rule win_gozi_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.gozi." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gozi" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { e8???????? 8b4df4 57 50 e8???????? } // n = 5, score = 100 // e8???????? | // 8b4df4 | mov ecx, dword ptr [ebp - 0xc] // 57 | push edi // 50 | push eax // e8???????? | $sequence_1 = { 7502 eb20 8d458c 50 } // n = 4, score = 100 // 7502 | jne 4 // eb20 | jmp 0x22 // 8d458c | lea eax, [ebp - 0x74] // 50 | push eax $sequence_2 = { 8c6a38 55 f79bfe7ca80d a7 } // n = 4, score = 100 // 8c6a38 | mov word ptr [edx + 0x38], gs // 55 | push ebp // f79bfe7ca80d | neg dword ptr [ebx + 0xda87cfe] // a7 | cmpsd dword ptr [esi], dword ptr es:[edi] $sequence_3 = { 86f2 8af4 8af4 86d6 0fadce } // n = 5, score = 100 // 86f2 | xchg dl, dh // 8af4 | mov dh, ah // 8af4 | mov dh, ah // 86d6 | xchg dh, dl // 0fadce | shrd esi, ecx, cl $sequence_4 = { 57 56 ff7528 ff7524 } // n = 4, score = 100 // 57 | push edi // 56 | push esi // ff7528 | push dword ptr [ebp + 0x28] // ff7524 | push dword ptr [ebp + 0x24] $sequence_5 = { c808bf35 6963c03caff3da c9 50 0c73 } // n = 5, score = 100 // c808bf35 | enter -0x40f8, 0x35 // 6963c03caff3da | imul esp, dword ptr [ebx - 0x40], 0xdaf3af3c // c9 | leave // 50 | push eax // 0c73 | or al, 0x73 $sequence_6 = { e9???????? 395dec 0f8415010000 c745fc02000000 c745f801000000 e9???????? } // n = 6, score = 100 // e9???????? | // 395dec | cmp dword ptr [ebp - 0x14], ebx // 0f8415010000 | je 0x11b // c745fc02000000 | mov dword ptr [ebp - 4], 2 // c745f801000000 | mov dword ptr [ebp - 8], 1 // e9???????? | $sequence_7 = { 894514 c745f000000000 8b4df8 e8???????? } // n = 4, score = 100 // 894514 | mov dword ptr [ebp + 0x14], eax // c745f000000000 | mov dword ptr [ebp - 0x10], 0 // 8b4df8 | mov ecx, dword ptr [ebp - 8] // e8???????? | $sequence_8 = { 85729b 7a47 43 c571d5 136ddf } // n = 5, score = 100 // 85729b | test dword ptr [edx - 0x65], esi // 7a47 | jp 0x49 // 43 | inc ebx // c571d5 | lds esi, ptr [ecx - 0x2b] // 136ddf | adc ebp, dword ptr [ebp - 0x21] $sequence_9 = { 4a 0fbdd5 0fc0d6 8af4 0fb3ce 80ee96 } // n = 6, score = 100 // 4a | dec edx // 0fbdd5 | bsr edx, ebp // 0fc0d6 | xadd dh, dl // 8af4 | mov dh, ah // 0fb3ce | btr esi, ecx // 80ee96 | sub dh, 0x96 $sequence_10 = { e9???????? ff75d8 ff7514 8d87f2030000 ff10 0bc0 } // n = 6, score = 100 // e9???????? | // ff75d8 | push dword ptr [ebp - 0x28] // ff7514 | push dword ptr [ebp + 0x14] // 8d87f2030000 | lea eax, [edi + 0x3f2] // ff10 | call dword ptr [eax] // 0bc0 | or eax, eax $sequence_11 = { e8???????? 8985b4feffff 56 6a02 ffd0 8bf0 8975e4 } // n = 7, score = 100 // e8???????? | // 8985b4feffff | mov dword ptr [ebp - 0x14c], eax // 56 | push esi // 6a02 | push 2 // ffd0 | call eax // 8bf0 | mov esi, eax // 8975e4 | mov dword ptr [ebp - 0x1c], esi $sequence_12 = { 8bc7 8bd6 7e14 6a00 50 52 e8???????? } // n = 7, score = 100 // 8bc7 | mov eax, edi // 8bd6 | mov edx, esi // 7e14 | jle 0x16 // 6a00 | push 0 // 50 | push eax // 52 | push edx // e8???????? | $sequence_13 = { 59 898540ffffff 894658 33ff 89bd3cffffff 3b7e54 } // n = 6, score = 100 // 59 | pop ecx // 898540ffffff | mov dword ptr [ebp - 0xc0], eax // 894658 | mov dword ptr [esi + 0x58], eax // 33ff | xor edi, edi // 89bd3cffffff | mov dword ptr [ebp - 0xc4], edi // 3b7e54 | cmp edi, dword ptr [esi + 0x54] $sequence_14 = { 45 43 6f 6d 7061 63743200 c808bf35 } // n = 7, score = 100 // 45 | inc ebp // 43 | inc ebx // 6f | outsd dx, dword ptr [esi] // 6d | insd dword ptr es:[edi], dx // 7061 | jo 0x63 // 63743200 | arpl word ptr [edx + esi], si // c808bf35 | enter -0x40f8, 0x35 $sequence_15 = { ff7514 ff7510 ff750c ff7508 8d8715050000 ff10 } // n = 6, score = 100 // ff7514 | push dword ptr [ebp + 0x14] // ff7510 | push dword ptr [ebp + 0x10] // ff750c | push dword ptr [ebp + 0xc] // ff7508 | push dword ptr [ebp + 8] // 8d8715050000 | lea eax, [edi + 0x515] // ff10 | call dword ptr [eax] $sequence_16 = { 0f87b1030000 ff24bd410f4300 8b41e4 3b42e4 7478 0fb642e4 } // n = 6, score = 100 // 0f87b1030000 | ja 0x3b7 // ff24bd410f4300 | jmp dword ptr [edi*4 + 0x430f41] // 8b41e4 | mov eax, dword ptr [ecx - 0x1c] // 3b42e4 | cmp eax, dword ptr [edx - 0x1c] // 7478 | je 0x7a // 0fb642e4 | movzx eax, byte ptr [edx - 0x1c] $sequence_17 = { ff7618 8f461c 8b13 8b12 } // n = 4, score = 100 // ff7618 | push dword ptr [esi + 0x18] // 8f461c | pop dword ptr [esi + 0x1c] // 8b13 | mov edx, dword ptr [ebx] // 8b12 | mov edx, dword ptr [edx] $sequence_18 = { b87e8da638 e022 3a56b9 036890 2b02 9a102a6715fb53 } // n = 6, score = 100 // b87e8da638 | mov eax, 0x38a68d7e // e022 | loopne 0x24 // 3a56b9 | cmp dl, byte ptr [esi - 0x47] // 036890 | add ebp, dword ptr [eax - 0x70] // 2b02 | sub eax, dword ptr [edx] // 9a102a6715fb53 | lcall 0x53fb:0x15672a10 $sequence_19 = { 8bf0 8b450c 8b4010 83660c00 894604 } // n = 5, score = 100 // 8bf0 | mov esi, eax // 8b450c | mov eax, dword ptr [ebp + 0xc] // 8b4010 | mov eax, dword ptr [eax + 0x10] // 83660c00 | and dword ptr [esi + 0xc], 0 // 894604 | mov dword ptr [esi + 4], eax $sequence_20 = { 3bc6 7407 c745d801000000 834dfcff e8???????? 8b45d8 } // n = 6, score = 100 // 3bc6 | cmp eax, esi // 7407 | je 9 // c745d801000000 | mov dword ptr [ebp - 0x28], 1 // 834dfcff | or dword ptr [ebp - 4], 0xffffffff // e8???????? | // 8b45d8 | mov eax, dword ptr [ebp - 0x28] $sequence_21 = { 6af4 dbe9 68912b4384 2383e08985e4 0572b6e2f4 fd } // n = 6, score = 100 // 6af4 | push -0xc // dbe9 | fucomi st(1) // 68912b4384 | push 0x84432b91 // 2383e08985e4 | and eax, dword ptr [ebx - 0x1b7a7620] // 0572b6e2f4 | add eax, 0xf4e2b672 // fd | std $sequence_22 = { de7e75 cd18 4a 51 d2b8c512294e } // n = 5, score = 100 // de7e75 | fidivr word ptr [esi + 0x75] // cd18 | int 0x18 // 4a | dec edx // 51 | push ecx // d2b8c512294e | sar byte ptr [eax + 0x4e2912c5], cl $sequence_23 = { c7400402000000 e9???????? 817df800001000 7607 c745f800001000 } // n = 5, score = 100 // c7400402000000 | mov dword ptr [eax + 4], 2 // e9???????? | // 817df800001000 | cmp dword ptr [ebp - 8], 0x100000 // 7607 | jbe 9 // c745f800001000 | mov dword ptr [ebp - 8], 0x100000 $sequence_24 = { 0fbaf24a 0fb3ce 0faff1 8b0d???????? 8b15???????? 6a00 } // n = 6, score = 100 // 0fbaf24a | btr edx, 0x4a // 0fb3ce | btr esi, ecx // 0faff1 | imul esi, ecx // 8b0d???????? | // 8b15???????? | // 6a00 | push 0 $sequence_25 = { 897508 89750c 895d10 895d14 ff15???????? 3bc6 } // n = 6, score = 100 // 897508 | mov dword ptr [ebp + 8], esi // 89750c | mov dword ptr [ebp + 0xc], esi // 895d10 | mov dword ptr [ebp + 0x10], ebx // 895d14 | mov dword ptr [ebp + 0x14], ebx // ff15???????? | // 3bc6 | cmp eax, esi $sequence_26 = { e8???????? 6a00 8d879a040000 50 ff750c e8???????? } // n = 6, score = 100 // e8???????? | // 6a00 | push 0 // 8d879a040000 | lea eax, [edi + 0x49a] // 50 | push eax // ff750c | push dword ptr [ebp + 0xc] // e8???????? | $sequence_27 = { be84f7c34f 10ba810b7f57 a4 8c6a38 55 } // n = 5, score = 100 // be84f7c34f | mov esi, 0x4fc3f784 // 10ba810b7f57 | adc byte ptr [edx + 0x577f0b81], bh // a4 | movsb byte ptr es:[edi], byte ptr [esi] // 8c6a38 | mov word ptr [edx + 0x38], gs // 55 | push ebp $sequence_28 = { ff15???????? 85c0 740e 834dfcff 33c0 } // n = 5, score = 100 // ff15???????? | // 85c0 | test eax, eax // 740e | je 0x10 // 834dfcff | or dword ptr [ebp - 4], 0xffffffff // 33c0 | xor eax, eax $sequence_29 = { 894db8 8b55b8 8955e0 c745fc00000000 } // n = 4, score = 100 // 894db8 | mov dword ptr [ebp - 0x48], ecx // 8b55b8 | mov edx, dword ptr [ebp - 0x48] // 8955e0 | mov dword ptr [ebp - 0x20], edx // c745fc00000000 | mov dword ptr [ebp - 4], 0 $sequence_30 = { 8995c4fbffff 8b95c0fbffff 0b95c4fbffff 7431 feca } // n = 5, score = 100 // 8995c4fbffff | mov dword ptr [ebp - 0x43c], edx // 8b95c0fbffff | mov edx, dword ptr [ebp - 0x440] // 0b95c4fbffff | or edx, dword ptr [ebp - 0x43c] // 7431 | je 0x33 // feca | dec dl $sequence_31 = { b282 4e f6de c0ee16 0fb3ea } // n = 5, score = 100 // b282 | mov dl, 0x82 // 4e | dec esi // f6de | neg dh // c0ee16 | shr dh, 0x16 // 0fb3ea | btr edx, ebp condition: 7 of them and filesize < 568320 }