Actor(s): Silent Chollima
There is no description at this point.
rule win_atharvan_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.atharvan." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.atharvan" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 4c8d05ee7a0000 488b9540070000 488bce e8???????? 85c0 750b eb9e } // n = 7, score = 100 // 4c8d05ee7a0000 | dec eax // 488b9540070000 | mov edi, eax // 488bce | movzx ecx, byte ptr [edx + eax*4 + 0x1a992] // e8???????? | // 85c0 | movzx esi, byte ptr [edx + eax*4 + 0x1a993] // 750b | mov ebx, ecx // eb9e | cmova eax, edx $sequence_1 = { 423a9401d4ab0100 7566 488b03 48ffc1 8a10 48ffc0 488903 } // n = 7, score = 100 // 423a9401d4ab0100 | mov eax, eax // 7566 | dec eax // 488b03 | lea ecx, [ebp - 0x60] // 48ffc1 | mov edx, 0x103 // 8a10 | dec eax // 48ffc0 | lea edx, [0x1dd9c] // 488903 | mov byte ptr [esi], 0 $sequence_2 = { 498784f6105c0200 4885c0 7409 488bcb ff15???????? 4885db } // n = 6, score = 100 // 498784f6105c0200 | dec ecx // 4885c0 | xchg dword ptr [edi + esi*8 + 0x25368], eax // 7409 | xor ebx, ebx // 488bcb | mov edi, eax // ff15???????? | // 4885db | test eax, eax $sequence_3 = { 8d0480 03c0 442be8 0f84cffbffff 418d45ff 8b848228aa0100 } // n = 6, score = 100 // 8d0480 | dec eax // 03c0 | mov eax, ebp // 442be8 | dec eax // 0f84cffbffff | mov ecx, dword ptr [eax] // 418d45ff | dec eax // 8b848228aa0100 | lea eax, [0x133b8] $sequence_4 = { 750d 4c8bc6 e8???????? e9???????? 4c8bce 4c8d05e1dd0100 } // n = 6, score = 100 // 750d | cmp dl, byte ptr [ecx + ebx + 0x1abd8] // 4c8bc6 | je 0x97e // e8???????? | // e9???????? | // 4c8bce | inc edi // 4c8d05e1dd0100 | cmp dl, byte ptr [ecx + ebx + 0x1abe0] $sequence_5 = { 498bcf ff15???????? 498bcf ff15???????? 488b4c2440 4833cc e8???????? } // n = 7, score = 100 // 498bcf | arpl ax, dx // ff15???????? | // 498bcf | jmp 0x14f // ff15???????? | // 488b4c2440 | inc esp // 4833cc | mov esi, dword ptr [ebp + 0x150] // e8???????? | $sequence_6 = { b903000000 4c8d0564a10000 488d1565a10000 e8???????? } // n = 4, score = 100 // b903000000 | sub edx, eax // 4c8d0564a10000 | mov eax, 2 // 488d1565a10000 | sub al, byte ptr [ecx] // e8???????? | $sequence_7 = { 498bcf ff15???????? 488bd8 eb02 33db 4c8d3d028cffff 4885db } // n = 7, score = 100 // 498bcf | jne 0x131 // ff15???????? | // 488bd8 | dec eax // eb02 | lea ecx, [0x10e55] // 33db | dec eax // 4c8d3d028cffff | mov dword ptr [ebx + 0x48], ecx // 4885db | dec ecx $sequence_8 = { 7528 48833d????????00 741e 488d0d943e0100 e8???????? 85c0 } // n = 6, score = 100 // 7528 | dec eax // 48833d????????00 | // 741e | add edx, esi // 488d0d943e0100 | inc ebp // e8???????? | // 85c0 | xor ecx, ecx $sequence_9 = { 83f801 751f 488b0d???????? 488d1d356c0100 483bcb 740c } // n = 6, score = 100 // 83f801 | dec esp // 751f | lea eax, [0xa164] // 488b0d???????? | // 488d1d356c0100 | dec eax // 483bcb | lea edx, [0xa165] // 740c | dec eax condition: 7 of them and filesize < 348160 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY