Actor(s): Calypso group, Karma Panda
There is no description at this point.
rule win_byeby_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-05-16" version = "1" description = "Detects win.byeby." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.byeby" malpedia_rule_date = "20220513" malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26" malpedia_version = "20220516" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { f30f7e0e 83e908 8d7608 660fd60f 8d7f08 8b048de8cb0010 } // n = 6, score = 100 // f30f7e0e | movq xmm1, qword ptr [esi] // 83e908 | sub ecx, 8 // 8d7608 | lea esi, [esi + 8] // 660fd60f | movq qword ptr [edi], xmm1 // 8d7f08 | lea edi, [edi + 8] // 8b048de8cb0010 | mov eax, dword ptr [ecx*4 + 0x1000cbe8] $sequence_1 = { e8???????? 6a04 8d442430 c7442430c0270900 50 } // n = 5, score = 100 // e8???????? | // 6a04 | push 4 // 8d442430 | lea eax, [esp + 0x30] // c7442430c0270900 | mov dword ptr [esp + 0x30], 0x927c0 // 50 | push eax $sequence_2 = { 6803010000 8d85c9fdffff c685c8fdffff00 6a00 50 } // n = 5, score = 100 // 6803010000 | push 0x103 // 8d85c9fdffff | lea eax, [ebp - 0x237] // c685c8fdffff00 | mov byte ptr [ebp - 0x238], 0 // 6a00 | push 0 // 50 | push eax $sequence_3 = { ffb578feffff ff15???????? ffb57cfeffff ff15???????? 8b4dfc } // n = 5, score = 100 // ffb578feffff | push dword ptr [ebp - 0x188] // ff15???????? | // ffb57cfeffff | push dword ptr [ebp - 0x184] // ff15???????? | // 8b4dfc | mov ecx, dword ptr [ebp - 4] $sequence_4 = { 83f8ff 7535 8d4df0 c745f0556d566a } // n = 4, score = 100 // 83f8ff | cmp eax, -1 // 7535 | jne 0x37 // 8d4df0 | lea ecx, [ebp - 0x10] // c745f0556d566a | mov dword ptr [ebp - 0x10], 0x6a566d55 $sequence_5 = { 6a04 51 6806100000 68ffff0000 50 c744244060ea0000 ffd6 } // n = 7, score = 100 // 6a04 | push 4 // 51 | push ecx // 6806100000 | push 0x1006 // 68ffff0000 | push 0xffff // 50 | push eax // c744244060ea0000 | mov dword ptr [esp + 0x40], 0xea60 // ffd6 | call esi $sequence_6 = { 8d8424f80a0000 64a300000000 6800020000 8d8424d8000000 0f57c0 } // n = 5, score = 100 // 8d8424f80a0000 | lea eax, [esp + 0xaf8] // 64a300000000 | mov dword ptr fs:[0], eax // 6800020000 | push 0x200 // 8d8424d8000000 | lea eax, [esp + 0xd8] // 0f57c0 | xorps xmm0, xmm0 $sequence_7 = { 50 e8???????? 83c40c 85c0 0f85db000000 6a40 } // n = 6, score = 100 // 50 | push eax // e8???????? | // 83c40c | add esp, 0xc // 85c0 | test eax, eax // 0f85db000000 | jne 0xe1 // 6a40 | push 0x40 $sequence_8 = { c685a0fcffff00 6a00 50 e8???????? 83c40c 8d4705 8b3d???????? } // n = 7, score = 100 // c685a0fcffff00 | mov byte ptr [ebp - 0x360], 0 // 6a00 | push 0 // 50 | push eax // e8???????? | // 83c40c | add esp, 0xc // 8d4705 | lea eax, [edi + 5] // 8b3d???????? | $sequence_9 = { 6a00 50 e8???????? 83c40c c78424d40200005656424d 8d8424d4020000 c78424d802000054304645 } // n = 7, score = 100 // 6a00 | push 0 // 50 | push eax // e8???????? | // 83c40c | add esp, 0xc // c78424d40200005656424d | mov dword ptr [esp + 0x2d4], 0x4d425656 // 8d8424d4020000 | lea eax, [esp + 0x2d4] // c78424d802000054304645 | mov dword ptr [esp + 0x2d8], 0x45463054 condition: 7 of them and filesize < 253952 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY