rule win_olympic_destroyer_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.olympic_destroyer." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.olympic_destroyer" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 56 33c0 89542414 57 } // n = 4, score = 200 // 56 | push esi // 33c0 | xor eax, eax // 89542414 | mov dword ptr [esp + 0x14], edx // 57 | push edi $sequence_1 = { 89442418 85c0 7419 56 8d542414 } // n = 5, score = 100 // 89442418 | mov dword ptr [esp + 0x18], eax // 85c0 | test eax, eax // 7419 | je 0x1b // 56 | push esi // 8d542414 | lea edx, [esp + 0x14] $sequence_2 = { 3b0cc5686a4000 740a 40 83f816 72ee } // n = 5, score = 100 // 3b0cc5686a4000 | cmp ecx, dword ptr [eax*8 + 0x406a68] // 740a | je 0xc // 40 | inc eax // 83f816 | cmp eax, 0x16 // 72ee | jb 0xfffffff0 $sequence_3 = { 51 8bcf 89442454 e8???????? } // n = 4, score = 100 // 51 | push ecx // 8bcf | mov ecx, edi // 89442454 | mov dword ptr [esp + 0x54], eax // e8???????? | $sequence_4 = { ff15???????? 83c420 6810040000 8d85dcf7ffff 50 } // n = 5, score = 100 // ff15???????? | // 83c420 | add esp, 0x20 // 6810040000 | push 0x410 // 8d85dcf7ffff | lea eax, [ebp - 0x824] // 50 | push eax $sequence_5 = { 76cb 83c614 6a04 57 } // n = 4, score = 100 // 76cb | jbe 0xffffffcd // 83c614 | add esi, 0x14 // 6a04 | push 4 // 57 | push edi $sequence_6 = { 51 8bce 8944244c 89bc2480000000 e8???????? } // n = 5, score = 100 // 51 | push ecx // 8bce | mov ecx, esi // 8944244c | mov dword ptr [esp + 0x4c], eax // 89bc2480000000 | mov dword ptr [esp + 0x80], edi // e8???????? | $sequence_7 = { 8d7e10 85ff 7476 8bcf e8???????? 85c0 746b } // n = 7, score = 100 // 8d7e10 | lea edi, [esi + 0x10] // 85ff | test edi, edi // 7476 | je 0x78 // 8bcf | mov ecx, edi // e8???????? | // 85c0 | test eax, eax // 746b | je 0x6d $sequence_8 = { 51 8bce 8b4004 894510 e8???????? 8b4d10 } // n = 6, score = 100 // 51 | push ecx // 8bce | mov ecx, esi // 8b4004 | mov eax, dword ptr [eax + 4] // 894510 | mov dword ptr [ebp + 0x10], eax // e8???????? | // 8b4d10 | mov ecx, dword ptr [ebp + 0x10] $sequence_9 = { ff15???????? 57 ff15???????? 81bd7cf9ffff40420f00 760e ffb590f9ffff } // n = 6, score = 100 // ff15???????? | // 57 | push edi // ff15???????? | // 81bd7cf9ffff40420f00 | cmp dword ptr [ebp - 0x684], 0xf4240 // 760e | jbe 0x10 // ffb590f9ffff | push dword ptr [ebp - 0x670] $sequence_10 = { 51 8bce 8d52ff e8???????? 83c408 85c0 0f851f040000 } // n = 7, score = 100 // 51 | push ecx // 8bce | mov ecx, esi // 8d52ff | lea edx, [edx - 1] // e8???????? | // 83c408 | add esp, 8 // 85c0 | test eax, eax // 0f851f040000 | jne 0x425 $sequence_11 = { 51 8bce e8???????? 6a00 68???????? } // n = 5, score = 100 // 51 | push ecx // 8bce | mov ecx, esi // e8???????? | // 6a00 | push 0 // 68???????? | $sequence_12 = { 898c24b0000000 898424b4000000 c7460400000000 85c9 7435 0fb74602 } // n = 6, score = 100 // 898c24b0000000 | mov dword ptr [esp + 0xb0], ecx // 898424b4000000 | mov dword ptr [esp + 0xb4], eax // c7460400000000 | mov dword ptr [esi + 4], 0 // 85c9 | test ecx, ecx // 7435 | je 0x37 // 0fb74602 | movzx eax, word ptr [esi + 2] $sequence_13 = { 51 8bcf 8b141a e8???????? } // n = 4, score = 100 // 51 | push ecx // 8bcf | mov ecx, edi // 8b141a | mov edx, dword ptr [edx + ebx] // e8???????? | $sequence_14 = { 50 6a03 683f010000 ff75e0 } // n = 4, score = 100 // 50 | push eax // 6a03 | push 3 // 683f010000 | push 0x13f // ff75e0 | push dword ptr [ebp - 0x20] $sequence_15 = { c3 8b742420 51 ff15???????? 8bc6 5f 5e } // n = 7, score = 100 // c3 | ret // 8b742420 | mov esi, dword ptr [esp + 0x20] // 51 | push ecx // ff15???????? | // 8bc6 | mov eax, esi // 5f | pop edi // 5e | pop esi $sequence_16 = { 8975e8 ff15???????? 8d45dc 50 68???????? } // n = 5, score = 100 // 8975e8 | mov dword ptr [ebp - 0x18], esi // ff15???????? | // 8d45dc | lea eax, [ebp - 0x24] // 50 | push eax // 68???????? | $sequence_17 = { 85db 0f84f6000000 8b4308 8b5304 89442414 8d44242c 51 } // n = 7, score = 100 // 85db | test ebx, ebx // 0f84f6000000 | je 0xfc // 8b4308 | mov eax, dword ptr [ebx + 8] // 8b5304 | mov edx, dword ptr [ebx + 4] // 89442414 | mov dword ptr [esp + 0x14], eax // 8d44242c | lea eax, [esp + 0x2c] // 51 | push ecx $sequence_18 = { 8d442424 89442414 c7442418d0f25500 8b0f } // n = 4, score = 100 // 8d442424 | lea eax, [esp + 0x24] // 89442414 | mov dword ptr [esp + 0x14], eax // c7442418d0f25500 | mov dword ptr [esp + 0x18], 0x55f2d0 // 8b0f | mov ecx, dword ptr [edi] $sequence_19 = { 50 68???????? 56 ff15???????? 8b45dc 8945f0 } // n = 6, score = 100 // 50 | push eax // 68???????? | // 56 | push esi // ff15???????? | // 8b45dc | mov eax, dword ptr [ebp - 0x24] // 8945f0 | mov dword ptr [ebp - 0x10], eax $sequence_20 = { 770e 8b8de8efffff 398df0efffff 7690 53 ff15???????? } // n = 6, score = 100 // 770e | ja 0x10 // 8b8de8efffff | mov ecx, dword ptr [ebp - 0x1018] // 398df0efffff | cmp dword ptr [ebp - 0x1010], ecx // 7690 | jbe 0xffffff92 // 53 | push ebx // ff15???????? | $sequence_21 = { 51 8bcf 89442424 e8???????? 8b542424 } // n = 5, score = 100 // 51 | push ecx // 8bcf | mov ecx, edi // 89442424 | mov dword ptr [esp + 0x24], eax // e8???????? | // 8b542424 | mov edx, dword ptr [esp + 0x24] $sequence_22 = { 89442414 e8???????? 33c9 83c404 85c0 0f45f9 } // n = 6, score = 100 // 89442414 | mov dword ptr [esp + 0x14], eax // e8???????? | // 33c9 | xor ecx, ecx // 83c404 | add esp, 4 // 85c0 | test eax, eax // 0f45f9 | cmovne edi, ecx condition: 7 of them and filesize < 1392640 }