SYMBOLCOMMON_NAMEaka. SYNONYMS
win.agent_btz (Back to overview)

Agent.BTZ

aka: ComRAT, Minit, Sun rootkit

Actor(s): Turla

VTCollection    

There is no description at this point.

References
2023-05-09 ⋅ CISA ⋅ CISA
Hunting Russian Intelligence “Snake” Malware
Agent.BTZ Cobra Carbon System Uroburos
2022-05-02 ⋅ cocomelonc ⋅ cocomelonc
Malware development: persistence - part 3. COM DLL hijack. Simple C++ example
Agent.BTZ Ave Maria Konni Mosquito TurlaRPC
2021-12-01 ⋅ ESET Research ⋅ Alexis Dorais-Joncas, Facundo Muñoz
Jumping the air gap: 15 years of nation‑state effort
Agent.BTZ Fanny Flame Gauss PlugX Ramsay Retro Stuxnet USBCulprit USBferry
2021-09-27 ⋅ Medium ryancor ⋅ Ryan Cornateanu
Deobfuscating PowerShell Malware Droppers
Agent.BTZ
2021-02-28 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team
2021-02-19 ⋅ Palo Alto Networks Unit 42 ⋅ Dominik Reichel
IronNetInjector: Turla’s New Malware Loading Tool
Agent.BTZ IronNetInjector TurlaRPC
2021-02-16 ⋅ US Department of Defense ⋅ US Department of Defense
The creation of the 2020 ComRATv4 illustration
Agent.BTZ
2020-12-21 ⋅ IronNet ⋅ Adam Hlavek, Kimberly Ortiz
Russian cyber attack campaigns and actors
WellMail elf.wellmess Agent.BTZ BlackEnergy EternalPetya Havex RAT Industroyer Ryuk Triton WellMess
2020-10-29 ⋅ US-CERT ⋅ US-CERT
Malware Analysis Report (AR20-303A): PowerShell Script: ComRAT
Agent.BTZ
2020-09-22 ⋅ vmware ⋅ Omar Elgebaly, Takahiro Haruyama
Detecting Threats in Real-time With Active C2 Information
Agent.BTZ Cobalt Strike Dacls NetWire RC PoshC2 Winnti
2020-09-01 ⋅ Möbius Strip Reverse Engineering ⋅ Rolf Rolles
An Exhaustively-Analyzed IDB for ComRAT v4
Agent.BTZ
2020-07-29 ⋅ ESET Research ⋅ welivesecurity
THREAT REPORT Q2 2020
DEFENSOR ID HiddenAd Bundlore Pirrit Agent.BTZ Cerber ClipBanker CROSSWALK Cryptowall CTB Locker DanaBot Dharma Formbook Gandcrab Grandoreiro Houdini ISFB LockBit Locky Mailto Maze Microcin Nemty NjRAT Phobos PlugX Pony REvil Socelars STOP Tinba TrickBot WannaCryptor
2020-05-26 ⋅ ESET Research ⋅ Matthieu Faou
From Agent.BTZ to ComRAT v4: A ten‑year journey (White Paper)
Agent.BTZ
2020-05-26 ⋅ ESET Research ⋅ Matthieu Faou
From Agent.BTZ to ComRAT v4: A ten‑year journey
Agent.BTZ
2020-02-13 ⋅ Qianxin ⋅ Qi Anxin Threat Intelligence Center
APT Report 2019
Chrysaor Exodus Dacls VPNFilter DNSRat Griffon KopiLuwak More_eggs SQLRat AppleJeus BONDUPDATER Agent.BTZ Anchor AndroMut AppleJeus BOOSTWRITE Brambul Carbanak Cobalt Strike Dacls DistTrack DNSpionage Dtrack ELECTRICFISH FlawedAmmyy FlawedGrace Get2 Grateful POS HOPLIGHT Imminent Monitor RAT jason Joanap KerrDown KEYMARBLE Lambert LightNeuron LoJax MiniDuke PolyglotDuke PowerRatankba Rising Sun SDBbot ServHelper Snatch Stuxnet TinyMet tRat TrickBot Volgmer X-Agent Zebrocy
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
IRON HUNTER
Agent.BTZ Cobra Carbon System LightNeuron Mosquito Nautilus Neuron Skipper Uroburos Turla
2018-10-04 ⋅ Kaspersky Labs ⋅ GReAT
Shedding Skin – Turla’s Fresh Faces
KopiLuwak Agent.BTZ Cobra Carbon System Gazer Meterpreter Mosquito Skipper
2018-03-01 ⋅ CrySyS Lab ⋅ Boldizsar Bencsath
Territorial Dispute – NSA’s perspective on APT landscape
9002 RAT Agent.BTZ DuQu EYService Flame FlowerShop Stuxnet Uroburos
2017-09-13 ⋅ Intezer ⋅ Omri Ben Bassat
New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving; Part 2/2
Agent.BTZ
2017-08-07 ⋅ Intezer ⋅ Omri Ben Bassat
New Variants of Agent.BTZ/ComRAT Found: The Threat That Hit The Pentagon In 2008 Still Evolving; Part 1/2
Agent.BTZ
2016-01-14 ⋅ Symantec ⋅ Security Response
The Waterbug attack group
Agent.BTZ Wipbot
2016-01-14 ⋅ Symantec ⋅ Security Response
The Waterbug attack group
Agent.BTZ Cobra Carbon System Wipbot Turla
2015-01-15 ⋅ G Data ⋅ G Data
Weiterentwicklung anspruchsvoller Spyware: von Agent.BTZ zu ComRAT
Agent.BTZ
2014-11-11 ⋅ G Data ⋅ G Data
The Uroburos case: new sophisticated RAT identified
Agent.BTZ Uroburos
2014-03-17 ⋅ BAE Systems ⋅ BAE Systems Applied Intelligence
Snake Campaign & Espionage Toolkit
Agent.BTZ Uroburos
2014-03-12 ⋅ Kaspersky Labs ⋅ Alexander Gostev
Agent.btz: a Source of Inspiration?
Agent.BTZ
2008-11-30 ⋅ ThreatExpert ⋅ Sergei Shevchenko
Agent.btz - A Threat That Hit Pentagon
Agent.BTZ
Yara Rules
[TLP:WHITE] win_agent_btz_auto (20260917 | Detects win.agent_btz.)
rule win_agent_btz_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.agent_btz."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c74608ffffffff f644240801 7409 56 e8???????? }
            // n = 5, score = 2400
            //   c74608ffffffff       | mov                 dword ptr [esi + 8], 0xffffffff
            //   f644240801           | test                byte ptr [esp + 8], 1
            //   7409                 | je                  0xb
            //   56                   | push                esi
            //   e8????????           |                     

        $sequence_1 = { ffd6 8d54240c 52 ffd7 }
            // n = 4, score = 2400
            //   ffd6                 | call                esi
            //   8d54240c             | lea                 edx, [esp + 0xc]
            //   52                   | push                edx
            //   ffd7                 | call                edi

        $sequence_2 = { 8d4c240c 51 ffd6 8d54240c }
            // n = 4, score = 2400
            //   8d4c240c             | lea                 ecx, [esp + 0xc]
            //   51                   | push                ecx
            //   ffd6                 | call                esi
            //   8d54240c             | lea                 edx, [esp + 0xc]

        $sequence_3 = { 50 ffd3 85c0 75d8 5f }
            // n = 5, score = 2400
            //   50                   | push                eax
            //   ffd3                 | call                ebx
            //   85c0                 | test                eax, eax
            //   75d8                 | jne                 0xffffffda
            //   5f                   | pop                 edi

        $sequence_4 = { b805000f00 8b4df4 64890d00000000 5f 5e 5b }
            // n = 6, score = 2300
            //   b805000f00           | mov                 eax, 0xf0005
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx

        $sequence_5 = { c7460c00000000 895e08 895e04 c7461000000000 895e14 }
            // n = 5, score = 2300
            //   c7460c00000000       | mov                 dword ptr [esi + 0xc], 0
            //   895e08               | mov                 dword ptr [esi + 8], ebx
            //   895e04               | mov                 dword ptr [esi + 4], ebx
            //   c7461000000000       | mov                 dword ptr [esi + 0x10], 0
            //   895e14               | mov                 dword ptr [esi + 0x14], ebx

        $sequence_6 = { ff15???????? b803000f00 8b4df4 64890d00000000 }
            // n = 4, score = 2300
            //   ff15????????         |                     
            //   b803000f00           | mov                 eax, 0xf0003
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx

        $sequence_7 = { 56 6a00 68???????? 8935???????? }
            // n = 4, score = 2200
            //   56                   | push                esi
            //   6a00                 | push                0
            //   68????????           |                     
            //   8935????????         |                     

        $sequence_8 = { 8d542408 52 c744240c30000000 c744241003000000 }
            // n = 4, score = 2100
            //   8d542408             | lea                 edx, [esp + 8]
            //   52                   | push                edx
            //   c744240c30000000     | mov                 dword ptr [esp + 0xc], 0x30
            //   c744241003000000     | mov                 dword ptr [esp + 0x10], 3

        $sequence_9 = { 83f8ff 740e 50 ff15???????? c74608ffffffff f644240801 }
            // n = 6, score = 2100
            //   83f8ff               | cmp                 eax, -1
            //   740e                 | je                  0x10
            //   50                   | push                eax
            //   ff15????????         |                     
            //   c74608ffffffff       | mov                 dword ptr [esi + 8], 0xffffffff
            //   f644240801           | test                byte ptr [esp + 8], 1

        $sequence_10 = { 8b4608 c706???????? 85c0 7413 83f8ff 740e }
            // n = 6, score = 2100
            //   8b4608               | mov                 eax, dword ptr [esi + 8]
            //   c706????????         |                     
            //   85c0                 | test                eax, eax
            //   7413                 | je                  0x15
            //   83f8ff               | cmp                 eax, -1
            //   740e                 | je                  0x10

        $sequence_11 = { 51 6a00 6819000200 6a00 68???????? }
            // n = 5, score = 1400
            //   51                   | push                ecx
            //   6a00                 | push                0
            //   6819000200           | push                0x20019
            //   6a00                 | push                0
            //   68????????           |                     

        $sequence_12 = { 6a0a 68???????? 6a01 6a00 }
            // n = 4, score = 1400
            //   6a0a                 | push                0xa
            //   68????????           |                     
            //   6a01                 | push                1
            //   6a00                 | push                0

        $sequence_13 = { 6a01 6a04 6a01 68???????? }
            // n = 4, score = 1100
            //   6a01                 | push                1
            //   6a04                 | push                4
            //   6a01                 | push                1
            //   68????????           |                     

        $sequence_14 = { 50 68???????? 6a01 68???????? e8???????? 83c410 }
            // n = 6, score = 1100
            //   50                   | push                eax
            //   68????????           |                     
            //   6a01                 | push                1
            //   68????????           |                     
            //   e8????????           |                     
            //   83c410               | add                 esp, 0x10

        $sequence_15 = { 50 e8???????? 83c408 6800010000 e8???????? }
            // n = 5, score = 1000
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   6800010000           | push                0x100
            //   e8????????           |                     

        $sequence_16 = { 6a01 68???????? e8???????? 83c414 5f 5e }
            // n = 6, score = 1000
            //   6a01                 | push                1
            //   68????????           |                     
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_17 = { 68???????? 6a01 e8???????? 50 e8???????? 83c41c }
            // n = 6, score = 900
            //   68????????           |                     
            //   6a01                 | push                1
            //   e8????????           |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c41c               | add                 esp, 0x1c

        $sequence_18 = { 0fb605???????? 66890d???????? 0fb60d???????? 660fafca 6603c8 }
            // n = 5, score = 900
            //   0fb605????????       |                     
            //   66890d????????       |                     
            //   0fb60d????????       |                     
            //   660fafca             | imul                cx, dx
            //   6603c8               | add                 cx, ax

        $sequence_19 = { 7511 e8???????? 83c020 50 e8???????? 83c404 }
            // n = 6, score = 900
            //   7511                 | jne                 0x13
            //   e8????????           |                     
            //   83c020               | add                 eax, 0x20
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4

        $sequence_20 = { 89461c 3dea000000 740b 3de5030000 }
            // n = 4, score = 900
            //   89461c               | mov                 ecx, dword ptr [ebp - 0xc]
            //   3dea000000           | mov                 dword ptr fs:[0], ecx
            //   740b                 | pop                 edi
            //   3de5030000           | pop                 esi

        $sequence_21 = { c684248800000043 c684248900000072 c684248a00000065 c684248b00000061 c684248c00000074 c684248d00000065 c684248e00000050 }
            // n = 7, score = 800
            //   c684248800000043     | mov                 byte ptr [esp + 0x88], 0x43
            //   c684248900000072     | mov                 byte ptr [esp + 0x89], 0x72
            //   c684248a00000065     | mov                 byte ptr [esp + 0x8a], 0x65
            //   c684248b00000061     | mov                 byte ptr [esp + 0x8b], 0x61
            //   c684248c00000074     | mov                 byte ptr [esp + 0x8c], 0x74
            //   c684248d00000065     | mov                 byte ptr [esp + 0x8d], 0x65
            //   c684248e00000050     | mov                 byte ptr [esp + 0x8e], 0x50

        $sequence_22 = { c684249500000057 c684249600000000 c684241001000047 c684241101000065 c684241201000074 }
            // n = 5, score = 800
            //   c684249500000057     | mov                 byte ptr [esp + 0x95], 0x57
            //   c684249600000000     | mov                 byte ptr [esp + 0x96], 0
            //   c684241001000047     | mov                 byte ptr [esp + 0x110], 0x47
            //   c684241101000065     | mov                 byte ptr [esp + 0x111], 0x65
            //   c684241201000074     | mov                 byte ptr [esp + 0x112], 0x74

        $sequence_23 = { 8d4df8 51 8d8df8f7ffff 51 57 }
            // n = 5, score = 800
            //   8d4df8               | pop                 edi
            //   51                   | pop                 esi
            //   8d8df8f7ffff         | mov                 eax, 0xf0004
            //   51                   | mov                 ecx, dword ptr [ebp - 0xc]
            //   57                   | mov                 dword ptr fs:[0], ecx

        $sequence_24 = { ff9574ffffff 8b4de0 89410c 33c0 8be5 5d c20400 }
            // n = 7, score = 800
            //   ff9574ffffff         | call                dword ptr [ebp - 0x8c]
            //   8b4de0               | mov                 ecx, dword ptr [ebp - 0x20]
            //   89410c               | mov                 dword ptr [ecx + 0xc], eax
            //   33c0                 | xor                 eax, eax
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c20400               | ret                 4

        $sequence_25 = { c684248c00000074 c684248d00000065 c684248e00000050 c684248f00000072 c68424900000006f c684249100000063 c684249200000065 }
            // n = 7, score = 800
            //   c684248c00000074     | mov                 byte ptr [esp + 0x8c], 0x74
            //   c684248d00000065     | mov                 byte ptr [esp + 0x8d], 0x65
            //   c684248e00000050     | mov                 byte ptr [esp + 0x8e], 0x50
            //   c684248f00000072     | mov                 byte ptr [esp + 0x8f], 0x72
            //   c68424900000006f     | mov                 byte ptr [esp + 0x90], 0x6f
            //   c684249100000063     | mov                 byte ptr [esp + 0x91], 0x63
            //   c684249200000065     | mov                 byte ptr [esp + 0x92], 0x65

        $sequence_26 = { 8b4624 6888130000 ff7618 897dfc }
            // n = 4, score = 800
            //   8b4624               | mov                 ecx, dword ptr [ebp - 0xc]
            //   6888130000           | mov                 dword ptr fs:[0], ecx
            //   ff7618               | pop                 edi
            //   897dfc               | pop                 esi

        $sequence_27 = { 8b5d0c 56 8bf0 8b4624 }
            // n = 4, score = 800
            //   8b5d0c               | mov                 eax, 0xf0005
            //   56                   | mov                 ecx, dword ptr [ebp - 0xc]
            //   8bf0                 | mov                 dword ptr fs:[0], ecx
            //   8b4624               | pop                 edi

        $sequence_28 = { 66894dea 59 6a65 668945f0 66894dec }
            // n = 5, score = 800
            //   66894dea             | pop                 edi
            //   59                   | pop                 esi
            //   6a65                 | mov                 eax, 0xf0000
            //   668945f0             | mov                 ecx, dword ptr [ebp - 0xc]
            //   66894dec             | mov                 dword ptr fs:[0], ecx

        $sequence_29 = { 8bf1 33db 895e10 895e0c }
            // n = 4, score = 800
            //   8bf1                 | mov                 ecx, dword ptr [ebp - 0xc]
            //   33db                 | mov                 dword ptr fs:[0], ecx
            //   895e10               | mov                 eax, 0xf0003
            //   895e0c               | mov                 ecx, dword ptr [ebp - 0xc]

        $sequence_30 = { 6a00 6a27 6a02 6a00 6a01 }
            // n = 5, score = 800
            //   6a00                 | push                0
            //   6a27                 | push                0x27
            //   6a02                 | push                2
            //   6a00                 | push                0
            //   6a01                 | push                1

        $sequence_31 = { 59 6a25 58 6a30 668945f2 58 6a38 }
            // n = 7, score = 800
            //   59                   | mov                 ecx, dword ptr [ebp - 0xc]
            //   6a25                 | mov                 dword ptr fs:[0], ecx
            //   58                   | pop                 edi
            //   6a30                 | pop                 esi
            //   668945f2             | pop                 ebx
            //   58                   | mov                 eax, 0xf0005
            //   6a38                 | mov                 ecx, dword ptr [ebp - 0xc]

        $sequence_32 = { 037dfc 8b4508 83c414 837df800 8938 }
            // n = 5, score = 800
            //   037dfc               | pop                 esi
            //   8b4508               | pop                 ebx
            //   83c414               | mov                 eax, 0xf0003
            //   837df800             | mov                 ecx, dword ptr [ebp - 0xc]
            //   8938                 | mov                 dword ptr fs:[0], ecx

        $sequence_33 = { c684249100000063 c684249200000065 c684249300000073 c684249400000073 c684249500000057 c684249600000000 }
            // n = 6, score = 800
            //   c684249100000063     | mov                 byte ptr [esp + 0x91], 0x63
            //   c684249200000065     | mov                 byte ptr [esp + 0x92], 0x65
            //   c684249300000073     | mov                 byte ptr [esp + 0x93], 0x73
            //   c684249400000073     | mov                 byte ptr [esp + 0x94], 0x73
            //   c684249500000057     | mov                 byte ptr [esp + 0x95], 0x57
            //   c684249600000000     | mov                 byte ptr [esp + 0x96], 0

        $sequence_34 = { 33c9 ff542458 85c0 7420 }
            // n = 4, score = 800
            //   33c9                 | xor                 ecx, ecx
            //   ff542458             | call                dword ptr [esp + 0x58]
            //   85c0                 | test                eax, eax
            //   7420                 | je                  0x22

        $sequence_35 = { 740d 3cff 7409 f6d0 }
            // n = 4, score = 800
            //   740d                 | je                  0xf
            //   3cff                 | cmp                 al, 0xff
            //   7409                 | je                  0xb
            //   f6d0                 | not                 al

        $sequence_36 = { c645d316 c645d43a c645d53b c645d63b c645d730 c645d836 }
            // n = 6, score = 700
            //   c645d316             | mov                 byte ptr [ebp - 0x2d], 0x16
            //   c645d43a             | mov                 byte ptr [ebp - 0x2c], 0x3a
            //   c645d53b             | mov                 byte ptr [ebp - 0x2b], 0x3b
            //   c645d63b             | mov                 byte ptr [ebp - 0x2a], 0x3b
            //   c645d730             | mov                 byte ptr [ebp - 0x29], 0x30
            //   c645d836             | mov                 byte ptr [ebp - 0x28], 0x36

        $sequence_37 = { 8d8505feffff 50 e8???????? 83c40c }
            // n = 4, score = 700
            //   8d8505feffff         | lea                 eax, [ebp - 0x1fb]
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_38 = { c645cb30 c645cc27 c645cd3b c645ce30 }
            // n = 4, score = 700
            //   c645cb30             | mov                 byte ptr [ebp - 0x35], 0x30
            //   c645cc27             | mov                 byte ptr [ebp - 0x34], 0x27
            //   c645cd3b             | mov                 byte ptr [ebp - 0x33], 0x3b
            //   c645ce30             | mov                 byte ptr [ebp - 0x32], 0x30

        $sequence_39 = { 488b4338 33d2 488bce 448d4220 }
            // n = 4, score = 500
            //   488b4338             | dec                 eax
            //   33d2                 | mov                 eax, dword ptr [ebx + 0x38]
            //   488bce               | xor                 edx, edx
            //   448d4220             | dec                 eax

        $sequence_40 = { e8???????? 488b5638 488bcf 8bd8 }
            // n = 4, score = 400
            //   e8????????           |                     
            //   488b5638             | inc                 ecx
            //   488bcf               | push                edi
            //   8bd8                 | dec                 eax

        $sequence_41 = { 488b5538 488bce 8bd8 ff92e8010000 }
            // n = 4, score = 400
            //   488b5538             | push                ecx
            //   488bce               | lea                 ecx, [ebp - 0x808]
            //   8bd8                 | push                ecx
            //   ff92e8010000         | mov                 esi, ecx

        $sequence_42 = { 488b4608 488b0e 48894628 488b4638 4c8d4c2450 }
            // n = 5, score = 400
            //   488b4608             | mov                 dword ptr fs:[0], ecx
            //   488b0e               | pop                 edi
            //   48894628             | pop                 esi
            //   488b4638             | pop                 ebx
            //   4c8d4c2450           | mov                 eax, 0xf0004

        $sequence_43 = { 4155 4156 4157 4883ec40 488b4138 }
            // n = 5, score = 400
            //   4155                 | mov                 eax, dword ptr [ecx + 8]
            //   4156                 | dec                 eax
            //   4157                 | mov                 dword ptr [ecx + 0x28], eax
            //   4883ec40             | dec                 eax
            //   488b4138             | mov                 ecx, dword ptr [edi]

        $sequence_44 = { 488b4108 48894128 488b0f 48396928 }
            // n = 4, score = 400
            //   488b4108             | mov                 eax, dword ptr [edi]
            //   48894128             | mov                 dword ptr [eax + 0x30], ebp
            //   488b0f               | xor                 eax, eax
            //   48396928             | dec                 eax

        $sequence_45 = { 4883ec40 33ed 488bf9 498bf0 }
            // n = 4, score = 400
            //   4883ec40             | dec                 eax
            //   33ed                 | mov                 ecx, dword ptr [edi]
            //   488bf9               | dec                 eax
            //   498bf0               | mov                 eax, dword ptr [ecx + 8]

        $sequence_46 = { 488b0f 894130 eb06 488b07 896830 33c0 488b5c2458 }
            // n = 7, score = 400
            //   488b0f               | mov                 ecx, esi
            //   894130               | inc                 esp
            //   eb06                 | lea                 eax, [edx + 0x20]
            //   488b07               | dec                 eax
            //   896830               | mov                 ecx, dword ptr [edi]
            //   33c0                 | mov                 dword ptr [ecx + 0x30], eax
            //   488b5c2458           | jmp                 8

        $sequence_47 = { 83c904 c1e803 448bc9 440fafc8 }
            // n = 4, score = 400
            //   83c904               | mov                 eax, 0xf0003
            //   c1e803               | mov                 ecx, dword ptr [ebp - 0xc]
            //   448bc9               | mov                 dword ptr fs:[0], ecx
            //   440fafc8             | pop                 edi

        $sequence_48 = { 488b0f 488901 488b07 488338ff }
            // n = 4, score = 400
            //   488b0f               | mov                 dword ptr [ecx + 0x28], eax
            //   488901               | dec                 eax
            //   488b07               | mov                 ecx, dword ptr [edi]
            //   488338ff             | mov                 dword ptr [ecx + 0x30], eax

        $sequence_49 = { 488bcf c744242088130000 e8???????? 488b5738 }
            // n = 4, score = 400
            //   488bcf               | pop                 esi
            //   c744242088130000     | pop                 ebx
            //   e8????????           |                     
            //   488b5738             | mov                 esp, ebp

        $sequence_50 = { 488b4638 488b0e 4c8d442450 4533c9 }
            // n = 4, score = 400
            //   488b4638             | mov                 eax, 0xf0003
            //   488b0e               | mov                 ecx, dword ptr [ebp - 0xc]
            //   4c8d442450           | mov                 dword ptr fs:[0], ecx
            //   4533c9               | pop                 edi

        $sequence_51 = { 488b4638 4c8d4c2450 448bc3 488bd7 }
            // n = 4, score = 400
            //   488b4638             | push                ecx
            //   4c8d4c2450           | mov                 dword ptr [esi + 0x1c], eax
            //   448bc3               | cmp                 eax, 0xea
            //   488bd7               | je                  0x12

        $sequence_52 = { 4533c9 488bd6 ff90c8010000 8bf8 }
            // n = 4, score = 400
            //   4533c9               | xor                 ebx, ebx
            //   488bd6               | mov                 dword ptr [esi + 0x10], ebx
            //   ff90c8010000         | mov                 dword ptr [esi + 0xc], ebx
            //   8bf8                 | mov                 esi, ecx

        $sequence_53 = { 488b0f 48894108 488b0f 488b4108 48894128 }
            // n = 5, score = 400
            //   488b0f               | dec                 eax
            //   48894108             | mov                 eax, dword ptr [edi]
            //   488b0f               | mov                 dword ptr [eax + 0x30], ebp
            //   488b4108             | xor                 eax, eax
            //   48894128             | dec                 eax

        $sequence_54 = { 8d8594faffff 50 68???????? ff15???????? }
            // n = 4, score = 300
            //   8d8594faffff         | lea                 eax, [ebp - 0x56c]
            //   50                   | push                eax
            //   68????????           |                     
            //   ff15????????         |                     

        $sequence_55 = { 59 5f 5e 5d 5b c3 83ec2c }
            // n = 7, score = 200
            //   59                   | pop                 ecx
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   5b                   | pop                 ebx
            //   c3                   | ret                 
            //   83ec2c               | sub                 esp, 0x2c

        $sequence_56 = { 8bce 83e11f c1e106 8b0485100b4200 c644080401 }
            // n = 5, score = 200
            //   8bce                 | mov                 ecx, esi
            //   83e11f               | and                 ecx, 0x1f
            //   c1e106               | shl                 ecx, 6
            //   8b0485100b4200       | mov                 eax, dword ptr [eax*4 + 0x420b10]
            //   c644080401           | mov                 byte ptr [eax + ecx + 4], 1

        $sequence_57 = { 8b1cf56c124200 3bc7 0f851e010000 c745fc00000000 53 }
            // n = 5, score = 200
            //   8b1cf56c124200       | mov                 ebx, dword ptr [esi*8 + 0x42126c]
            //   3bc7                 | cmp                 eax, edi
            //   0f851e010000         | jne                 0x124
            //   c745fc00000000       | mov                 dword ptr [ebp - 4], 0
            //   53                   | push                ebx

        $sequence_58 = { 397d00 1bdb 43 742e f7460800000080 }
            // n = 5, score = 200
            //   397d00               | cmp                 dword ptr [ebp], edi
            //   1bdb                 | sbb                 ebx, ebx
            //   43                   | inc                 ebx
            //   742e                 | je                  0x30
            //   f7460800000080       | test                dword ptr [esi + 8], 0x80000000

        $sequence_59 = { 8903 85c0 7429 8d4df4 51 8d4dfc 51 }
            // n = 7, score = 200
            //   8903                 | mov                 dword ptr [ebx], eax
            //   85c0                 | test                eax, eax
            //   7429                 | je                  0x2b
            //   8d4df4               | lea                 ecx, [ebp - 0xc]
            //   51                   | push                ecx
            //   8d4dfc               | lea                 ecx, [ebp - 4]
            //   51                   | push                ecx

        $sequence_60 = { ff35???????? 8d047dfeffffff 50 6a01 }
            // n = 4, score = 200
            //   ff35????????         |                     
            //   8d047dfeffffff       | lea                 eax, [edi*2 - 2]
            //   50                   | push                eax
            //   6a01                 | push                1

        $sequence_61 = { 5e eb33 53 53 }
            // n = 4, score = 200
            //   5e                   | pop                 esi
            //   eb33                 | jmp                 0x35
            //   53                   | push                ebx
            //   53                   | push                ebx

    condition:
        7 of them and filesize < 5577728
}
[TLP:WHITE] win_agent_btz_w0   (20171113 | No description)
rule win_agent_btz_w0 {
    meta:
        author = "Symantec"
        source = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
        contribution = "pnx - removed FPs"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz"
        malpedia_version = "20171113"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $b = {C645????}
        $c = {C685??FEFFFF??}
        $d = {FFA0??0?0000}
        $e = {89A8??00000068??00000056FFD78B}
        $f = {00004889????030000488B}
        $tmp_fn = "FA.tmp"
    condition:
        ((#c > 200 and #b > 200 ) or (#d > 40) and (#e > 15 or #f > 30)) and $tmp_fn
}
Download all Yara Rules