rule win_remexi_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.remexi." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remexi" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 56 c706ffffffff e8???????? 83c404 } // n = 4, score = 300 // 56 | push esi // c706ffffffff | mov dword ptr [esi], 0xffffffff // e8???????? | // 83c404 | add esp, 4 $sequence_1 = { 8945e4 8945e8 b802000000 51 668945dc ff15???????? } // n = 6, score = 200 // 8945e4 | mov dword ptr [ebp - 0x1c], eax // 8945e8 | mov dword ptr [ebp - 0x18], eax // b802000000 | mov eax, 2 // 51 | push ecx // 668945dc | mov word ptr [ebp - 0x24], ax // ff15???????? | $sequence_2 = { 8907 894704 894708 6a01 89470c 57 894710 } // n = 7, score = 200 // 8907 | mov dword ptr [edi], eax // 894704 | mov dword ptr [edi + 4], eax // 894708 | mov dword ptr [edi + 8], eax // 6a01 | push 1 // 89470c | mov dword ptr [edi + 0xc], eax // 57 | push edi // 894710 | mov dword ptr [edi + 0x10], eax $sequence_3 = { e8???????? 83ec1c 8bcc 89642430 6aff 53 } // n = 6, score = 200 // e8???????? | // 83ec1c | sub esp, 0x1c // 8bcc | mov ecx, esp // 89642430 | mov dword ptr [esp + 0x30], esp // 6aff | push -1 // 53 | push ebx $sequence_4 = { 53 50 ff15???????? 3dffffff00 } // n = 4, score = 200 // 53 | push ebx // 50 | push eax // ff15???????? | // 3dffffff00 | cmp eax, 0xffffff $sequence_5 = { ff15???????? 8bf0 85f6 7513 8b45d8 } // n = 5, score = 200 // ff15???????? | // 8bf0 | mov esi, eax // 85f6 | test esi, esi // 7513 | jne 0x15 // 8b45d8 | mov eax, dword ptr [ebp - 0x28] $sequence_6 = { c705????????01000000 c705????????00000000 ff15???????? 8b0d???????? 51 } // n = 5, score = 200 // c705????????01000000 | // c705????????00000000 | // ff15???????? | // 8b0d???????? | // 51 | push ecx $sequence_7 = { 68???????? 41 50 a3???????? c705????????02000000 890d???????? ffd6 } // n = 7, score = 200 // 68???????? | // 41 | inc ecx // 50 | push eax // a3???????? | // c705????????02000000 | // 890d???????? | // ffd6 | call esi $sequence_8 = { 8b4818 8b5104 50 8955e0 } // n = 4, score = 200 // 8b4818 | mov ecx, dword ptr [eax + 0x18] // 8b5104 | mov edx, dword ptr [ecx + 4] // 50 | push eax // 8955e0 | mov dword ptr [ebp - 0x20], edx $sequence_9 = { ff15???????? 6a10 8d4ddc 8bf0 51 56 ff15???????? } // n = 7, score = 200 // ff15???????? | // 6a10 | push 0x10 // 8d4ddc | lea ecx, [ebp - 0x24] // 8bf0 | mov esi, eax // 51 | push ecx // 56 | push esi // ff15???????? | $sequence_10 = { 57 894710 ff15???????? 6a00 } // n = 4, score = 200 // 57 | push edi // 894710 | mov dword ptr [edi + 0x10], eax // ff15???????? | // 6a00 | push 0 $sequence_11 = { 8b95d4feffff 52 6a00 68ffff1f00 ffd7 } // n = 5, score = 200 // 8b95d4feffff | mov edx, dword ptr [ebp - 0x12c] // 52 | push edx // 6a00 | push 0 // 68ffff1f00 | push 0x1fffff // ffd7 | call edi $sequence_12 = { 014b30 bf???????? b903000000 8b742418 } // n = 4, score = 100 // 014b30 | add dword ptr [ebx + 0x30], ecx // bf???????? | // b903000000 | mov ecx, 3 // 8b742418 | mov esi, dword ptr [esp + 0x18] $sequence_13 = { 771a 488d0c92 48c1e103 e8???????? 488bf8 } // n = 5, score = 100 // 771a | mov dword ptr [ebx - 0x18], edx // 488d0c92 | mov ecx, 0x28 // 48c1e103 | dec eax // e8???????? | // 488bf8 | mov esi, eax $sequence_14 = { 015330 41 894b0c e9???????? } // n = 4, score = 100 // 015330 | add dword ptr [ebx + 0x30], edx // 41 | inc ecx // 894b0c | mov dword ptr [ebx + 0xc], ecx // e9???????? | $sequence_15 = { 015330 8a10 eb84 8a5001 } // n = 4, score = 100 // 015330 | add dword ptr [ebx + 0x30], edx // 8a10 | mov dl, byte ptr [eax] // eb84 | jmp 0xffffff86 // 8a5001 | mov dl, byte ptr [eax + 1] $sequence_16 = { 4883bc249800000010 720d 488b8c2480000000 e8???????? 84db } // n = 5, score = 100 // 4883bc249800000010 | jb 0xffffffef // 720d | je 0x23 // 488b8c2480000000 | dec eax // e8???????? | // 84db | lea ecx, [0x2878a] $sequence_17 = { 488d4d08 e8???????? 90 48895c2458 b900000c07 } // n = 5, score = 100 // 488d4d08 | inc ecx // e8???????? | // 90 | mov eax, 5 // 48895c2458 | dec ecx // b900000c07 | cmp ebx, eax $sequence_18 = { 016b24 89e8 83c44c 5b } // n = 4, score = 100 // 016b24 | add dword ptr [ebx + 0x24], ebp // 89e8 | mov eax, ebp // 83c44c | add esp, 0x4c // 5b | pop ebx $sequence_19 = { 016b04 83c41c 5b 5e } // n = 4, score = 100 // 016b04 | add dword ptr [ebx + 4], ebp // 83c41c | add esp, 0x1c // 5b | pop ebx // 5e | pop esi $sequence_20 = { 488be9 498953e8 b928000000 e8???????? 488bf0 } // n = 5, score = 100 // 488be9 | lea ecx, [ebp + 8] // 498953e8 | nop // b928000000 | dec eax // e8???????? | // 488bf0 | mov dword ptr [esp + 0x58], ebx $sequence_21 = { 72ed 48833d????????00 741f 488d0d8a870200 } // n = 4, score = 100 // 72ed | mov ecx, 0x70c0000 // 48833d????????00 | // 741f | dec eax // 488d0d8a870200 | lea ecx, [ebx + 8] $sequence_22 = { 015518 8b5d14 85db 0f8565fbffff } // n = 4, score = 100 // 015518 | add dword ptr [ebp + 0x18], edx // 8b5d14 | mov ebx, dword ptr [ebp + 0x14] // 85db | test ebx, ebx // 0f8565fbffff | jne 0xfffffb6b $sequence_23 = { 015330 e9???????? 8b5314 3b5318 0f8d23020000 } // n = 5, score = 100 // 015330 | add dword ptr [ebx + 0x30], edx // e9???????? | // 8b5314 | mov edx, dword ptr [ebx + 0x14] // 3b5318 | cmp edx, dword ptr [ebx + 0x18] // 0f8d23020000 | jge 0x229 $sequence_24 = { 488d4b08 e8???????? 90 488d4d08 e8???????? } // n = 5, score = 100 // 488d4b08 | dec esp // e8???????? | // 90 | cmovb eax, ebx // 488d4d08 | dec eax // e8???????? | $sequence_25 = { 488b5810 4883781810 7203 488b00 41b805000000 493bd8 4c0f42c3 } // n = 7, score = 100 // 488b5810 | dec eax // 4883781810 | mov ebx, dword ptr [eax + 0x10] // 7203 | dec eax // 488b00 | cmp dword ptr [eax + 0x18], 0x10 // 41b805000000 | jb 5 // 493bd8 | dec eax // 4c0f42c3 | mov eax, dword ptr [eax] $sequence_26 = { 488bf9 4889542460 c744245000000000 c644247000 33c0 6689442471 } // n = 6, score = 100 // 488bf9 | nop // 4889542460 | dec eax // c744245000000000 | lea ecx, [ebp + 8] // c644247000 | dec eax // 33c0 | mov ebp, ecx // 6689442471 | dec ecx $sequence_27 = { 015930 3b542408 0f8d10ffffff 8d3c52 } // n = 4, score = 100 // 015930 | add dword ptr [ecx + 0x30], ebx // 3b542408 | cmp edx, dword ptr [esp + 8] // 0f8d10ffffff | jge 0xffffff16 // 8d3c52 | lea edi, [edx + edx*2] condition: 7 of them and filesize < 614400 }