Actor(s): Lazarus Group
There is no description at this point.
rule win_badcall_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.badcall." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.badcall" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 7e15 8b4c2408 8a1408 80ea28 } // n = 4, score = 300 // 7e15 | jle 0x17 // 8b4c2408 | mov ecx, dword ptr [esp + 8] // 8a1408 | mov dl, byte ptr [eax + ecx] // 80ea28 | sub dl, 0x28 $sequence_1 = { 85c0 7409 50 e8???????? 83c404 8b7604 85f6 } // n = 7, score = 300 // 85c0 | test eax, eax // 7409 | je 0xb // 50 | push eax // e8???????? | // 83c404 | add esp, 4 // 8b7604 | mov esi, dword ptr [esi + 4] // 85f6 | test esi, esi $sequence_2 = { 5f b801000000 5b 81c40c030000 c3 5f b801000000 } // n = 7, score = 300 // 5f | pop edi // b801000000 | mov eax, 1 // // 81c40c030000 | add esp, 0x30c // c3 | ret // 5f | pop edi // b801000000 | mov eax, 1 $sequence_3 = { e8???????? e8???????? 50 89460c e8???????? 83c404 } // n = 6, score = 300 // e8???????? | // e8???????? | // 50 | push eax // 89460c | mov dword ptr [esi + 0xc], eax // e8???????? | // 83c404 | add esp, 4 $sequence_4 = { 51 ff15???????? 5e 83c410 c20800 83c8ff 5e } // n = 7, score = 300 // 51 | push ecx // ff15???????? | // 5e | pop esi // 83c410 | add esp, 0x10 // c20800 | ret 8 // 83c8ff | or eax, 0xffffffff // 5e | pop esi $sequence_5 = { 8bf1 0f84ff000000 8bac2428020000 6685ed 0f84ef000000 8b84242c020000 85c0 } // n = 7, score = 300 // 8bf1 | mov esi, ecx // 0f84ff000000 | je 0x105 // 8bac2428020000 | mov ebp, dword ptr [esp + 0x228] // 6685ed | test bp, bp // 0f84ef000000 | je 0xf5 // 8b84242c020000 | mov eax, dword ptr [esp + 0x22c] // 85c0 | test eax, eax $sequence_6 = { ff15???????? 85c0 0f85a9000000 8b542408 8d4c240c 56 } // n = 6, score = 300 // ff15???????? | // 85c0 | test eax, eax // 0f85a9000000 | jne 0xaf // 8b542408 | mov edx, dword ptr [esp + 8] // 8d4c240c | lea ecx, [esp + 0xc] // 56 | push esi $sequence_7 = { 8a542420 3aca 7509 66817c24090103 7402 33c0 } // n = 6, score = 300 // 8a542420 | mov dl, byte ptr [esp + 0x20] // 3aca | cmp cl, dl // 7509 | jne 0xb // 66817c24090103 | cmp word ptr [esp + 9], 0x301 // 7402 | je 4 // 33c0 | xor eax, eax $sequence_8 = { 0f84cc040000 33c9 48 8a4d00 8944242c 8bc1 8bcb } // n = 7, score = 200 // 0f84cc040000 | je 0x4d2 // 33c9 | xor ecx, ecx // 48 | dec eax // 8a4d00 | mov cl, byte ptr [ebp] // 8944242c | mov dword ptr [esp + 0x2c], eax // 8bc1 | mov eax, ecx // 8bcb | mov ecx, ebx $sequence_9 = { 8bbc248c010000 83c608 b94b000000 33c0 f3a5 5f 5e } // n = 7, score = 200 // 8bbc248c010000 | mov edi, dword ptr [esp + 0x18c] // 83c608 | add esi, 8 // b94b000000 | mov ecx, 0x4b // 33c0 | xor eax, eax // f3a5 | rep movsd dword ptr es:[edi], dword ptr [esi] // 5f | pop edi // 5e | pop esi $sequence_10 = { 83c404 6681c16c07 66894c2408 668b5010 } // n = 4, score = 200 // 83c404 | add esp, 4 // 6681c16c07 | add cx, 0x76c // 66894c2408 | mov word ptr [esp + 8], cx // 668b5010 | mov dx, word ptr [eax + 0x10] $sequence_11 = { e8???????? 85c0 a3???????? 740d 56 e8???????? } // n = 6, score = 200 // e8???????? | // 85c0 | test eax, eax // a3???????? | // 740d | je 0xf // 56 | push esi // e8???????? | $sequence_12 = { c705????????00070000 33c0 5f 5e 5b 81c490000000 } // n = 6, score = 200 // c705????????00070000 | // 33c0 | xor eax, eax // 5f | pop edi // 5e | pop esi // 5b | pop ebx // 81c490000000 | add esp, 0x90 $sequence_13 = { 81e2e0030000 81faa0030000 0f87c5050000 c1e805 83e01f 6a04 } // n = 6, score = 200 // 81e2e0030000 | and edx, 0x3e0 // 81faa0030000 | cmp edx, 0x3a0 // 0f87c5050000 | ja 0x5cb // c1e805 | shr eax, 5 // 83e01f | and eax, 0x1f // 6a04 | push 4 $sequence_14 = { 50 51 e8???????? 83c428 894304 85c0 0f84e3060000 } // n = 7, score = 200 // 50 | push eax // 51 | push ecx // e8???????? | // 83c428 | add esp, 0x28 // 894304 | mov dword ptr [ebx + 4], eax // 85c0 | test eax, eax // 0f84e3060000 | je 0x6e9 $sequence_15 = { 8bc8 c1e902 80e101 884c2413 } // n = 4, score = 200 // 8bc8 | mov ecx, eax // c1e902 | shr ecx, 2 // 80e101 | and cl, 1 // 884c2413 | mov byte ptr [esp + 0x13], cl $sequence_16 = { 8bd9 762f 8b6c2414 8bc7 2bc6 } // n = 5, score = 100 // 8bd9 | mov ebx, ecx // 762f | jbe 0x31 // 8b6c2414 | mov ebp, dword ptr [esp + 0x14] // 8bc7 | mov eax, edi // 2bc6 | sub eax, esi $sequence_17 = { c1f905 8d04c0 8b0c8de0ad0110 8d44810c 50 ff15???????? c3 } // n = 7, score = 100 // c1f905 | sar ecx, 5 // 8d04c0 | lea eax, [eax + eax*8] // 8b0c8de0ad0110 | mov ecx, dword ptr [ecx*4 + 0x1001ade0] // 8d44810c | lea eax, [ecx + eax*4 + 0xc] // 50 | push eax // ff15???????? | // c3 | ret $sequence_18 = { 898424a0000000 ff15???????? 8d942498000000 6a10 52 } // n = 5, score = 100 // 898424a0000000 | mov dword ptr [esp + 0xa0], eax // ff15???????? | // 8d942498000000 | lea edx, [esp + 0x98] // 6a10 | push 0x10 // 52 | push edx $sequence_19 = { ff12 e9???????? 8b442438 3bc3 8d8424a8000000 50 56 } // n = 7, score = 100 // ff12 | call dword ptr [edx] // e9???????? | // 8b442438 | mov eax, dword ptr [esp + 0x38] // 3bc3 | cmp eax, ebx // 8d8424a8000000 | lea eax, [esp + 0xa8] // 50 | push eax // 56 | push esi $sequence_20 = { 8a4dff 8d3c85e0ad0110 8bc3 80c901 83e01f 884d0b } // n = 6, score = 100 // 8a4dff | mov cl, byte ptr [ebp - 1] // 8d3c85e0ad0110 | lea edi, [eax*4 + 0x1001ade0] // 8bc3 | mov eax, ebx // 80c901 | or cl, 1 // 83e01f | and eax, 0x1f // 884d0b | mov byte ptr [ebp + 0xb], cl $sequence_21 = { e9???????? e8???????? 83c408 85c0 0f849dfcffff 8b8424a8000000 c7442428ae080000 } // n = 7, score = 100 // e9???????? | // e8???????? | // 83c408 | add esp, 8 // 85c0 | test eax, eax // 0f849dfcffff | je 0xfffffca3 // 8b8424a8000000 | mov eax, dword ptr [esp + 0xa8] // c7442428ae080000 | mov dword ptr [esp + 0x28], 0x8ae $sequence_22 = { 6a00 50 8d842424010000 50 51 } // n = 5, score = 100 // 6a00 | push 0 // 50 | push eax // 8d842424010000 | lea eax, [esp + 0x124] // 50 | push eax // 51 | push ecx $sequence_23 = { 6a01 53 8915???????? 66ab ff15???????? 8b2d???????? 8d4c242c } // n = 7, score = 100 // 6a01 | push 1 // 53 | push ebx // 8915???????? | // 66ab | stosw word ptr es:[edi], ax // ff15???????? | // 8b2d???????? | // 8d4c242c | lea ecx, [esp + 0x2c] condition: 7 of them and filesize < 483328 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY
