Actor(s): Pirate Panda
There is no description at this point.
rule win_chiser_client_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.chiser_client." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.chiser_client" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { e8???????? 488d152a1f0200 488d4c2440 e8???????? cc ff15???????? } // n = 6, score = 100 // e8???????? | // 488d152a1f0200 | dec eax // 488d4c2440 | lea ecx, [ecx + 0x80] // e8???????? | // cc | movups xmmword ptr [eax - 0x80], xmm0 // ff15???????? | $sequence_1 = { c0e806 410fb6ce c0e902 4002f8 0fb6c1 410fb6d7 80e23f } // n = 7, score = 100 // c0e806 | dec eax // 410fb6ce | mov edi, dword ptr [ebx] // c0e902 | dec esp // 4002f8 | mov dword ptr [ebp - 0x70], esi // 0fb6c1 | dec ecx // 410fb6d7 | mov ecx, dword ptr [ebp] // 80e23f | dec eax $sequence_2 = { 48894710 488d542430 ff15???????? b905010000 e8???????? ba04010000 } // n = 6, score = 100 // 48894710 | push esp // 488d542430 | dec eax // ff15???????? | // b905010000 | sub esp, 0x28 // e8???????? | // ba04010000 | dec ebp $sequence_3 = { ff15???????? 3db7000000 7531 488bcb ff15???????? 33c0 488b4df8 } // n = 7, score = 100 // ff15???????? | // 3db7000000 | dec eax // 7531 | mov ebx, dword ptr [esp + 0x50] // 488bcb | dec eax // ff15???????? | // 33c0 | mov ebp, dword ptr [esp + 0x58] // 488b4df8 | dec eax $sequence_4 = { 48ffc1 483bca 7ce3 413bd8 750a b805000000 } // n = 6, score = 100 // 48ffc1 | dec eax // 483bca | lea edx, [0x2df64] // 7ce3 | dec eax // 413bd8 | lea edx, [0x2df6a] // 750a | dec eax // b805000000 | mov ecx, ebx $sequence_5 = { 488d1564df0200 488bcb 488905???????? ff15???????? } // n = 4, score = 100 // 488d1564df0200 | inc ebp // 488bcb | mov ebp, ecx // 488905???????? | // ff15???????? | $sequence_6 = { 488bc8 e8???????? 4c634e08 488d146d00000000 4c8b06 4d03c9 488bc8 } // n = 7, score = 100 // 488bc8 | mov dword ptr [esp + 0x18], ebp // e8???????? | // 4c634e08 | dec eax // 488d146d00000000 | mov dword ptr [esp + 0x20], edi // 4c8b06 | inc ecx // 4d03c9 | push esi // 488bc8 | dec eax $sequence_7 = { 488bcf e8???????? 4883c308 48ffc6 493bf6 75d2 4c8b642448 } // n = 7, score = 100 // 488bcf | dec eax // e8???????? | // 4883c308 | mov esi, edx // 48ffc6 | dec eax // 493bf6 | mov ebp, ecx // 75d2 | dec eax // 4c8b642448 | test edx, edx $sequence_8 = { 48f7e5 48c7c1ffffffff 480f40c1 488bc8 e8???????? 4c634e08 488d146d00000000 } // n = 7, score = 100 // 48f7e5 | mov ebx, dword ptr [esp + 0x30] // 48c7c1ffffffff | xor eax, eax // 480f40c1 | dec eax // 488bc8 | mov edx, edi // e8???????? | // 4c634e08 | dec esp // 488d146d00000000 | lea eax, [0x3976a] $sequence_9 = { 7872 3b1d???????? 736a 488bfb 4c8d3506b30300 83e73f } // n = 6, score = 100 // 7872 | jle 0x184 // 3b1d???????? | // 736a | dec eax // 488bfb | lea ebx, [esp + 0x7c] // 4c8d3506b30300 | mov edi, eax // 83e73f | cmp word ptr [edx + eax*2], 0 condition: 7 of them and filesize < 714752 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY