There is no description at this point.
rule win_amadey_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-12-22" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey" malpedia_rule_date = "20201222" malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130" malpedia_version = "20201023" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 84c0 7407 c745fc09000000 c70424???????? } // n = 4, score = 700 // 84c0 | test al, al // 7407 | je 9 // c745fc09000000 | mov dword ptr [ebp - 4], 9 // c70424???????? | $sequence_1 = { e8???????? 890424 e8???????? 84c0 7407 c745fc01000000 c70424???????? } // n = 7, score = 700 // e8???????? | // 890424 | mov dword ptr [esp], eax // e8???????? | // 84c0 | test al, al // 7407 | je 9 // c745fc01000000 | mov dword ptr [ebp - 4], 1 // c70424???????? | $sequence_2 = { e8???????? 84c0 7407 c745fc09000000 c70424???????? e8???????? } // n = 6, score = 700 // e8???????? | // 84c0 | test al, al // 7407 | je 9 // c745fc09000000 | mov dword ptr [ebp - 4], 9 // c70424???????? | // e8???????? | $sequence_3 = { 890424 e8???????? e8???????? 0fb6c0 } // n = 4, score = 700 // 890424 | mov dword ptr [esp], eax // e8???????? | // e8???????? | // 0fb6c0 | movzx eax, al $sequence_4 = { c1e004 8945f4 8b45f4 e8???????? 8d44240c 83c00f c1e804 } // n = 7, score = 700 // c1e004 | shl eax, 4 // 8945f4 | mov dword ptr [ebp - 0xc], eax // 8b45f4 | mov eax, dword ptr [ebp - 0xc] // e8???????? | // 8d44240c | lea eax, [esp + 0xc] // 83c00f | add eax, 0xf // c1e804 | shr eax, 4 $sequence_5 = { 750a c705????????0f000000 a1???????? 898514ffffff 8b8514ffffff c9 } // n = 6, score = 700 // 750a | jne 0xc // c705????????0f000000 | // a1???????? | // 898514ffffff | mov dword ptr [ebp - 0xec], eax // 8b8514ffffff | mov eax, dword ptr [ebp - 0xec] // c9 | leave $sequence_6 = { 83ec20 c70424???????? e8???????? 8b95ecfbffff 89d0 c1e003 29d0 } // n = 7, score = 700 // 83ec20 | sub esp, 0x20 // c70424???????? | // e8???????? | // 8b95ecfbffff | mov edx, dword ptr [ebp - 0x414] // 89d0 | mov eax, edx // c1e003 | shl eax, 3 // 29d0 | sub eax, edx $sequence_7 = { 8d85f8fdffff 890424 e8???????? c744240800020000 c744240400000000 8d85f8fbffff 890424 } // n = 7, score = 700 // 8d85f8fdffff | lea eax, [ebp - 0x208] // 890424 | mov dword ptr [esp], eax // e8???????? | // c744240800020000 | mov dword ptr [esp + 8], 0x200 // c744240400000000 | mov dword ptr [esp + 4], 0 // 8d85f8fbffff | lea eax, [ebp - 0x408] // 890424 | mov dword ptr [esp], eax $sequence_8 = { 751c 807df201 750c c705????????09000000 eb0a c705????????0a000000 } // n = 6, score = 700 // 751c | jne 0x1e // 807df201 | cmp byte ptr [ebp - 0xe], 1 // 750c | jne 0xe // c705????????09000000 | // eb0a | jmp 0xc // c705????????0a000000 | $sequence_9 = { 8b4508 803800 7448 8d45fc ff00 } // n = 5, score = 700 // 8b4508 | mov eax, dword ptr [ebp + 8] // 803800 | cmp byte ptr [eax], 0 // 7448 | je 0x4a // 8d45fc | lea eax, [ebp - 4] // ff00 | inc dword ptr [eax] condition: 7 of them and filesize < 264192 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY