rule win_sality_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.sality." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sality" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 52 68ff011f00 8d45f4 50 } // n = 4, score = 400 // 52 | push edx // 68ff011f00 | push 0x1f01ff // 8d45f4 | lea eax, [ebp - 0xc] // 50 | push eax $sequence_1 = { 0f8411010000 8b55dc 33c0 668b4212 } // n = 4, score = 400 // 0f8411010000 | je 0x117 // 8b55dc | mov edx, dword ptr [ebp - 0x24] // 33c0 | xor eax, eax // 668b4212 | mov ax, word ptr [edx + 0x12] $sequence_2 = { 7207 b801040000 eb54 8b55fc 2b55f4 8b450c 8910 } // n = 7, score = 400 // 7207 | jb 9 // b801040000 | mov eax, 0x401 // eb54 | jmp 0x56 // 8b55fc | mov edx, dword ptr [ebp - 4] // 2b55f4 | sub edx, dword ptr [ebp - 0xc] // 8b450c | mov eax, dword ptr [ebp + 0xc] // 8910 | mov dword ptr [eax], edx $sequence_3 = { 52 68a3000000 e8???????? 83c414 8b4dfc 03c8 894dfc } // n = 7, score = 400 // 52 | push edx // 68a3000000 | push 0xa3 // e8???????? | // 83c414 | add esp, 0x14 // 8b4dfc | mov ecx, dword ptr [ebp - 4] // 03c8 | add ecx, eax // 894dfc | mov dword ptr [ebp - 4], ecx $sequence_4 = { 721b 817d08d5000000 7712 8b4510 0345fc c6000f 8b4dfc } // n = 7, score = 400 // 721b | jb 0x1d // 817d08d5000000 | cmp dword ptr [ebp + 8], 0xd5 // 7712 | ja 0x14 // 8b4510 | mov eax, dword ptr [ebp + 0x10] // 0345fc | add eax, dword ptr [ebp - 4] // c6000f | mov byte ptr [eax], 0xf // 8b4dfc | mov ecx, dword ptr [ebp - 4] $sequence_5 = { 0f8410010000 e8???????? 25ffff0000 99 b967000000 f7f9 } // n = 6, score = 400 // 0f8410010000 | je 0x116 // e8???????? | // 25ffff0000 | and eax, 0xffff // 99 | cdq // b967000000 | mov ecx, 0x67 // f7f9 | idiv ecx $sequence_6 = { 0f8410020000 c785ccfdffff28010000 b949000000 33c0 } // n = 4, score = 400 // 0f8410020000 | je 0x216 // c785ccfdffff28010000 | mov dword ptr [ebp - 0x234], 0x128 // b949000000 | mov ecx, 0x49 // 33c0 | xor eax, eax $sequence_7 = { 833c8a00 7402 eb10 8b450c 8b4d0c 83e901 } // n = 6, score = 400 // 833c8a00 | cmp dword ptr [edx + ecx*4], 0 // 7402 | je 4 // eb10 | jmp 0x12 // 8b450c | mov eax, dword ptr [ebp + 0xc] // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] // 83e901 | sub ecx, 1 $sequence_8 = { 64ff30 8d8586134000 8920 896804 8d9dba114000 895808 } // n = 6, score = 200 // 64ff30 | push dword ptr fs:[eax] // 8d8586134000 | lea eax, [ebp + 0x401386] // 8920 | mov dword ptr [eax], esp // 896804 | mov dword ptr [eax + 4], ebp // 8d9dba114000 | lea ebx, [ebp + 0x4011ba] // 895808 | mov dword ptr [eax + 8], ebx $sequence_9 = { b996000000 32c0 f2ae 8bcf 2b4c2410 8b5678 0354240c } // n = 7, score = 200 // b996000000 | mov ecx, 0x96 // 32c0 | xor al, al // f2ae | repne scasb al, byte ptr es:[edi] // 8bcf | mov ecx, edi // 2b4c2410 | sub ecx, dword ptr [esp + 0x10] // 8b5678 | mov edx, dword ptr [esi + 0x78] // 0354240c | add edx, dword ptr [esp + 0xc] $sequence_10 = { bb04000000 8bc1 f7e3 0344240c } // n = 4, score = 200 // bb04000000 | mov ebx, 4 // 8bc1 | mov eax, ecx // f7e3 | mul ebx // 0344240c | add eax, dword ptr [esp + 0xc] $sequence_11 = { 0354240c 8b5a20 035c240c 33c0 8b3b } // n = 5, score = 200 // 0354240c | add edx, dword ptr [esp + 0xc] // 8b5a20 | mov ebx, dword ptr [edx + 0x20] // 035c240c | add ebx, dword ptr [esp + 0xc] // 33c0 | xor eax, eax // 8b3b | mov edi, dword ptr [ebx] $sequence_12 = { 50 ff95bc154000 85c0 7403 eb0c 58 } // n = 6, score = 200 // 50 | push eax // ff95bc154000 | call dword ptr [ebp + 0x4015bc] // 85c0 | test eax, eax // 7403 | je 5 // eb0c | jmp 0xe // 58 | pop eax $sequence_13 = { 8bc8 48 c6857b27400000 8d8527164000 6a00 6a00 50 } // n = 7, score = 200 // 8bc8 | mov ecx, eax // 48 | dec eax // c6857b27400000 | mov byte ptr [ebp + 0x40277b], 0 // 8d8527164000 | lea eax, [ebp + 0x401627] // 6a00 | push 0 // 6a00 | push 0 // 50 | push eax $sequence_14 = { 6a00 ff9585144000 50 ff95e7144000 85c0 } // n = 5, score = 200 // 6a00 | push 0 // ff9585144000 | call dword ptr [ebp + 0x401485] // 50 | push eax // ff95e7144000 | call dword ptr [ebp + 0x4014e7] // 85c0 | test eax, eax $sequence_15 = { 0f858c000000 03763c 813e50450000 0f857d000000 8b7c2410 b996000000 32c0 } // n = 7, score = 200 // 0f858c000000 | jne 0x92 // 03763c | add esi, dword ptr [esi + 0x3c] // 813e50450000 | cmp dword ptr [esi], 0x4550 // 0f857d000000 | jne 0x83 // 8b7c2410 | mov edi, dword ptr [esp + 0x10] // b996000000 | mov ecx, 0x96 // 32c0 | xor al, al $sequence_16 = { 833c85ebc3400000 7519 0fbec3 ff3485e3c34000 e8???????? } // n = 5, score = 100 // 833c85ebc3400000 | cmp dword ptr [eax*4 + 0x40c3eb], 0 // 7519 | jne 0x1b // 0fbec3 | movsx eax, bl // ff3485e3c34000 | push dword ptr [eax*4 + 0x40c3e3] // e8???????? | $sequence_17 = { 750f 8b4508 8b14857d504100 e9???????? } // n = 4, score = 100 // 750f | jne 0x11 // 8b4508 | mov eax, dword ptr [ebp + 8] // 8b14857d504100 | mov edx, dword ptr [eax*4 + 0x41507d] // e9???????? | $sequence_18 = { 49 7432 8bd1 8b7c2414 8bdf 83c9ff } // n = 6, score = 100 // 49 | dec ecx // 7432 | je 0x34 // 8bd1 | mov edx, ecx // 8b7c2414 | mov edi, dword ptr [esp + 0x14] // 8bdf | mov ebx, edi // 83c9ff | or ecx, 0xffffffff $sequence_19 = { 888831004100 46 ebd5 8935???????? } // n = 4, score = 100 // 888831004100 | mov byte ptr [eax + 0x410031], cl // 46 | inc esi // ebd5 | jmp 0xffffffd7 // 8935???????? | $sequence_20 = { 03f2 8bfe 83c604 fc } // n = 4, score = 100 // 03f2 | add esi, edx // 8bfe | mov edi, esi // 83c604 | add esi, 4 // fc | cld $sequence_21 = { ff30 e8???????? eb22 40 } // n = 4, score = 100 // ff30 | push dword ptr [eax] // e8???????? | // eb22 | jmp 0x24 // 40 | inc eax $sequence_22 = { c1c004 50 240f 0430 3c39 } // n = 5, score = 100 // c1c004 | rol eax, 4 // 50 | push eax // 240f | and al, 0xf // 0430 | add al, 0x30 // 3c39 | cmp al, 0x39 $sequence_23 = { 3c0d 741f 3c0e 7431 b002 83c410 } // n = 6, score = 100 // 3c0d | cmp al, 0xd // 741f | je 0x21 // 3c0e | cmp al, 0xe // 7431 | je 0x33 // b002 | mov al, 2 // 83c410 | add esp, 0x10 condition: 7 of them and filesize < 1523712 }