SYMBOLCOMMON_NAMEaka. SYNONYMS
win.absentloader (Back to overview)

AbSent Loader


There is no description at this point.

References
2020-05-12Twitter (@cocaman)Corsin Camichel
@online{camichel:20200512:absent:f352502, author = {Corsin Camichel}, title = {{Tweet on AbSent Loader}}, date = {2020-05-12}, organization = {Twitter (@cocaman)}, url = {https://twitter.com/cocaman/status/1260069549069733888}, language = {English}, urldate = {2020-05-15} } Tweet on AbSent Loader
AbSent Loader
2019-05-09Github (Tlgyt)Yattaze
@online{yattaze:20190509:github:add51eb, author = {Yattaze}, title = {{Github Repository of AbSent-Loader}}, date = {2019-05-09}, organization = {Github (Tlgyt)}, url = {https://github.com/Tlgyt/AbSent-Loader}, language = {English}, urldate = {2020-05-18} } Github Repository of AbSent-Loader
AbSent Loader
Yara Rules
[TLP:WHITE] win_absentloader_auto (20211008 | Detects win.absentloader.)
rule win_absentloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.absentloader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.absentloader"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7520 8b7008 ff7510 8d4610 50 e8???????? 84c0 }
            // n = 7, score = 200
            //   7520                 | jne                 0x22
            //   8b7008               | mov                 esi, dword ptr [eax + 8]
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   8d4610               | lea                 eax, dword ptr [esi + 0x10]
            //   50                   | push                eax
            //   e8????????           |                     
            //   84c0                 | test                al, al

        $sequence_1 = { 8d85e8feffff c645fc17 50 e8???????? 68bcf905fd 8d8db8feffff e8???????? }
            // n = 7, score = 200
            //   8d85e8feffff         | lea                 eax, dword ptr [ebp - 0x118]
            //   c645fc17             | mov                 byte ptr [ebp - 4], 0x17
            //   50                   | push                eax
            //   e8????????           |                     
            //   68bcf905fd           | push                0xfd05f9bc
            //   8d8db8feffff         | lea                 ecx, dword ptr [ebp - 0x148]
            //   e8????????           |                     

        $sequence_2 = { 7430 8325????????00 8bcb 68a89806fd ff15???????? ffd3 57 }
            // n = 7, score = 200
            //   7430                 | je                  0x32
            //   8325????????00       |                     
            //   8bcb                 | mov                 ecx, ebx
            //   68a89806fd           | push                0xfd0698a8
            //   ff15????????         |                     
            //   ffd3                 | call                ebx
            //   57                   | push                edi

        $sequence_3 = { 54 8bcb e8???????? 8d8d48ffffff e8???????? 8d8548ffffff c645fc07 }
            // n = 7, score = 200
            //   54                   | push                esp
            //   8bcb                 | mov                 ecx, ebx
            //   e8????????           |                     
            //   8d8d48ffffff         | lea                 ecx, dword ptr [ebp - 0xb8]
            //   e8????????           |                     
            //   8d8548ffffff         | lea                 eax, dword ptr [ebp - 0xb8]
            //   c645fc07             | mov                 byte ptr [ebp - 4], 7

        $sequence_4 = { e8???????? 83c410 ebe3 8b4df8 8b55f4 8b048de8a006fd }
            // n = 6, score = 200
            //   e8????????           |                     
            //   83c410               | add                 esp, 0x10
            //   ebe3                 | jmp                 0xffffffe5
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   8b048de8a006fd       | mov                 eax, dword ptr [ecx*4 - 0x2f95f18]

        $sequence_5 = { c645fc1e 8bcc 89a590faffff 8d4548 50 83611000 83611400 }
            // n = 7, score = 200
            //   c645fc1e             | mov                 byte ptr [ebp - 4], 0x1e
            //   8bcc                 | mov                 ecx, esp
            //   89a590faffff         | mov                 dword ptr [ebp - 0x570], esp
            //   8d4548               | lea                 eax, dword ptr [ebp + 0x48]
            //   50                   | push                eax
            //   83611000             | and                 dword ptr [ecx + 0x10], 0
            //   83611400             | and                 dword ptr [ecx + 0x14], 0

        $sequence_6 = { 803f02 895df0 7515 ff7508 8bd6 e8???????? 59 }
            // n = 7, score = 200
            //   803f02               | cmp                 byte ptr [edi], 2
            //   895df0               | mov                 dword ptr [ebp - 0x10], ebx
            //   7515                 | jne                 0x17
            //   ff7508               | push                dword ptr [ebp + 8]
            //   8bd6                 | mov                 edx, esi
            //   e8????????           |                     
            //   59                   | pop                 ecx

        $sequence_7 = { 8b0c8de8a006fd c644112800 85f6 740c 56 e8???????? 59 }
            // n = 7, score = 200
            //   8b0c8de8a006fd       | mov                 ecx, dword ptr [ecx*4 - 0x2f95f18]
            //   c644112800           | mov                 byte ptr [ecx + edx + 0x28], 0
            //   85f6                 | test                esi, esi
            //   740c                 | je                  0xe
            //   56                   | push                esi
            //   e8????????           |                     
            //   59                   | pop                 ecx

        $sequence_8 = { e8???????? 8bc8 c645fc00 e8???????? 894630 8d4de0 e8???????? }
            // n = 7, score = 200
            //   e8????????           |                     
            //   8bc8                 | mov                 ecx, eax
            //   c645fc00             | mov                 byte ptr [ebp - 4], 0
            //   e8????????           |                     
            //   894630               | mov                 dword ptr [esi + 0x30], eax
            //   8d4de0               | lea                 ecx, dword ptr [ebp - 0x20]
            //   e8????????           |                     

        $sequence_9 = { 0f84e2060000 e9???????? 83f804 0f852b030000 8d4658 8bcf 50 }
            // n = 7, score = 200
            //   0f84e2060000         | je                  0x6e8
            //   e9????????           |                     
            //   83f804               | cmp                 eax, 4
            //   0f852b030000         | jne                 0x331
            //   8d4658               | lea                 eax, dword ptr [esi + 0x58]
            //   8bcf                 | mov                 ecx, edi
            //   50                   | push                eax

    condition:
        7 of them and filesize < 794624
}
Download all Yara Rules