????? | $sequence_8 = { 39c8 8945dc 72d2 ebb6 } // n = 4, score = 100 // 39c8 | cmp eax, ecx // 8945dc | mov dword ptr [ebp - 0x24], eax // 72d2 | jb 0xffffffd4 // ebb6 | jmp 0xffffffb8 $sequence_9 = { 08fb f6c301 8975d8 894dbc 8945dc 7505 e9???????? } // n = 7, score = 100 // 08fb | or bl, bh // f6c301 | test bl, 1 // 8975d8 | mov dword ptr [ebp - 0x28], esi // 894dbc | mov dword ptr [ebp - 0x44], ecx // 8945dc | mov dword ptr [ebp - 0x24], eax // 7505 | jne 7 // e9???????? | $sequence_10 = { 8945fc 894df8 7508 8b45f8 83c40c 5d } // n = 6, score = 100 // 8945fc | mov dword ptr [ebp - 4], eax // 894df8 | mov dword ptr [ebp - 8], ecx // 7508 | jne 0xa // 8b45f8 | mov eax, dword ptr [ebp - 8] // 83c40c | add esp, 0xc // 5d | pop ebp $sequence_11 = { ebdb 55 89e5 83ec08 } // n = 4, score = 100 // ebdb | jmp 0xffffffdd // 55 | push ebp // 89e5 | mov ebp, esp // 83ec08 | sub esp, 8 $sequence_12 = { 8b7de4 8b54170c 83fa00 8955d0 8975cc 8945c8 7419 } // n = 7, score = 100 // 8b7de4 | mov edi, dword ptr [ebp - 0x1c] // 8b54170c | mov edx, dword ptr [edi + edx + 0xc] // 83fa00 | cmp edx, 0 // 8955d0 | mov dword ptr [ebp - 0x30], edx // 8975cc | mov dword ptr [ebp - 0x34], esi // 8945c8 | mov dword ptr [ebp - 0x38], eax // 7419 | je 0x1b $sequence_13 = { b9af9f4d67 2b4df0 2b45f0 8b55d0 } // n = 4, score = 100 // b9af9f4d67 | mov ecx, 0x674d9faf // 2b4df0 | sub ecx, dword ptr [ebp - 0x10] // 2b45f0 | sub eax, dword ptr [ebp - 0x10] // 8b55d0 | mov edx, dword ptr [ebp - 0x30] $sequence_14 = { 56 53 83ec50 8b4508 8d0d20302d00 31d2 c645f300 } // n = 7, score = 100 // 56 | push esi // 53 | push ebx // 83ec50 | sub esp, 0x50 // 8b4508 | mov eax, dword ptr [ebp + 8] // 8d0d20302d00 | lea ecx, [0x2d3020] // 31d2 | xor edx, edx // c645f300 | mov byte ptr [ebp - 0xd], 0 $sequence_15 = { 8b45e4 8b4dc0 034110 89c2 } // n = 4, score = 100 // 8b45e4 | mov eax, dword ptr [ebp - 0x1c] // 8b4dc0 | mov ecx, dword ptr [ebp - 0x40] // 034110 | add eax, dword ptr [ecx + 0x10] // 89c2 | mov edx, eax condition: 7 of them and filesize < 360448 }