Actor(s): Lazarus Group
There is no description at this point.
rule win_applejeus_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-05-16" version = "1" description = "Detects win.applejeus." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.applejeus" malpedia_rule_date = "20220513" malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26" malpedia_version = "20220516" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { e8???????? 8945dc 8945c0 c700???????? 897004 897808 8b75e4 } // n = 7, score = 100 // e8???????? | // 8945dc | mov dword ptr [ebp - 0x24], eax // 8945c0 | mov dword ptr [ebp - 0x40], eax // c700???????? | // 897004 | mov dword ptr [eax + 4], esi // 897808 | mov dword ptr [eax + 8], edi // 8b75e4 | mov esi, dword ptr [ebp - 0x1c] $sequence_1 = { ffb424fc010000 ffb424fc010000 ffd3 5f 5e 5b 8b8c2468020000 } // n = 7, score = 100 // ffb424fc010000 | push dword ptr [esp + 0x1fc] // ffb424fc010000 | push dword ptr [esp + 0x1fc] // ffd3 | call ebx // 5f | pop edi // 5e | pop esi // 5b | pop ebx // 8b8c2468020000 | mov ecx, dword ptr [esp + 0x268] $sequence_2 = { c700???????? 894804 897008 e8???????? 898540eeffff 8d8de0efffff 8985ececffff } // n = 7, score = 100 // c700???????? | // 894804 | mov dword ptr [eax + 4], ecx // 897008 | mov dword ptr [eax + 8], esi // e8???????? | // 898540eeffff | mov dword ptr [ebp - 0x11c0], eax // 8d8de0efffff | lea ecx, [ebp - 0x1020] // 8985ececffff | mov dword ptr [ebp - 0x1314], eax $sequence_3 = { 040a 83f030 88856ef6ffff 8b8560f6ffff 040b 83f020 88856ff6ffff } // n = 7, score = 100 // 040a | add al, 0xa // 83f030 | xor eax, 0x30 // 88856ef6ffff | mov byte ptr [ebp - 0x992], al // 8b8560f6ffff | mov eax, dword ptr [ebp - 0x9a0] // 040b | add al, 0xb // 83f020 | xor eax, 0x20 // 88856ff6ffff | mov byte ptr [ebp - 0x991], al $sequence_4 = { 50 6865010000 56 8d9518ffffff 8d4d98 e8???????? 8b759c } // n = 7, score = 100 // 50 | push eax // 6865010000 | push 0x165 // 56 | push esi // 8d9518ffffff | lea edx, [ebp - 0xe8] // 8d4d98 | lea ecx, [ebp - 0x68] // e8???????? | // 8b759c | mov esi, dword ptr [ebp - 0x64] $sequence_5 = { 888504feffff 8b85fcfdffff 0405 83f065 888505feffff 8b85fcfdffff 0406 } // n = 7, score = 100 // 888504feffff | mov byte ptr [ebp - 0x1fc], al // 8b85fcfdffff | mov eax, dword ptr [ebp - 0x204] // 0405 | add al, 5 // 83f065 | xor eax, 0x65 // 888505feffff | mov byte ptr [ebp - 0x1fb], al // 8b85fcfdffff | mov eax, dword ptr [ebp - 0x204] // 0406 | add al, 6 $sequence_6 = { 8a45af 0f57c0 8845e8 8b45e8 8945dc 8d45d0 c745d0e0994200 } // n = 7, score = 100 // 8a45af | mov al, byte ptr [ebp - 0x51] // 0f57c0 | xorps xmm0, xmm0 // 8845e8 | mov byte ptr [ebp - 0x18], al // 8b45e8 | mov eax, dword ptr [ebp - 0x18] // 8945dc | mov dword ptr [ebp - 0x24], eax // 8d45d0 | lea eax, [ebp - 0x30] // c745d0e0994200 | mov dword ptr [ebp - 0x30], 0x4299e0 $sequence_7 = { 83f061 88856af6ffff 8b8560f6ffff 0407 83f02f 88856bf6ffff 8b8560f6ffff } // n = 7, score = 100 // 83f061 | xor eax, 0x61 // 88856af6ffff | mov byte ptr [ebp - 0x996], al // 8b8560f6ffff | mov eax, dword ptr [ebp - 0x9a0] // 0407 | add al, 7 // 83f02f | xor eax, 0x2f // 88856bf6ffff | mov byte ptr [ebp - 0x995], al // 8b8560f6ffff | mov eax, dword ptr [ebp - 0x9a0] $sequence_8 = { 88857bfcffff 8b8568fcffff 0410 83f028 88857cfcffff 8b8568fcffff 0411 } // n = 7, score = 100 // 88857bfcffff | mov byte ptr [ebp - 0x385], al // 8b8568fcffff | mov eax, dword ptr [ebp - 0x398] // 0410 | add al, 0x10 // 83f028 | xor eax, 0x28 // 88857cfcffff | mov byte ptr [ebp - 0x384], al // 8b8568fcffff | mov eax, dword ptr [ebp - 0x398] // 0411 | add al, 0x11 $sequence_9 = { 8a8500eeffff 90 8a841500eeffff 8b8dfcedffff 02ca 0fbec0 33c8 } // n = 7, score = 100 // 8a8500eeffff | mov al, byte ptr [ebp - 0x1200] // 90 | nop // 8a841500eeffff | mov al, byte ptr [ebp + edx - 0x1200] // 8b8dfcedffff | mov ecx, dword ptr [ebp - 0x1204] // 02ca | add cl, dl // 0fbec0 | movsx eax, al // 33c8 | xor ecx, eax condition: 7 of them and filesize < 1245184 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY