rule win_industroyer_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.industroyer." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.industroyer" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 83c414 56 56 50 68???????? } // n = 5, score = 600 // 83c414 | add esp, 0x14 // 56 | push esi // 56 | push esi // 50 | push eax // 68???????? | $sequence_1 = { ff750c ff7508 56 ff15???????? 8bc8 } // n = 5, score = 600 // ff750c | push dword ptr [ebp + 0xc] // ff7508 | push dword ptr [ebp + 8] // 56 | push esi // ff15???????? | // 8bc8 | mov ecx, eax $sequence_2 = { 59 8d4dfc 51 50 56 57 ff15???????? } // n = 7, score = 600 // 59 | pop ecx // 8d4dfc | lea ecx, [ebp - 4] // 51 | push ecx // 50 | push eax // 56 | push esi // 57 | push edi // ff15???????? | $sequence_3 = { 6800000008 56 8d85a0fdffff 50 51 } // n = 5, score = 600 // 6800000008 | push 0x8000000 // 56 | push esi // 8d85a0fdffff | lea eax, [ebp - 0x260] // 50 | push eax // 51 | push ecx $sequence_4 = { 8b1d???????? ffd3 57 8d45fc 50 56 ff7508 } // n = 7, score = 600 // 8b1d???????? | // ffd3 | call ebx // 57 | push edi // 8d45fc | lea eax, [ebp - 4] // 50 | push eax // 56 | push esi // ff7508 | push dword ptr [ebp + 8] $sequence_5 = { 51 56 8d45f8 33f6 50 ff35???????? } // n = 6, score = 600 // 51 | push ecx // 56 | push esi // 8d45f8 | lea eax, [ebp - 8] // 33f6 | xor esi, esi // 50 | push eax // ff35???????? | $sequence_6 = { c745dc04000000 50 8d45d0 50 6a00 6813000020 } // n = 6, score = 600 // c745dc04000000 | mov dword ptr [ebp - 0x24], 4 // 50 | push eax // 8d45d0 | lea eax, [ebp - 0x30] // 50 | push eax // 6a00 | push 0 // 6813000020 | push 0x20000013 $sequence_7 = { 8d45f8 50 6a05 53 ffd6 6a04 } // n = 6, score = 600 // 8d45f8 | lea eax, [ebp - 8] // 50 | push eax // 6a05 | push 5 // 53 | push ebx // ffd6 | call esi // 6a04 | push 4 $sequence_8 = { ff15???????? 8bf0 83feff 743c 6690 f644241810 751c } // n = 7, score = 400 // ff15???????? | // 8bf0 | mov esi, eax // 83feff | cmp esi, -1 // 743c | je 0x3e // 6690 | nop // f644241810 | test byte ptr [esp + 0x18], 0x10 // 751c | jne 0x1e $sequence_9 = { 85c0 742c 83c604 83fe44 72e1 } // n = 5, score = 400 // 85c0 | test eax, eax // 742c | je 0x2e // 83c604 | add esi, 4 // 83fe44 | cmp esi, 0x44 // 72e1 | jb 0xffffffe3 $sequence_10 = { a1???????? 33c5 8945fc 0f1005???????? a1???????? 56 } // n = 6, score = 400 // a1???????? | // 33c5 | xor eax, ebp // 8945fc | mov dword ptr [ebp - 4], eax // 0f1005???????? | // a1???????? | // 56 | push esi $sequence_11 = { 89842468040000 53 8b1d???????? 8d842460020000 56 } // n = 5, score = 400 // 89842468040000 | mov dword ptr [esp + 0x468], eax // 53 | push ebx // 8b1d???????? | // 8d842460020000 | lea eax, [esp + 0x260] // 56 | push esi $sequence_12 = { 50 ffd6 85c0 7431 ff35???????? } // n = 5, score = 400 // 50 | push eax // ffd6 | call esi // 85c0 | test eax, eax // 7431 | je 0x33 // ff35???????? | $sequence_13 = { 83c404 8bf0 8d45fc 6a00 50 57 56 } // n = 7, score = 400 // 83c404 | add esp, 4 // 8bf0 | mov esi, eax // 8d45fc | lea eax, [ebp - 4] // 6a00 | push 0 // 50 | push eax // 57 | push edi // 56 | push esi $sequence_14 = { 0f46f9 3d00005000 b900400000 0f46f9 3d00003000 } // n = 5, score = 400 // 0f46f9 | cmovbe edi, ecx // 3d00005000 | cmp eax, 0x500000 // b900400000 | mov ecx, 0x4000 // 0f46f9 | cmovbe edi, ecx // 3d00003000 | cmp eax, 0x300000 $sequence_15 = { 6a08 8907 894f04 e8???????? b9???????? 83c408 } // n = 6, score = 400 // 6a08 | push 8 // 8907 | mov dword ptr [edi], eax // 894f04 | mov dword ptr [edi + 4], ecx // e8???????? | // b9???????? | // 83c408 | add esp, 8 $sequence_16 = { 8d442424 c7442424e0070c00 50 c744242e11001600 c74424321b000000 } // n = 5, score = 200 // 8d442424 | lea eax, [esp + 0x24] // c7442424e0070c00 | mov dword ptr [esp + 0x24], 0xc07e0 // 50 | push eax // c744242e11001600 | mov dword ptr [esp + 0x2e], 0x160011 // c74424321b000000 | mov dword ptr [esp + 0x32], 0x1b $sequence_17 = { ff15???????? ff15???????? 8b4c244c 5f } // n = 4, score = 200 // ff15???????? | // ff15???????? | // 8b4c244c | mov ecx, dword ptr [esp + 0x4c] // 5f | pop edi $sequence_18 = { a1???????? 33c5 8945fc 8d45ec c745ec040a4100 50 } // n = 6, score = 200 // a1???????? | // 33c5 | xor eax, ebp // 8945fc | mov dword ptr [ebp - 4], eax // 8d45ec | lea eax, [ebp - 0x14] // c745ec040a4100 | mov dword ptr [ebp - 0x14], 0x410a04 // 50 | push eax $sequence_19 = { 81f900000400 7542 0c80 88441628 8b04bdd01f0210 c644102901 eb2e } // n = 7, score = 200 // 81f900000400 | cmp ecx, 0x40000 // 7542 | jne 0x44 // 0c80 | or al, 0x80 // 88441628 | mov byte ptr [esi + edx + 0x28], al // 8b04bdd01f0210 | mov eax, dword ptr [edi*4 + 0x10021fd0] // c644102901 | mov byte ptr [eax + edx + 0x29], 1 // eb2e | jmp 0x30 $sequence_20 = { 6aff 8945f8 8d45f4 6a00 50 } // n = 5, score = 200 // 6aff | push -1 // 8945f8 | mov dword ptr [ebp - 8], eax // 8d45f4 | lea eax, [ebp - 0xc] // 6a00 | push 0 // 50 | push eax $sequence_21 = { ff15???????? 8b44241c 89442444 8b442418 89442440 } // n = 5, score = 200 // ff15???????? | // 8b44241c | mov eax, dword ptr [esp + 0x1c] // 89442444 | mov dword ptr [esp + 0x44], eax // 8b442418 | mov eax, dword ptr [esp + 0x18] // 89442440 | mov dword ptr [esp + 0x40], eax $sequence_22 = { 40 c745ec387a0010 894df8 8945fc 64a100000000 } // n = 5, score = 200 // 40 | inc eax // c745ec387a0010 | mov dword ptr [ebp - 0x14], 0x10007a38 // 894df8 | mov dword ptr [ebp - 8], ecx // 8945fc | mov dword ptr [ebp - 4], eax // 64a100000000 | mov eax, dword ptr fs:[0] $sequence_23 = { 3f 2425 2627 2829 06 3f } // n = 6, score = 200 // 3f | aas // 2425 | and al, 0x25 // 2627 | daa // 2829 | sub byte ptr [ecx], ch // 06 | push es // 3f | aas $sequence_24 = { 33c4 89442444 56 57 68???????? } // n = 5, score = 200 // 33c4 | xor eax, esp // 89442444 | mov dword ptr [esp + 0x44], eax // 56 | push esi // 57 | push edi // 68???????? | $sequence_25 = { 0fb6c0 0bc8 894a04 0fbe4608 } // n = 4, score = 200 // 0fb6c0 | movzx eax, al // 0bc8 | or ecx, eax // 894a04 | mov dword ptr [edx + 4], ecx // 0fbe4608 | movsx eax, byte ptr [esi + 8] $sequence_26 = { 85ff 0f84c8000000 837c243c04 0f85bd000000 } // n = 4, score = 200 // 85ff | test edi, edi // 0f84c8000000 | je 0xce // 837c243c04 | cmp dword ptr [esp + 0x3c], 4 // 0f85bd000000 | jne 0xc3 $sequence_27 = { 8bec 51 53 8b1d???????? b8ad04c77e } // n = 5, score = 200 // 8bec | mov ebp, esp // 51 | push ecx // 53 | push ebx // 8b1d???????? | // b8ad04c77e | mov eax, 0x7ec704ad $sequence_28 = { 660f59f5 660f28aa40fe4000 660f54e5 660f58fe } // n = 4, score = 200 // 660f59f5 | mulpd xmm6, xmm5 // 660f28aa40fe4000 | movapd xmm5, xmmword ptr [edx + 0x40fe40] // 660f54e5 | andpd xmm4, xmm5 // 660f58fe | addpd xmm7, xmm6 $sequence_29 = { 3b44240c 0f8c34ffffff 807b3300 7479 807b3200 } // n = 5, score = 200 // 3b44240c | cmp eax, dword ptr [esp + 0xc] // 0f8c34ffffff | jl 0xffffff3a // 807b3300 | cmp byte ptr [ebx + 0x33], 0 // 7479 | je 0x7b // 807b3200 | cmp byte ptr [ebx + 0x32], 0 $sequence_30 = { ff7508 8b15???????? 51 8bcb e8???????? } // n = 5, score = 200 // ff7508 | push dword ptr [ebp + 8] // 8b15???????? | // 51 | push ecx // 8bcb | mov ecx, ebx // e8???????? | $sequence_31 = { c6857dfcfeff01 8bb5f0f9fdff 56 e8???????? 83c404 85c0 } // n = 6, score = 200 // c6857dfcfeff01 | mov byte ptr [ebp - 0x10383], 1 // 8bb5f0f9fdff | mov esi, dword ptr [ebp - 0x20610] // 56 | push esi // e8???????? | // 83c404 | add esp, 4 // 85c0 | test eax, eax $sequence_32 = { 7408 84824faf4400 7528 d92d???????? } // n = 4, score = 100 // 7408 | je 0xa // 84824faf4400 | test byte ptr [edx + 0x44af4f], al // 7528 | jne 0x2a // d92d???????? | $sequence_33 = { 6a01 0fb6db 58 0f44d8 895c2410 e9???????? } // n = 6, score = 100 // 6a01 | push 1 // 0fb6db | movzx ebx, bl // 58 | pop eax // 0f44d8 | cmove ebx, eax // 895c2410 | mov dword ptr [esp + 0x10], ebx // e9???????? | $sequence_34 = { 59 59 85c0 7507 5e 8be5 } // n = 6, score = 100 // 59 | pop ecx // 59 | pop ecx // 85c0 | test eax, eax // 7507 | jne 9 // 5e | pop esi // 8be5 | mov esp, ebp $sequence_35 = { 56 57 83ec0c 8bd9 8bf4 8bce } // n = 6, score = 100 // 56 | push esi // 57 | push edi // 83ec0c | sub esp, 0xc // 8bd9 | mov ebx, ecx // 8bf4 | mov esi, esp // 8bce | mov ecx, esi $sequence_36 = { 7831 8b1cc5647a4400 6a55 53 e8???????? } // n = 5, score = 100 // 7831 | js 0x33 // 8b1cc5647a4400 | mov ebx, dword ptr [eax*8 + 0x447a64] // 6a55 | push 0x55 // 53 | push ebx // e8???????? | $sequence_37 = { f6c303 7403 83cb03 8b4dfc 668bc3 } // n = 5, score = 100 // f6c303 | test bl, 3 // 7403 | je 5 // 83cb03 | or ebx, 3 // 8b4dfc | mov ecx, dword ptr [ebp - 4] // 668bc3 | mov ax, bx $sequence_38 = { 56 57 51 8bd9 8d4dc4 } // n = 5, score = 100 // 56 | push esi // 57 | push edi // 51 | push ecx // 8bd9 | mov ebx, ecx // 8d4dc4 | lea ecx, [ebp - 0x3c] $sequence_39 = { 8d4db8 e8???????? e9???????? 8d8540ffffff e9???????? } // n = 5, score = 100 // 8d4db8 | lea ecx, [ebp - 0x48] // e8???????? | // e9???????? | // 8d8540ffffff | lea eax, [ebp - 0xc0] // e9???????? | condition: 7 of them and filesize < 983040 }