Actor(s): Mirage
There is no description at this point.
rule win_bs2005_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-04-08" version = "1" description = "Detects win.bs2005." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bs2005" malpedia_rule_date = "20220405" malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a" malpedia_version = "20220411" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 885403ff 83f820 7ce0 8bd0 c6041300 } // n = 5, score = 100 // 885403ff | mov byte ptr [ebx + eax - 1], dl // 83f820 | cmp eax, 0x20 // 7ce0 | jl 0xffffffe2 // 8bd0 | mov edx, eax // c6041300 | mov byte ptr [ebx + edx], 0 $sequence_1 = { e8???????? 689c000000 8d8dd8fcffff 6a00 51 e8???????? 8b35???????? } // n = 7, score = 100 // e8???????? | // 689c000000 | push 0x9c // 8d8dd8fcffff | lea ecx, dword ptr [ebp - 0x328] // 6a00 | push 0 // 51 | push ecx // e8???????? | // 8b35???????? | $sequence_2 = { 8d8578fdffff 8d9b00000000 c60000 40 } // n = 4, score = 100 // 8d8578fdffff | lea eax, dword ptr [ebp - 0x288] // 8d9b00000000 | lea ebx, dword ptr [ebx] // c60000 | mov byte ptr [eax], 0 // 40 | inc eax $sequence_3 = { 75f9 8b874c060000 8b08 81c154010400 8bc1 8d7001 8d4900 } // n = 7, score = 100 // 75f9 | jne 0xfffffffb // 8b874c060000 | mov eax, dword ptr [edi + 0x64c] // 8b08 | mov ecx, dword ptr [eax] // 81c154010400 | add ecx, 0x40154 // 8bc1 | mov eax, ecx // 8d7001 | lea esi, dword ptr [eax + 1] // 8d4900 | lea ecx, dword ptr [ecx] $sequence_4 = { 50 ffd7 be40420f00 8da42400000000 8d8dd0feffff 51 } // n = 6, score = 100 // 50 | push eax // ffd7 | call edi // be40420f00 | mov esi, 0xf4240 // 8da42400000000 | lea esp, dword ptr [esp] // 8d8dd0feffff | lea ecx, dword ptr [ebp - 0x130] // 51 | push ecx $sequence_5 = { eb09 3c2f 7505 b93f000000 8d5abf 83c8ff 80fb19 } // n = 7, score = 100 // eb09 | jmp 0xb // 3c2f | cmp al, 0x2f // 7505 | jne 7 // b93f000000 | mov ecx, 0x3f // 8d5abf | lea ebx, dword ptr [edx - 0x41] // 83c8ff | or eax, 0xffffffff // 80fb19 | cmp bl, 0x19 $sequence_6 = { 85c9 7e1d 8b95e0feffff 51 52 8d85e4feffff 50 } // n = 7, score = 100 // 85c9 | test ecx, ecx // 7e1d | jle 0x1f // 8b95e0feffff | mov edx, dword ptr [ebp - 0x120] // 51 | push ecx // 52 | push edx // 8d85e4feffff | lea eax, dword ptr [ebp - 0x11c] // 50 | push eax $sequence_7 = { 8b85a8feffff 3bc3 7403 50 ffd6 399dacfeffff 7409 } // n = 7, score = 100 // 8b85a8feffff | mov eax, dword ptr [ebp - 0x158] // 3bc3 | cmp eax, ebx // 7403 | je 5 // 50 | push eax // ffd6 | call esi // 399dacfeffff | cmp dword ptr [ebp - 0x154], ebx // 7409 | je 0xb $sequence_8 = { 56 50 8b412c ffd0 56 8b35???????? ffd6 } // n = 7, score = 100 // 56 | push esi // 50 | push eax // 8b412c | mov eax, dword ptr [ecx + 0x2c] // ffd0 | call eax // 56 | push esi // 8b35???????? | // ffd6 | call esi $sequence_9 = { c785b4feffff0c000000 c785bcfeffff01000000 899db8feffff ffd7 85c0 } // n = 5, score = 100 // c785b4feffff0c000000 | mov dword ptr [ebp - 0x14c], 0xc // c785bcfeffff01000000 | mov dword ptr [ebp - 0x144], 1 // 899db8feffff | mov dword ptr [ebp - 0x148], ebx // ffd7 | call edi // 85c0 | test eax, eax condition: 7 of them and filesize < 212992 }
import "pe" rule win_bs2005_w0 { meta: description = "Detects malware from APT 15 report by NCC Group" author = "Florian Roth" reference = "https://goo.gl/HZ5XMN" date = "2018-03-10" hash = "750d9eecd533f89b8aa13aeab173a1cf813b021b6824bc30e60f5db6fa7b950b" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bs2005" malpedia_version = "20180312" malpedia_license = "CC BY-NC-SA 4.0" malpedia_sharing = "TLP:WHITE" strings: $x1 = "AAAAKQAASCMAABi+AABnhEBj8vep7VRoAEPRWLweGc0/eiDrXGajJXRxbXsTXAcZAABK4QAAPWwAACzWAAByrg==" fullword ascii $x2 = "AAAAKQAASCMAABi+AABnhKv3kXJJousn5YzkjGF46eE3G8ZGse4B9uoqJo8Q2oF0AABK4QAAPWwAACzWAAByrg==" fullword ascii $a1 = "http://%s/content.html?id=%s" fullword ascii $a2 = "http://%s/main.php?ssid=%s" fullword ascii $a3 = "http://%s/webmail.php?id=%s" fullword ascii $a9 = "http://%s/error.html?tab=%s" fullword ascii $s1 = "%s\\~tmp.txt" fullword ascii $s2 = "%s /C %s >>\"%s\" 2>&1" fullword ascii $s3 = "DisableFirstRunCustomize" fullword ascii condition: 1 of ($x*) or 2 of them }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY