rule win_redcurl_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.redcurl." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.redcurl" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { f7f9 80c261 88143e 47 } // n = 4, score = 400 // f7f9 | idiv ecx // 80c261 | add dl, 0x61 // 88143e | mov byte ptr [esi + edi], dl // 47 | inc edi $sequence_1 = { ff15???????? 8bd0 c7461000000000 8bca } // n = 4, score = 400 // ff15???????? | // 8bd0 | mov edx, eax // c7461000000000 | mov dword ptr [esi + 0x10], 0 // 8bca | mov ecx, edx $sequence_2 = { 2bc6 48 50 56 } // n = 4, score = 400 // 2bc6 | sub eax, esi // 48 | dec eax // 50 | push eax // 56 | push esi $sequence_3 = { 6683e07f 6683f87f 8d642408 0f85e90b0000 } // n = 4, score = 300 // 6683e07f | and ax, 0x7f // 6683f87f | cmp ax, 0x7f // 8d642408 | lea esp, [esp + 8] // 0f85e90b0000 | jne 0xbef $sequence_4 = { c745e800000000 c745ec0f000000 c645d800 8d5001 8b4610 } // n = 5, score = 300 // c745e800000000 | mov dword ptr [ebp - 0x18], 0 // c745ec0f000000 | mov dword ptr [ebp - 0x14], 0xf // c645d800 | mov byte ptr [ebp - 0x28], 0 // 8d5001 | lea edx, [eax + 1] // 8b4610 | mov eax, dword ptr [esi + 0x10] $sequence_5 = { c745fc00000000 c745c400000000 c745c80f000000 c645b400 } // n = 4, score = 300 // c745fc00000000 | mov dword ptr [ebp - 4], 0 // c745c400000000 | mov dword ptr [ebp - 0x3c], 0 // c745c80f000000 | mov dword ptr [ebp - 0x38], 0xf // c645b400 | mov byte ptr [ebp - 0x4c], 0 $sequence_6 = { 3bd3 7426 0fb64aff 4a } // n = 4, score = 300 // 3bd3 | cmp edx, ebx // 7426 | je 0x28 // 0fb64aff | movzx ecx, byte ptr [edx - 1] // 4a | dec edx $sequence_7 = { e8???????? 8d45d8 8bce 50 e8???????? 8b55ec 83fa10 } // n = 7, score = 300 // e8???????? | // 8d45d8 | lea eax, [ebp - 0x28] // 8bce | mov ecx, esi // 50 | push eax // e8???????? | // 8b55ec | mov edx, dword ptr [ebp - 0x14] // 83fa10 | cmp edx, 0x10 $sequence_8 = { ff15???????? 837d1c10 8d4d08 6a00 0f434d08 8bf0 6a00 } // n = 7, score = 300 // ff15???????? | // 837d1c10 | cmp dword ptr [ebp + 0x1c], 0x10 // 8d4d08 | lea ecx, [ebp + 8] // 6a00 | push 0 // 0f434d08 | cmovae ecx, dword ptr [ebp + 8] // 8bf0 | mov esi, eax // 6a00 | push 0 $sequence_9 = { 6aff 8bf8 6a00 57 ff15???????? } // n = 5, score = 300 // 6aff | push -1 // 8bf8 | mov edi, eax // 6a00 | push 0 // 57 | push edi // ff15???????? | $sequence_10 = { 660fd645e0 e8???????? 83c404 c645fc03 } // n = 4, score = 300 // 660fd645e0 | movq qword ptr [ebp - 0x20], xmm0 // e8???????? | // 83c404 | add esp, 4 // c645fc03 | mov byte ptr [ebp - 4], 3 $sequence_11 = { 726f 2bc2 83c9ff 83f8ff 0f42c8 } // n = 5, score = 300 // 726f | jb 0x71 // 2bc2 | sub eax, edx // 83c9ff | or ecx, 0xffffffff // 83f8ff | cmp eax, -1 // 0f42c8 | cmovb ecx, eax $sequence_12 = { a900000080 7541 d9ec d9c9 d9f1 833d????????00 0f856c090000 } // n = 7, score = 300 // a900000080 | test eax, 0x80000000 // 7541 | jne 0x43 // d9ec | fldlg2 // d9c9 | fxch st(1) // d9f1 | fyl2x // 833d????????00 | // 0f856c090000 | jne 0x972 $sequence_13 = { 00c1 8b8300010000 83da03 29fa 7468 } // n = 5, score = 200 // 00c1 | add cl, al // 8b8300010000 | mov eax, dword ptr [ebx + 0x100] // 83da03 | sbb edx, 3 // 29fa | sub edx, edi // 7468 | je 0x6a $sequence_14 = { 00c1 83de03 29de 89b504feffff } // n = 4, score = 200 // 00c1 | add cl, al // 83de03 | sbb esi, 3 // 29de | sub esi, ebx // 89b504feffff | mov dword ptr [ebp - 0x1fc], esi $sequence_15 = { 0154241c 894104 e9???????? 8b44241c } // n = 4, score = 200 // 0154241c | add dword ptr [esp + 0x1c], edx // 894104 | mov dword ptr [ecx + 4], eax // e9???????? | // 8b44241c | mov eax, dword ptr [esp + 0x1c] $sequence_16 = { 00c1 83db03 2b9d34fdffff 899d44fdffff } // n = 4, score = 200 // 00c1 | add cl, al // 83db03 | sbb ebx, 3 // 2b9d34fdffff | sub ebx, dword ptr [ebp - 0x2cc] // 899d44fdffff | mov dword ptr [ebp - 0x2bc], ebx $sequence_17 = { 00c1 8d8510feffff 83da03 89442404 } // n = 4, score = 200 // 00c1 | add cl, al // 8d8510feffff | lea eax, [ebp - 0x1f0] // 83da03 | sbb edx, 3 // 89442404 | mov dword ptr [esp + 4], eax $sequence_18 = { 00c1 83da03 2b54241c 0f8444230000 8b7c241c } // n = 5, score = 200 // 00c1 | add cl, al // 83da03 | sbb edx, 3 // 2b54241c | sub edx, dword ptr [esp + 0x1c] // 0f8444230000 | je 0x234a // 8b7c241c | mov edi, dword ptr [esp + 0x1c] $sequence_19 = { 00c2 83de03 2bb500ffffff 89b530ffffff } // n = 4, score = 200 // 00c2 | add dl, al // 83de03 | sbb esi, 3 // 2bb500ffffff | sub esi, dword ptr [ebp - 0x100] // 89b530ffffff | mov dword ptr [ebp - 0xd0], esi $sequence_20 = { 8b55e4 83ec04 89d9 893c24 89542404 e8???????? } // n = 6, score = 200 // 8b55e4 | mov edx, dword ptr [ebp - 0x1c] // 83ec04 | sub esp, 4 // 89d9 | mov ecx, ebx // 893c24 | mov dword ptr [esp], edi // 89542404 | mov dword ptr [esp + 4], edx // e8???????? | condition: 7 of them and filesize < 487424 }