rule win_tinyloader_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-05-04" version = "1" description = "Detects win.tinyloader." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tinyloader" malpedia_rule_date = "20260422" malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14" malpedia_version = "20260504" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 5b 89d0 c1c010 6689c8 90 } // n = 5, score = 200 // 5b | pop ebx // 89d0 | mov eax, edx // c1c010 | rol eax, 0x10 // 6689c8 | mov ax, cx // 90 | nop $sequence_1 = { 8b1d???????? 90 8998f8070000 90 } // n = 4, score = 200 // 8b1d???????? | // 90 | nop // 8998f8070000 | mov dword ptr [eax + 0x7f8], ebx // 90 | nop $sequence_2 = { 6a40 6800300000 6800800200 6a00 ff15???????? 90 8b1d???????? } // n = 7, score = 100 // 6a40 | push 0x40 // 6800300000 | push 0x3000 // 6800800200 | push 0x28000 // 6a00 | push 0 // ff15???????? | // 90 | nop // 8b1d???????? | $sequence_3 = { ffd0 31db 8b4500 8b8000040000 83f80c 7702 eb28 } // n = 7, score = 100 // ffd0 | call eax // 31db | xor ebx, ebx // 8b4500 | mov eax, dword ptr [ebp] // 8b8000040000 | mov eax, dword ptr [eax + 0x400] // 83f80c | cmp eax, 0xc // 7702 | ja 4 // eb28 | jmp 0x2a $sequence_4 = { c70000000000 c7855808000000000000 8b5d00 039d58080000 } // n = 4, score = 100 // c70000000000 | mov dword ptr [eax], 0 // c7855808000000000000 | mov dword ptr [ebp + 0x858], 0 // 8b5d00 | mov ebx, dword ptr [ebp] // 039d58080000 | add ebx, dword ptr [ebp + 0x858] $sequence_5 = { ffb5b8050000 ff15???????? 83f8ff 7405 } // n = 4, score = 100 // ffb5b8050000 | push dword ptr [ebp + 0x5b8] // ff15???????? | // 83f8ff | cmp eax, -1 // 7405 | je 7 $sequence_6 = { 83ec20 48 8d0dca110000 48 8d15c3110000 } // n = 5, score = 100 // 83ec20 | sub esp, 0x20 // 48 | dec eax // 8d0dca110000 | lea ecx, [0x11ca] // 48 | dec eax // 8d15c3110000 | lea edx, [0x11c3] $sequence_7 = { 90 48 895830 90 48 8b1d???????? } // n = 6, score = 100 // 90 | nop // 48 | dec eax // 895830 | mov dword ptr [eax + 0x30], ebx // 90 | nop // 48 | dec eax // 8b1d???????? | $sequence_8 = { 8d3500304000 89c7 53 31c9 49 } // n = 5, score = 100 // 8d3500304000 | lea esi, [0x403000] // 89c7 | mov edi, eax // 53 | push ebx // 31c9 | xor ecx, ecx // 49 | dec ecx $sequence_9 = { 90 8bbb97114000 90 8938 90 81fb04030000 730d } // n = 7, score = 100 // 90 | nop // 8bbb97114000 | mov edi, dword ptr [ebx + 0x401197] // 90 | nop // 8938 | mov dword ptr [eax], edi // 90 | nop // 81fb04030000 | cmp ebx, 0x304 // 730d | jae 0xf $sequence_10 = { 66894302 66c7030200 e8???????? 3935???????? } // n = 4, score = 100 // 66894302 | mov word ptr [ebx + 2], ax // 66c7030200 | mov word ptr [ebx], 2 // e8???????? | // 3935???????? | $sequence_11 = { 83ec20 48 8d0d060f0000 48 8d152f150000 ff15???????? 48 } // n = 7, score = 100 // 83ec20 | sub esp, 0x20 // 48 | dec eax // 8d0d060f0000 | lea ecx, [0xf06] // 48 | dec eax // 8d152f150000 | lea edx, [0x152f] // ff15???????? | // 48 | dec eax $sequence_12 = { 83f80c 7702 eb28 83e80c 39c3 7321 } // n = 6, score = 100 // 83f80c | cmp eax, 0xc // 7702 | ja 4 // eb28 | jmp 0x2a // 83e80c | sub eax, 0xc // 39c3 | cmp ebx, eax // 7321 | jae 0x23 $sequence_13 = { 83c420 48 83ec20 48 8d0dea0e0000 ff15???????? } // n = 6, score = 100 // 83c420 | add esp, 0x20 // 48 | dec eax // 83ec20 | sub esp, 0x20 // 48 | dec eax // 8d0dea0e0000 | lea ecx, [0xeea] // ff15???????? | $sequence_14 = { 90 31db 90 90 } // n = 4, score = 100 // 90 | nop // 31db | xor ebx, ebx // 90 | nop // 90 | nop $sequence_15 = { 31c9 90 3108 90 } // n = 4, score = 100 // 31c9 | xor ecx, ecx // 90 | nop // 3108 | xor dword ptr [eax], ecx // 90 | nop $sequence_16 = { c7c100000000 48 c7c200800200 49 } // n = 4, score = 100 // c7c100000000 | mov ecx, 0 // 48 | dec eax // c7c200800200 | mov edx, 0x28000 // 49 | dec ecx $sequence_17 = { 656c 6c 3332 2e646c 6c 00ff 15???????? } // n = 7, score = 100 // 656c | insb byte ptr es:[edi], dx // 6c | insb byte ptr es:[edi], dx // 3332 | xor esi, dword ptr [edx] // 2e646c | insb byte ptr es:[edi], dx // 6c | insb byte ptr es:[edi], dx // 00ff | add bh, bh // 15???????? | $sequence_18 = { 31c0 8b03 8b5d00 66894308 6a10 } // n = 5, score = 100 // 31c0 | xor eax, eax // 8b03 | mov eax, dword ptr [ebx] // 8b5d00 | mov ebx, dword ptr [ebp] // 66894308 | mov word ptr [ebx + 8], ax // 6a10 | push 0x10 $sequence_19 = { e9???????? 018558080000 83bd580800000c 7302 ebc3 } // n = 5, score = 100 // e9???????? | // 018558080000 | add dword ptr [ebp + 0x858], eax // 83bd580800000c | cmp dword ptr [ebp + 0x858], 0xc // 7302 | jae 4 // ebc3 | jmp 0xffffffc5 $sequence_20 = { 48 8d15ebffffff ff15???????? 48 83c420 } // n = 5, score = 100 // 48 | dec eax // 8d15ebffffff | lea edx, [0xffffffeb] // ff15???????? | // 48 | dec eax // 83c420 | add esp, 0x20 $sequence_21 = { 8985a8050000 0500080000 894508 0500200000 894518 0500200000 } // n = 6, score = 100 // 8985a8050000 | mov dword ptr [ebp + 0x5a8], eax // 0500080000 | add eax, 0x800 // 894508 | mov dword ptr [ebp + 8], eax // 0500200000 | add eax, 0x2000 // 894518 | mov dword ptr [ebp + 0x18], eax // 0500200000 | add eax, 0x2000 condition: 7 of them and filesize < 40960 }