rule win_cobint_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.cobint." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cobint" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 33c0 56 8b7508 8d4a04 } // n = 4, score = 400 // 33c0 | xor eax, eax // 56 | push esi // 8b7508 | mov esi, dword ptr [ebp + 8] // 8d4a04 | lea ecx, [edx + 4] $sequence_1 = { c745e401000000 50 6a41 56 ffd3 } // n = 5, score = 400 // c745e401000000 | mov dword ptr [ebp - 0x1c], 1 // 50 | push eax // 6a41 | push 0x41 // 56 | push esi // ffd3 | call ebx $sequence_2 = { 3bc3 0f8c12010000 8b4d08 2bc3 57 } // n = 5, score = 400 // 3bc3 | cmp eax, ebx // 0f8c12010000 | jl 0x118 // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 2bc3 | sub eax, ebx // 57 | push edi $sequence_3 = { 56 8b7001 83e904 0fb6d2 83c005 83ea01 } // n = 6, score = 400 // 56 | push esi // 8b7001 | mov esi, dword ptr [eax + 1] // 83e904 | sub ecx, 4 // 0fb6d2 | movzx edx, dl // 83c005 | add eax, 5 // 83ea01 | sub edx, 1 $sequence_4 = { 741b 83e801 752a ff7518 ff7510 ff7508 } // n = 6, score = 400 // 741b | je 0x1d // 83e801 | sub eax, 1 // 752a | jne 0x2c // ff7518 | push dword ptr [ebp + 0x18] // ff7510 | push dword ptr [ebp + 0x10] // ff7508 | push dword ptr [ebp + 8] $sequence_5 = { 8b4508 8902 8b450c 894204 8b01 894208 8b4104 } // n = 7, score = 400 // 8b4508 | mov eax, dword ptr [ebp + 8] // 8902 | mov dword ptr [edx], eax // 8b450c | mov eax, dword ptr [ebp + 0xc] // 894204 | mov dword ptr [edx + 4], eax // 8b01 | mov eax, dword ptr [ecx] // 894208 | mov dword ptr [edx + 8], eax // 8b4104 | mov eax, dword ptr [ecx + 4] $sequence_6 = { 03c9 3bd1 0f47ca 51 } // n = 4, score = 400 // 03c9 | add ecx, ecx // 3bd1 | cmp edx, ecx // 0f47ca | cmova ecx, edx // 51 | push ecx $sequence_7 = { 215df8 50 8d45f4 50 8d45ec 50 6813000020 } // n = 7, score = 400 // 215df8 | and dword ptr [ebp - 8], ebx // 50 | push eax // 8d45f4 | lea eax, [ebp - 0xc] // 50 | push eax // 8d45ec | lea eax, [ebp - 0x14] // 50 | push eax // 6813000020 | push 0x20000013 $sequence_8 = { c3 31b7807c30ae 807c909090 90 } // n = 4, score = 200 // c3 | ret // 31b7807c30ae | xor dword ptr [edi - 0x51cf8380], esi // 807c909090 | cmp byte ptr [eax + edx*4 - 0x70], 0x90 // 90 | nop $sequence_9 = { 8b45ec 42 3b5318 72c4 33c0 } // n = 5, score = 200 // 8b45ec | mov eax, dword ptr [ebp - 0x14] // 42 | inc edx // 3b5318 | cmp edx, dword ptr [ebx + 0x18] // 72c4 | jb 0xffffffc6 // 33c0 | xor eax, eax $sequence_10 = { 8802 eb0b 8b4d08 034df0 8a55ed } // n = 5, score = 200 // 8802 | mov byte ptr [edx], al // eb0b | jmp 0xd // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 034df0 | add ecx, dword ptr [ebp - 0x10] // 8a55ed | mov dl, byte ptr [ebp - 0x13] $sequence_11 = { 0f8444020000 ba5953df81 8bcf e8???????? } // n = 4, score = 200 // 0f8444020000 | je 0x24a // ba5953df81 | mov edx, 0x81df5359 // 8bcf | mov ecx, edi // e8???????? | $sequence_12 = { 6a00 8bc8 897de8 8d45e8 2bdf 50 } // n = 6, score = 200 // 6a00 | push 0 // 8bc8 | mov ecx, eax // 897de8 | mov dword ptr [ebp - 0x18], edi // 8d45e8 | lea eax, [ebp - 0x18] // 2bdf | sub ebx, edi // 50 | push eax $sequence_13 = { 51 8d8d24feffff 51 ffd0 8945d4 } // n = 5, score = 200 // 51 | push ecx // 8d8d24feffff | lea ecx, [ebp - 0x1dc] // 51 | push ecx // ffd0 | call eax // 8945d4 | mov dword ptr [ebp - 0x2c], eax $sequence_14 = { 90 e10b 96 7c90 90 } // n = 5, score = 200 // 90 | nop // e10b | loope 0xd // 96 | xchg eax, esi // 7c90 | jl 0xffffff92 // 90 | nop $sequence_15 = { bffc807c28 1a807c170e81 7cd7 9b } // n = 4, score = 200 // bffc807c28 | mov edi, 0x287c80fc // 1a807c170e81 | sbb al, byte ptr [eax - 0x7ef1e884] // 7cd7 | jl 0xffffffd9 // 9b | wait $sequence_16 = { 8b4320 03c6 8945ec 395318 } // n = 4, score = 200 // 8b4320 | mov eax, dword ptr [ebx + 0x20] // 03c6 | add eax, esi // 8945ec | mov dword ptr [ebp - 0x14], eax // 395318 | cmp dword ptr [ebx + 0x18], edx $sequence_17 = { 837d1000 740d 8b5508 0355f0 8a45ec 8802 eb0b } // n = 7, score = 200 // 837d1000 | cmp dword ptr [ebp + 0x10], 0 // 740d | je 0xf // 8b5508 | mov edx, dword ptr [ebp + 8] // 0355f0 | add edx, dword ptr [ebp - 0x10] // 8a45ec | mov al, byte ptr [ebp - 0x14] // 8802 | mov byte ptr [edx], al // eb0b | jmp 0xd $sequence_18 = { 749b 807ce19a80 7c90 90 90 90 } // n = 6, score = 200 // 749b | je 0xffffff9d // 807ce19a80 | cmp byte ptr [ecx - 0x66], 0x80 // 7c90 | jl 0xffffff92 // 90 | nop // 90 | nop // 90 | nop $sequence_19 = { 90 749b 807ce19a80 7c90 } // n = 4, score = 200 // 90 | nop // 749b | je 0xffffff9d // 807ce19a80 | cmp byte ptr [ecx - 0x66], 0x80 // 7c90 | jl 0xffffff92 $sequence_20 = { 53 ffd6 baf608f7a4 8bcf e8???????? } // n = 5, score = 200 // 53 | push ebx // ffd6 | call esi // baf608f7a4 | mov edx, 0xa4f708f6 // 8bcf | mov ecx, edi // e8???????? | $sequence_21 = { 51 8d8524feffff 50 51 ff75d8 } // n = 5, score = 200 // 51 | push ecx // 8d8524feffff | lea eax, [ebp - 0x1dc] // 50 | push eax // 51 | push ecx // ff75d8 | push dword ptr [ebp - 0x28] $sequence_22 = { 8d45c0 c745c001000000 50 6a41 53 } // n = 5, score = 200 // 8d45c0 | lea eax, [ebp - 0x40] // c745c001000000 | mov dword ptr [ebp - 0x40], 1 // 50 | push eax // 6a41 | push 0x41 // 53 | push ebx $sequence_23 = { 90 90 90 90 90 bffc807c28 } // n = 6, score = 200 // 90 | nop // 90 | nop // 90 | nop // 90 | nop // 90 | nop // bffc807c28 | mov edi, 0x287c80fc condition: 7 of them and filesize < 65536 }