rule win_disttrack_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.disttrack." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { ff15???????? 8d45dc 50 ff15???????? 8b4ddc } // n = 5, score = 200 // ff15???????? | // 8d45dc | sar eax, 3 // 50 | dec eax // ff15???????? | // 8b4ddc | sub eax, edx $sequence_1 = { e8???????? 83c404 50 e8???????? 83c404 68???????? ff15???????? } // n = 7, score = 200 // e8???????? | // 83c404 | inc eax // 50 | cmp ch, bh // e8???????? | // 83c404 | je 0x59 // 68???????? | // ff15???????? | $sequence_2 = { 53 ff15???????? 5d 5b 8bc7 5f 5e } // n = 7, score = 200 // 53 | mov eax, dword ptr [esp + 0x60] // ff15???????? | // 5d | dec eax // 5b | mov ecx, dword ptr [esp + 0x58] // 8bc7 | mov dword ptr [edi], eax // 5f | dec edx // 5e | lea ecx, [esp + ebx*2 + 0x30] $sequence_3 = { 57 e8???????? 6a07 e8???????? 59 c3 6a10 } // n = 7, score = 200 // 57 | push edi // e8???????? | // 6a07 | push 7 // e8???????? | // 59 | pop ecx // c3 | ret // 6a10 | push 0x10 $sequence_4 = { 52 6a00 6a00 6848000700 } // n = 4, score = 200 // 52 | lea ecx, [esp + 0x30] // 6a00 | lea ebx, [eax + eax + 2] // 6a00 | dec esp // 6848000700 | sub eax, dword ptr [ecx] $sequence_5 = { 6a64 68???????? ff15???????? 6a64 68???????? } // n = 5, score = 100 // 6a64 | push 0x64 // 68???????? | // ff15???????? | // 6a64 | push 0x64 // 68???????? | $sequence_6 = { 3b45e4 72c1 5f b001 5b } // n = 5, score = 100 // 3b45e4 | mov ecx, dword ptr [ebp - 0x24] // 72c1 | lea eax, [ebp - 0x24] // 5f | push eax // b001 | mov ecx, dword ptr [ebp - 0x24] // 5b | push dword ptr [eax*8 + 0x4266f8] $sequence_7 = { e8???????? 8bd8 85c0 7432 488bce e8???????? e8???????? } // n = 7, score = 100 // e8???????? | // 8bd8 | lea ebx, [0x3403] // 85c0 | push edi // 7432 | dec eax // 488bce | sub esp, 0x20 // e8???????? | // e8???????? | $sequence_8 = { 408a6c2427 40b701 403aef 7454 } // n = 4, score = 100 // 408a6c2427 | lea eax, [0x14946] // 40b701 | mov esi, edx // 403aef | dec eax // 7454 | mov ebx, ecx $sequence_9 = { 488d4c2432 8945ca 0fb705???????? 33f6 } // n = 4, score = 100 // 488d4c2432 | dec eax // 8945ca | mov edi, dword ptr [ecx + 0x68] // 0fb705???????? | // 33f6 | dec eax $sequence_10 = { 8d4c0c44 3bfb 741e 8b410c 0bc7 } // n = 5, score = 100 // 8d4c0c44 | lea ecx, [esp + ecx + 0x44] // 3bfb | cmp edi, ebx // 741e | je 0x20 // 8b410c | mov eax, dword ptr [ecx + 0xc] // 0bc7 | or eax, edi $sequence_11 = { 48638528050000 498b16 498b0f 4889442468 0fb68540050000 4c8d1d03340000 } // n = 6, score = 100 // 48638528050000 | inc sp // 498b16 | cmp dword ptr [ebp - 0x1a], esp // 498b0f | dec eax // 4889442468 | arpl word ptr [ebp + 0x528], ax // 0fb68540050000 | dec ecx // 4c8d1d03340000 | mov edx, dword ptr [esi] $sequence_12 = { 83e017 89410c 854110 7407 6a00 e8???????? b301 } // n = 7, score = 100 // 83e017 | push eax // 89410c | add esp, 4 // 854110 | push edx // 7407 | push 0 // 6a00 | push 0 // e8???????? | // b301 | push 0x70048 $sequence_13 = { 8bff 56 57 33ff ffb740004200 ff15???????? 898740004200 } // n = 7, score = 100 // 8bff | mov edi, edi // 56 | push esi // 57 | push edi // 33ff | xor edi, edi // ffb740004200 | push dword ptr [edi + 0x420040] // ff15???????? | // 898740004200 | mov dword ptr [edi + 0x420040], eax $sequence_14 = { 7406 53 e8???????? 8d44244c e8???????? } // n = 5, score = 100 // 7406 | je 8 // 53 | push ebx // e8???????? | // 8d44244c | lea eax, [esp + 0x4c] // e8???????? | $sequence_15 = { ff34c5f8664200 ff15???????? 5d c3 6a0c 68???????? e8???????? } // n = 7, score = 100 // ff34c5f8664200 | add esp, 4 // ff15???????? | // 5d | push eax // c3 | add esp, 4 // 6a0c | push ebx // 68???????? | // e8???????? | $sequence_16 = { 57 4883ec20 488b7968 488d0546490100 8bf2 488bd9 } // n = 6, score = 100 // 57 | dec ecx // 4883ec20 | mov ecx, dword ptr [edi] // 488b7968 | dec eax // 488d0546490100 | mov dword ptr [esp + 0x68], eax // 8bf2 | movzx eax, byte ptr [ebp + 0x540] // 488bd9 | dec esp $sequence_17 = { 72ee 33c0 5d c3 8b04c58c8b4200 } // n = 5, score = 100 // 72ee | pop ebp // 33c0 | pop ebx // 5d | mov eax, edi // c3 | pop edi // 8b04c58c8b4200 | pop esi $sequence_18 = { eb01 53 e8???????? 8b8c24ec500000 5f 5e } // n = 6, score = 100 // eb01 | jmp 3 // 53 | push ebx // e8???????? | // 8b8c24ec500000 | mov ecx, dword ptr [esp + 0x50ec] // 5f | pop edi // 5e | pop esi $sequence_19 = { 50 8b4de0 51 8d55dc 52 } // n = 5, score = 100 // 50 | add esp, 4 // 8b4de0 | push eax // 51 | add esp, 4 // 8d55dc | push edx // 52 | push 0 $sequence_20 = { 8bc1 c1f805 8bf1 83e61f 8d3c8540174200 } // n = 5, score = 100 // 8bc1 | mov eax, ecx // c1f805 | sar eax, 5 // 8bf1 | mov esi, ecx // 83e61f | and esi, 0x1f // 8d3c8540174200 | lea edi, [eax*4 + 0x421740] $sequence_21 = { 0fb692b8a14200 33ca 8b45ec 0345e0 } // n = 4, score = 100 // 0fb692b8a14200 | add esp, 4 // 33ca | push eax // 8b45ec | add esp, 4 // 0345e0 | push ebx $sequence_22 = { 4a8d4c5c30 e8???????? 488bcf e8???????? 488d4c2430 8d5c0002 e8???????? } // n = 7, score = 100 // 4a8d4c5c30 | dec eax // e8???????? | // 488bcf | mov ecx, esi // e8???????? | // 488d4c2430 | dec eax // 8d5c0002 | lea ecx, [esp + 0x32] // e8???????? | $sequence_23 = { 8d1480 3bd6 7e08 c7442410ffffffff ff442410 e9???????? 83f903 } // n = 7, score = 100 // 8d1480 | lea edx, [eax + eax*4] // 3bd6 | cmp edx, esi // 7e08 | jle 0xa // c7442410ffffffff | mov dword ptr [esp + 0x10], 0xffffffff // ff442410 | inc dword ptr [esp + 0x10] // e9???????? | // 83f903 | cmp ecx, 3 $sequence_24 = { 8b442460 488b4c2458 8907 ff15???????? } // n = 4, score = 100 // 8b442460 | mov ebx, eax // 488b4c2458 | test eax, eax // 8907 | je 0x34 // ff15???????? | $sequence_25 = { 1bc0 23d8 6644396de0 752a 66397de2 7524 66443965e6 } // n = 7, score = 100 // 1bc0 | sbb eax, eax // 23d8 | and ebx, eax // 6644396de0 | inc sp // 752a | cmp dword ptr [ebp - 0x20], ebp // 66397de2 | jne 0x2c // 7524 | cmp word ptr [ebp - 0x1e], di // 66443965e6 | jne 0x26 $sequence_26 = { 8d55ec 52 8d8530ffffff 50 884dee } // n = 5, score = 100 // 8d55ec | add esp, 4 // 52 | push eax // 8d8530ffffff | add esp, 4 // 50 | lea eax, [ebp - 0x24] // 884dee | push eax condition: 7 of them and filesize < 1112064 }