rule win_sdbbot_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.sdbbot." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { ff55e0 ff7508 6a01 53 ffd6 5f } // n = 6, score = 700 // ff55e0 | inc ecx // ff7508 | mov ecx, dword ptr [edx] // 6a01 | dec ecx // 53 | add ecx, ecx // ffd6 | jne 0xb // 5f | inc esp $sequence_1 = { 83c72c 8b4ff8 4b 8b17 03ce } // n = 5, score = 700 // 83c72c | mov edi, dword ptr [edi + 0x10] // 8b4ff8 | add edi, edx // 4b | cmp dword ptr [edi], 0 // 8b17 | sub edi, dword ptr [ebx + 0x34] // 03ce | mov dword ptr [ebp - 0x14], edx $sequence_2 = { 83ec24 53 33db c745e800000000 56 } // n = 5, score = 700 // 83ec24 | lea ebx, [ebx + 8] // 53 | dec ecx // 33db | shr edx, 1 // c745e800000000 | je 0x81 // 56 | dec ebp $sequence_3 = { 83c304 6685ff 0f855effffff e9???????? 81f95d68fa3c } // n = 5, score = 700 // 83c304 | mov ebx, dword ptr [ebp - 0x10] // 6685ff | call dword ptr [ebp - 0x20] // 0f855effffff | push dword ptr [ebp + 8] // e9???????? | // 81f95d68fa3c | push 1 $sequence_4 = { 2b7b34 8955ec 85d2 0f84ae000000 8b83a0000000 } // n = 5, score = 700 // 2b7b34 | lea edx, [edx + 1] // 8955ec | sub esi, 1 // 85d2 | jne 0xfffffff8 // 0f84ae000000 | call dword ptr [ebp - 0xc] // 8b83a0000000 | push dword ptr [ebx + 0x50] $sequence_5 = { 833f00 0f847d000000 8b470c 03c6 50 ff55e8 } // n = 6, score = 700 // 833f00 | je 0x1c // 0f847d000000 | mov edi, esi // 8b470c | sub edi, dword ptr [ebp - 8] // 03c6 | nop dword ptr [eax + eax] // 50 | mov al, byte ptr [ecx] // ff55e8 | mov esi, dword ptr [ebp - 4] $sequence_6 = { 03f2 8b7f10 03fa 833f00 } // n = 4, score = 700 // 03f2 | mov ecx, edi // 8b7f10 | mov edi, dword ptr [ebp - 0x14] // 03fa | add edi, 0x14 // 833f00 | mov dword ptr [ebp - 0x14], edi $sequence_7 = { 660f1f440000 c1c90d 8d5201 0fbec0 } // n = 4, score = 700 // 660f1f440000 | nop dword ptr [eax + eax] // c1c90d | ror eax, 0xd // 8d5201 | lea edx, [edx + 1] // 0fbec0 | movsx ecx, cl $sequence_8 = { c3 803d????????00 750c c605????????01 e8???????? } // n = 5, score = 400 // c3 | ret // 803d????????00 | // 750c | jne 0xe // c605????????01 | // e8???????? | $sequence_9 = { 53 4156 4157 4883ec50 48896c2448 4533f6 } // n = 6, score = 300 // 53 | inc ecx // 4156 | mov ebx, dword ptr [edi + 0xb0] // 4157 | mov edi, eax // 4883ec50 | dec ecx // 48896c2448 | add ebx, esi // 4533f6 | test eax, eax $sequence_10 = { 4c8bac2480000000 8b4d0c 4903ce 41ffd5 488bf0 } // n = 5, score = 300 // 4c8bac2480000000 | dec esp // 8b4d0c | mov ebp, dword ptr [esp + 0x80] // 4903ce | mov ecx, dword ptr [ebp + 0xc] // 41ffd5 | dec ecx // 488bf0 | add ecx, esi $sequence_11 = { 468b5c0f24 4d03d1 4d03d9 418b0a 4903c9 } // n = 5, score = 300 // 468b5c0f24 | dec ecx // 4d03d1 | add edx, ebp // 4d03d9 | dec ebp // 418b0a | test eax, eax // 4903c9 | je 0x21 $sequence_12 = { 48897c2478 664503de 4983c004 4983c102 664585db } // n = 5, score = 300 // 48897c2478 | push ebx // 664503de | inc ecx // 4983c004 | push esi // 4983c102 | inc ecx // 664585db | push edi $sequence_13 = { 0f84bb000000 418b9fb0000000 8bf8 4903de 85c0 } // n = 5, score = 300 // 0f84bb000000 | inc ecx // 418b9fb0000000 | call ebp // 8bf8 | dec eax // 4903de | mov esi, eax // 85c0 | je 0xc1 $sequence_14 = { 4903ce 458b41fc 4903d5 4d85c0 7419 0f1f8000000000 0fb602 } // n = 7, score = 300 // 4903ce | dec eax // 458b41fc | sub esp, 0x50 // 4903d5 | dec eax // 4d85c0 | mov dword ptr [esp + 0x48], ebp // 7419 | inc ebp // 0f1f8000000000 | xor esi, esi // 0fb602 | dec eax $sequence_15 = { 418b5f28 33d2 4533c0 4903de 488d4aff ff542478 } // n = 6, score = 300 // 418b5f28 | movsx eax, al // 33d2 | mov eax, dword ptr [ebp - 0x1c] // 4533c0 | mov edx, dword ptr [ebp - 0x14] // 4903de | mov ecx, dword ptr [eax + 4] // 488d4aff | jmp 0xb // ff542478 | mov eax, dword ptr [ebp - 0x1c] $sequence_16 = { 418baf90000000 4903ee 837d0000 0f849b000000 4c8bac2480000000 } // n = 5, score = 300 // 418baf90000000 | jne 0x56 // 4903ee | inc edx // 837d0000 | mov ecx, dword ptr [edi + ecx + 0x1c] // 0f849b000000 | inc ecx // 4c8bac2480000000 | movzx edx, word ptr [ebx] condition: 7 of them and filesize < 1015808 }