rule win_rovnix_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.rovnix." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rovnix" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8b15???????? 83e7f0 89542418 83c710 } // n = 4, score = 900 // 8b15???????? | // 83e7f0 | and edi, 0xfffffff0 // 89542418 | mov dword ptr [esp + 0x18], edx // 83c710 | add edi, 0x10 $sequence_1 = { 83c335 c1e902 ad 2bc3 ab } // n = 5, score = 900 // 83c335 | add ebx, 0x35 // c1e902 | shr ecx, 2 // ad | lodsd eax, dword ptr [esi] // 2bc3 | sub eax, ebx // ab | stosd dword ptr es:[edi], eax $sequence_2 = { 6a00 ffd2 89442408 8bcf } // n = 4, score = 900 // 6a00 | push 0 // ffd2 | call edx // 89442408 | mov dword ptr [esp + 8], eax // 8bcf | mov ecx, edi $sequence_3 = { 2bc3 ab e2fa 61 } // n = 4, score = 900 // 2bc3 | sub eax, ebx // ab | stosd dword ptr es:[edi], eax // e2fa | loop 0xfffffffc // 61 | popal $sequence_4 = { 837c242c00 7405 57 6a00 ffd2 } // n = 5, score = 900 // 837c242c00 | cmp dword ptr [esp + 0x2c], 0 // 7405 | je 7 // 57 | push edi // 6a00 | push 0 // ffd2 | call edx $sequence_5 = { 60 bf40090000 be???????? 8b15???????? 83e7f0 } // n = 5, score = 500 // 60 | pushal // bf40090000 | mov edi, 0x940 // be???????? | // 8b15???????? | // 83e7f0 | and edi, 0xfffffff0 $sequence_6 = { 897f04 893f 894e14 895e10 } // n = 4, score = 400 // 897f04 | mov dword ptr [edi + 4], edi // 893f | mov dword ptr [edi], edi // 894e14 | mov dword ptr [esi + 0x14], ecx // 895e10 | mov dword ptr [esi + 0x10], ebx $sequence_7 = { 8d4e1c 8908 8b4508 c7461801000000 } // n = 4, score = 400 // 8d4e1c | lea ecx, [esi + 0x1c] // 8908 | mov dword ptr [eax], ecx // 8b4508 | mov eax, dword ptr [ebp + 8] // c7461801000000 | mov dword ptr [esi + 0x18], 1 $sequence_8 = { 85c0 e8???????? 8be5 5d c3 } // n = 5, score = 400 // 85c0 | test eax, eax // e8???????? | // 8be5 | mov esp, ebp // 5d | pop ebp // c3 | ret $sequence_9 = { 83f919 7703 83c220 85c0 7404 } // n = 5, score = 400 // 83f919 | cmp ecx, 0x19 // 7703 | ja 5 // 83c220 | add edx, 0x20 // 85c0 | test eax, eax // 7404 | je 6 $sequence_10 = { 894804 8b4608 8b4e0c 8901 894804 8b4718 85c0 } // n = 7, score = 400 // 894804 | mov dword ptr [eax + 4], ecx // 8b4608 | mov eax, dword ptr [esi + 8] // 8b4e0c | mov ecx, dword ptr [esi + 0xc] // 8901 | mov dword ptr [ecx], eax // 894804 | mov dword ptr [eax + 4], ecx // 8b4718 | mov eax, dword ptr [edi + 0x18] // 85c0 | test eax, eax $sequence_11 = { 8b4d0c 897604 8936 8d7e08 897f04 } // n = 5, score = 400 // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] // 897604 | mov dword ptr [esi + 4], esi // 8936 | mov dword ptr [esi], esi // 8d7e08 | lea edi, [esi + 8] // 897f04 | mov dword ptr [edi + 4], edi $sequence_12 = { 8b4508 c7461801000000 8b4804 8906 894e04 8931 897004 } // n = 7, score = 400 // 8b4508 | mov eax, dword ptr [ebp + 8] // c7461801000000 | mov dword ptr [esi + 0x18], 1 // 8b4804 | mov ecx, dword ptr [eax + 4] // 8906 | mov dword ptr [esi], eax // 894e04 | mov dword ptr [esi + 4], ecx // 8931 | mov dword ptr [ecx], esi // 897004 | mov dword ptr [eax + 4], esi $sequence_13 = { c745ec40020000 8975e8 8975f0 8975f4 ff15???????? 85c0 } // n = 6, score = 400 // c745ec40020000 | mov dword ptr [ebp - 0x14], 0x240 // 8975e8 | mov dword ptr [ebp - 0x18], esi // 8975f0 | mov dword ptr [ebp - 0x10], esi // 8975f4 | mov dword ptr [ebp - 0xc], esi // ff15???????? | // 85c0 | test eax, eax $sequence_14 = { 8b00 3bc1 75f3 395e14 } // n = 4, score = 400 // 8b00 | mov eax, dword ptr [eax] // 3bc1 | cmp eax, ecx // 75f3 | jne 0xfffffff5 // 395e14 | cmp dword ptr [esi + 0x14], ebx $sequence_15 = { 8b5e14 8b7e10 eb06 8b5d0c 8b7d08 8bcf } // n = 6, score = 400 // 8b5e14 | mov ebx, dword ptr [esi + 0x14] // 8b7e10 | mov edi, dword ptr [esi + 0x10] // eb06 | jmp 8 // 8b5d0c | mov ebx, dword ptr [ebp + 0xc] // 8b7d08 | mov edi, dword ptr [ebp + 8] // 8bcf | mov ecx, edi $sequence_16 = { 23db 81e1ff000000 23c9 83440c0404 } // n = 4, score = 200 // 23db | and ebx, ebx // 81e1ff000000 | and ecx, 0xff // 23c9 | and ecx, ecx // 83440c0404 | add dword ptr [esp + ecx + 4], 4 $sequence_17 = { 5d c3 85c0 e8???????? } // n = 4, score = 200 // 5d | pop ebp // c3 | ret // 85c0 | test eax, eax // e8???????? | $sequence_18 = { 5d c3 85c9 e8???????? } // n = 4, score = 200 // 5d | pop ebp // c3 | ret // 85c9 | test ecx, ecx // e8???????? | $sequence_19 = { 55 8bec 85db 85c9 } // n = 4, score = 200 // 55 | push ebp // 8bec | mov ebp, esp // 85db | test ebx, ebx // 85c9 | test ecx, ecx $sequence_20 = { 16 85c9 23d2 59 } // n = 4, score = 200 // 16 | push ss // 85c9 | test ecx, ecx // 23d2 | and edx, edx // 59 | pop ecx $sequence_21 = { 4885c0 746a 33d2 488bc8 448d4250 } // n = 5, score = 100 // 4885c0 | inc esp // 746a | cmp byte ptr [esi], al // 33d2 | je 0x4e // 488bc8 | dec esp // 448d4250 | lea ecx, [esp + 0x68] $sequence_22 = { 281a 48 ee 7502 4e 40 } // n = 6, score = 100 // 281a | sub byte ptr [edx], bl // 48 | dec eax // ee | out dx, al // 7502 | jne 4 // 4e | dec esi // 40 | inc eax $sequence_23 = { 0f84d3000000 458b10 4585d2 0f84c7000000 488b4120 } // n = 5, score = 100 // 0f84d3000000 | je 0xd9 // 458b10 | inc ebp // 4585d2 | mov edx, dword ptr [eax] // 0f84c7000000 | inc ebp // 488b4120 | test edx, edx $sequence_24 = { 9d e279 3d2dcac93b 45 7d58 95 } // n = 6, score = 100 // 9d | popfd // e279 | loop 0x7b // 3d2dcac93b | cmp eax, 0x3bc9ca2d // 45 | inc ebp // 7d58 | jge 0x5a // 95 | xchg eax, ebp $sequence_25 = { a2???????? d24b46 92 c55151 } // n = 4, score = 100 // a2???????? | // d24b46 | ror byte ptr [ebx + 0x46], cl // 92 | xchg eax, edx // c55151 | lds edx, ptr [ecx + 0x51] $sequence_26 = { 8b4518 8d4430fd f7f6 440fb7e8 } // n = 4, score = 100 // 8b4518 | je 0xcd // 8d4430fd | dec eax // f7f6 | mov eax, dword ptr [ecx + 0x20] // 440fb7e8 | mov eax, dword ptr [ebp + 0x18] $sequence_27 = { 2be8 7455 66ff432e 443806 7443 4c8d4c2468 458bc7 } // n = 7, score = 100 // 2be8 | lea eax, [eax + esi - 3] // 7455 | div esi // 66ff432e | inc esp // 443806 | movzx ebp, ax // 7443 | sub ebp, eax // 4c8d4c2468 | je 0x57 // 458bc7 | inc word ptr [ebx + 0x2e] $sequence_28 = { 8bf2 7cb7 8b8424e8000000 895704 4489570c 03c5 } // n = 6, score = 100 // 8bf2 | dec esp // 7cb7 | lea eax, [ecx + 2] // 8b8424e8000000 | inc ecx // 895704 | mov edx, edx // 4489570c | inc ebp // 03c5 | cmp byte ptr [eax], dl $sequence_29 = { 7434 4c8d4102 418bd2 453810 7409 ffc2 } // n = 6, score = 100 // 7434 | inc ebp // 4c8d4102 | mov eax, edi // 418bd2 | dec eax // 453810 | test eax, eax // 7409 | je 0x6c // ffc2 | xor edx, edx $sequence_30 = { ff15???????? 8b464c 8d581f 83e3e0 899c2490000000 747d } // n = 6, score = 100 // ff15???????? | // 8b464c | dec eax // 8d581f | mov ecx, eax // 83e3e0 | inc esp // 899c2490000000 | lea eax, [edx + 0x50] // 747d | je 0x36 $sequence_31 = { 9aa1e0301a7317 48 b131 7fa8 } // n = 4, score = 100 // 9aa1e0301a7317 | lcall 0x1773:0x1a30e0a1 // 48 | dec eax // b131 | mov cl, 0x31 // 7fa8 | jg 0xffffffaa $sequence_32 = { 399e38194111 5a e3f7 c4614f 7a0f 28832d7424e3 } // n = 6, score = 100 // 399e38194111 | cmp dword ptr [esi + 0x11411938], ebx // 5a | pop edx // e3f7 | jecxz 0xfffffff9 // c4614f | les esp, ptr [ecx + 0x4f] // 7a0f | jp 0x11 // 28832d7424e3 | sub byte ptr [ebx - 0x1cdb8bd3], al $sequence_33 = { 95 367a3e 2d02ca3b45 05bd6f0e7b 2d3f459239 5a 7852 } // n = 7, score = 100 // 95 | xchg eax, ebp // 367a3e | jp 0x41 // 2d02ca3b45 | sub eax, 0x453bca02 // 05bd6f0e7b | add eax, 0x7b0e6fbd // 2d3f459239 | sub eax, 0x3992453f // 5a | pop edx // 7852 | js 0x54 $sequence_34 = { 16 d24055 2672f7 6232 ce 3d2033ce3d 6215???????? } // n = 7, score = 100 // 16 | push ss // d24055 | rol byte ptr [eax + 0x55], cl // 2672f7 | jb 0xfffffffa // 6232 | bound esi, qword ptr [edx] // ce | into // 3d2033ce3d | cmp eax, 0x3dce3320 // 6215???????? | $sequence_35 = { 74e5 01c4 035dfc 022464 b428 40 40 } // n = 7, score = 100 // 74e5 | je 0xffffffe7 // 01c4 | add esp, eax // 035dfc | add ebx, dword ptr [ebp - 4] // 022464 | add ah, byte ptr [esp] // b428 | mov ah, 0x28 // 40 | inc eax // 40 | inc eax condition: 7 of them and filesize < 548864 }