rule win_upatre_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.upatre." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.upatre" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 33c0 aa b404 895d98 8bfb 03d8 } // n = 6, score = 200 // 33c0 | xor eax, eax // aa | stosb byte ptr es:[edi], al // b404 | mov ah, 4 // 895d98 | mov dword ptr [ebp - 0x68], ebx // 8bfb | mov edi, ebx // 03d8 | add ebx, eax $sequence_1 = { ebf5 8b7594 33c9 66ad 6685c0 7404 66ab } // n = 7, score = 200 // ebf5 | jmp 0xfffffff7 // 8b7594 | mov esi, dword ptr [ebp - 0x6c] // 33c9 | xor ecx, ecx // 66ad | lodsw ax, word ptr [esi] // 6685c0 | test ax, ax // 7404 | je 6 // 66ab | stosw word ptr es:[edi], ax $sequence_2 = { 8945d0 03c1 8945fc 8bd8 03c1 8bf8 } // n = 6, score = 200 // 8945d0 | mov dword ptr [ebp - 0x30], eax // 03c1 | add eax, ecx // 8945fc | mov dword ptr [ebp - 4], eax // 8bd8 | mov ebx, eax // 03c1 | add eax, ecx // 8bf8 | mov edi, eax $sequence_3 = { 8b7df4 33c0 b02f 66ab 8b45a8 } // n = 5, score = 200 // 8b7df4 | mov edi, dword ptr [ebp - 0xc] // 33c0 | xor eax, eax // b02f | mov al, 0x2f // 66ab | stosw word ptr es:[edi], ax // 8b45a8 | mov eax, dword ptr [ebp - 0x58] $sequence_4 = { e9???????? 8d4590 50 6a40 } // n = 4, score = 200 // e9???????? | // 8d4590 | lea eax, [ebp - 0x70] // 50 | push eax // 6a40 | push 0x40 $sequence_5 = { ad 0430 66ab 81c60e010000 ac 3c01 740c } // n = 7, score = 200 // ad | lodsd eax, dword ptr [esi] // 0430 | add al, 0x30 // 66ab | stosw word ptr es:[edi], ax // 81c60e010000 | add esi, 0x10e // ac | lodsb al, byte ptr [esi] // 3c01 | cmp al, 1 // 740c | je 0xe $sequence_6 = { 66ab b02f 66ab 8bc1 0430 } // n = 5, score = 200 // 66ab | stosw word ptr es:[edi], ax // b02f | mov al, 0x2f // 66ab | stosw word ptr es:[edi], ax // 8bc1 | mov eax, ecx // 0430 | add al, 0x30 $sequence_7 = { 7409 66ab 41 84c0 75f4 ebed 33c0 } // n = 7, score = 200 // 7409 | je 0xb // 66ab | stosw word ptr es:[edi], ax // 41 | inc ecx // 84c0 | test al, al // 75f4 | jne 0xfffffff6 // ebed | jmp 0xffffffef // 33c0 | xor eax, eax $sequence_8 = { 3bd0 7508 8b4dd4 894df4 eb0e } // n = 5, score = 100 // 3bd0 | cmp edx, eax // 7508 | jne 0xa // 8b4dd4 | mov ecx, dword ptr [ebp - 0x2c] // 894df4 | mov dword ptr [ebp - 0xc], ecx // eb0e | jmp 0x10 $sequence_9 = { 741b e0d6 b454 d2ea 54 b2f2 37 } // n = 7, score = 100 // 741b | je 0x1d // e0d6 | loopne 0xffffffd8 // b454 | mov ah, 0x54 // d2ea | shr dl, cl // 54 | push esp // b2f2 | mov dl, 0xf2 // 37 | aaa $sequence_10 = { 894dfc c645bc6a c645bd09 c645c46a c645c501 c645c3e8 c645cfc3 } // n = 7, score = 100 // 894dfc | mov dword ptr [ebp - 4], ecx // c645bc6a | mov byte ptr [ebp - 0x44], 0x6a // c645bd09 | mov byte ptr [ebp - 0x43], 9 // c645c46a | mov byte ptr [ebp - 0x3c], 0x6a // c645c501 | mov byte ptr [ebp - 0x3b], 1 // c645c3e8 | mov byte ptr [ebp - 0x3d], 0xe8 // c645cfc3 | mov byte ptr [ebp - 0x31], 0xc3 $sequence_11 = { 83c404 0fb7c0 83f805 7514 8b4df8 } // n = 5, score = 100 // 83c404 | add esp, 4 // 0fb7c0 | movzx eax, ax // 83f805 | cmp eax, 5 // 7514 | jne 0x16 // 8b4df8 | mov ecx, dword ptr [ebp - 8] $sequence_12 = { e8???????? 8b55d0 52 e8???????? e9???????? 8b4514 8b4de8 } // n = 7, score = 100 // e8???????? | // 8b55d0 | mov edx, dword ptr [ebp - 0x30] // 52 | push edx // e8???????? | // e9???????? | // 8b4514 | mov eax, dword ptr [ebp + 0x14] // 8b4de8 | mov ecx, dword ptr [ebp - 0x18] $sequence_13 = { 668b4508 668945ec 0fb74dec 81f9007d0000 } // n = 4, score = 100 // 668b4508 | mov ax, word ptr [ebp + 8] // 668945ec | mov word ptr [ebp - 0x14], ax // 0fb74dec | movzx ecx, word ptr [ebp - 0x14] // 81f9007d0000 | cmp ecx, 0x7d00 $sequence_14 = { 8b510c 52 e8???????? 83c404 0fb7c0 83f803 7534 } // n = 7, score = 100 // 8b510c | mov edx, dword ptr [ecx + 0xc] // 52 | push edx // e8???????? | // 83c404 | add esp, 4 // 0fb7c0 | movzx eax, ax // 83f803 | cmp eax, 3 // 7534 | jne 0x36 $sequence_15 = { eb2b 8b55f4 8b420c 50 e8???????? 83c404 0fb7c8 } // n = 7, score = 100 // eb2b | jmp 0x2d // 8b55f4 | mov edx, dword ptr [ebp - 0xc] // 8b420c | mov eax, dword ptr [edx + 0xc] // 50 | push eax // e8???????? | // 83c404 | add esp, 4 // 0fb7c8 | movzx ecx, ax condition: 7 of them and filesize < 294912 }