rule win_acr_stealer_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.acr_stealer." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.acr_stealer" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 51 8b4530 50 8d4d08 51 e8???????? 8b55f8 } // n = 7, score = 600 // 51 | push ecx // 8b4530 | mov eax, dword ptr [ebp + 0x30] // 50 | push eax // 8d4d08 | lea ecx, [ebp + 8] // 51 | push ecx // e8???????? | // 8b55f8 | mov edx, dword ptr [ebp - 8] $sequence_1 = { 83c404 83c001 50 8b553c 52 8b45e4 } // n = 6, score = 600 // 83c404 | add esp, 4 // 83c001 | add eax, 1 // 50 | push eax // 8b553c | mov edx, dword ptr [ebp + 0x3c] // 52 | push edx // 8b45e4 | mov eax, dword ptr [ebp - 0x1c] $sequence_2 = { 837df800 7630 8b45f8 33d2 b90a000000 } // n = 5, score = 600 // 837df800 | cmp dword ptr [ebp - 8], 0 // 7630 | jbe 0x32 // 8b45f8 | mov eax, dword ptr [ebp - 8] // 33d2 | xor edx, edx // b90a000000 | mov ecx, 0xa $sequence_3 = { 83c408 85c0 7507 33c0 e9???????? 8b55fc 8b02 } // n = 7, score = 600 // 83c408 | add esp, 8 // 85c0 | test eax, eax // 7507 | jne 9 // 33c0 | xor eax, eax // e9???????? | // 8b55fc | mov edx, dword ptr [ebp - 4] // 8b02 | mov eax, dword ptr [edx] $sequence_4 = { 8b4d0c 83c101 894d0c 8b5510 83ea01 895510 eb94 } // n = 7, score = 600 // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] // 83c101 | add ecx, 1 // 894d0c | mov dword ptr [ebp + 0xc], ecx // 8b5510 | mov edx, dword ptr [ebp + 0x10] // 83ea01 | sub edx, 1 // 895510 | mov dword ptr [ebp + 0x10], edx // eb94 | jmp 0xffffff96 $sequence_5 = { f7f1 8945f8 ebca 837d0800 7d09 } // n = 5, score = 600 // f7f1 | div ecx // 8945f8 | mov dword ptr [ebp - 8], eax // ebca | jmp 0xffffffcc // 837d0800 | cmp dword ptr [ebp + 8], 0 // 7d09 | jge 0xb $sequence_6 = { 64a1c0000000 8945fc 837dfc00 7409 c745f801000000 eb07 c745f800000000 } // n = 7, score = 600 // 64a1c0000000 | mov eax, dword ptr fs:[0xc0] // 8945fc | mov dword ptr [ebp - 4], eax // 837dfc00 | cmp dword ptr [ebp - 4], 0 // 7409 | je 0xb // c745f801000000 | mov dword ptr [ebp - 8], 1 // eb07 | jmp 9 // c745f800000000 | mov dword ptr [ebp - 8], 0 $sequence_7 = { 8b4508 0fb708 83c102 8b5508 66894a02 8b4508 8b4d0c } // n = 7, score = 600 // 8b4508 | mov eax, dword ptr [ebp + 8] // 0fb708 | movzx ecx, word ptr [eax] // 83c102 | add ecx, 2 // 8b5508 | mov edx, dword ptr [ebp + 8] // 66894a02 | mov word ptr [edx + 2], cx // 8b4508 | mov eax, dword ptr [ebp + 8] // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] $sequence_8 = { 50 e8???????? 83c410 83f801 740e } // n = 5, score = 300 // 50 | push eax // e8???????? | // 83c410 | add esp, 0x10 // 83f801 | cmp eax, 1 // 740e | je 0x10 $sequence_9 = { 0f8405010000 837f2800 0f84fb000000 8b772c } // n = 4, score = 300 // 0f8405010000 | je 0x10b // 837f2800 | cmp dword ptr [edi + 0x28], 0 // 0f84fb000000 | je 0x101 // 8b772c | mov esi, dword ptr [edi + 0x2c] $sequence_10 = { 5d c3 c7471c18000000 8b4dfc 33c0 5f 5e } // n = 7, score = 300 // 5d | pop ebp // c3 | ret // c7471c18000000 | mov dword ptr [edi + 0x1c], 0x18 // 8b4dfc | mov ecx, dword ptr [ebp - 4] // 33c0 | xor eax, eax // 5f | pop edi // 5e | pop esi $sequence_11 = { 33c9 03ff 3bc8 72f8 } // n = 4, score = 300 // 33c9 | xor ecx, ecx // 03ff | add edi, edi // 3bc8 | cmp ecx, eax // 72f8 | jb 0xfffffffa $sequence_12 = { 50 8d0c76 c1e104 03cf } // n = 4, score = 300 // 50 | push eax // 8d0c76 | lea ecx, [esi + esi*2] // c1e104 | shl ecx, 4 // 03cf | add ecx, edi $sequence_13 = { 5b 8be5 5d c3 85f6 747e } // n = 6, score = 300 // 5b | pop ebx // 8be5 | mov esp, ebp // 5d | pop ebp // c3 | ret // 85f6 | test esi, esi // 747e | je 0x80 $sequence_14 = { 53 8b5d08 56 8bf1 894df4 } // n = 5, score = 300 // 53 | push ebx // 8b5d08 | mov ebx, dword ptr [ebp + 8] // 56 | push esi // 8bf1 | mov esi, ecx // 894df4 | mov dword ptr [ebp - 0xc], ecx $sequence_15 = { 6a0a 68???????? 8b07 8b7004 8bce ff15???????? 8bcf } // n = 7, score = 300 // 6a0a | push 0xa // 68???????? | // 8b07 | mov eax, dword ptr [edi] // 8b7004 | mov esi, dword ptr [eax + 4] // 8bce | mov ecx, esi // ff15???????? | // 8bcf | mov ecx, edi condition: 7 of them and filesize < 2160640 }