There is no description at this point.
rule win_citadel_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-12-22" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.citadel" malpedia_rule_date = "20201222" malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130" malpedia_version = "20201023" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { eb0e 6800800000 53 57 56 } // n = 5, score = 4900 // eb0e | jmp 0x10 // 6800800000 | push 0x8000 // 53 | push ebx // 57 | push edi // 56 | push esi $sequence_1 = { 89442414 e8???????? 84c0 7407 c644240f01 eb2f 8bcb } // n = 7, score = 4800 // 89442414 | mov dword ptr [esp + 0x14], eax // e8???????? | // 84c0 | test al, al // 7407 | je 9 // c644240f01 | mov byte ptr [esp + 0xf], 1 // eb2f | jmp 0x31 // 8bcb | mov ecx, ebx $sequence_2 = { 5f 5e c20400 55 8bec 8b4d0c } // n = 6, score = 4800 // 5f | pop edi // 5e | pop esi // c20400 | ret 4 // 55 | push ebp // 8bec | mov ebp, esp // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] $sequence_3 = { 50 e8???????? 6a44 5a 52 } // n = 5, score = 4800 // 50 | push eax // e8???????? | // 6a44 | push 0x44 // 5a | pop edx // 52 | push edx $sequence_4 = { 6a00 e8???????? 8bf8 85ff 7437 8d75f0 83c8ff } // n = 7, score = 4800 // 6a00 | push 0 // e8???????? | // 8bf8 | mov edi, eax // 85ff | test edi, edi // 7437 | je 0x39 // 8d75f0 | lea esi, [ebp - 0x10] // 83c8ff | or eax, 0xffffffff $sequence_5 = { 8d7c0201 8bc7 e8???????? 8b1d???????? 8bf0 } // n = 5, score = 4800 // 8d7c0201 | lea edi, [edx + eax + 1] // 8bc7 | mov eax, edi // e8???????? | // 8b1d???????? | // 8bf0 | mov esi, eax $sequence_6 = { e8???????? 5d ff25???????? 55 8bec ff7508 e8???????? } // n = 7, score = 4800 // e8???????? | // 5d | pop ebp // ff25???????? | // 55 | push ebp // 8bec | mov ebp, esp // ff7508 | push dword ptr [ebp + 8] // e8???????? | $sequence_7 = { c745fc00040000 e8???????? 84c0 750f } // n = 4, score = 4800 // c745fc00040000 | mov dword ptr [ebp - 4], 0x400 // e8???????? | // 84c0 | test al, al // 750f | jne 0x11 $sequence_8 = { 6a01 57 57 8bc6 50 } // n = 5, score = 4800 // 6a01 | push 1 // 57 | push edi // 57 | push edi // 8bc6 | mov eax, esi // 50 | push eax $sequence_9 = { 53 53 8d450c 50 57 } // n = 5, score = 4800 // 53 | push ebx // 53 | push ebx // 8d450c | lea eax, [ebp + 0xc] // 50 | push eax // 57 | push edi $sequence_10 = { ff742410 e8???????? 5f 5e 5b 8be5 } // n = 6, score = 4800 // ff742410 | push dword ptr [esp + 0x10] // e8???????? | // 5f | pop edi // 5e | pop esi // 5b | pop ebx // 8be5 | mov esp, ebp $sequence_11 = { e8???????? ff74241c e8???????? 807c240f00 750e ff742410 e8???????? } // n = 7, score = 4800 // e8???????? | // ff74241c | push dword ptr [esp + 0x1c] // e8???????? | // 807c240f00 | cmp byte ptr [esp + 0xf], 0 // 750e | jne 0x10 // ff742410 | push dword ptr [esp + 0x10] // e8???????? | $sequence_12 = { 8d440810 3d00002003 7715 8b4d08 } // n = 4, score = 4800 // 8d440810 | lea eax, [eax + ecx + 0x10] // 3d00002003 | cmp eax, 0x3200000 // 7715 | ja 0x17 // 8b4d08 | mov ecx, dword ptr [ebp + 8] $sequence_13 = { 8b4508 6a03 e8???????? 894508 85c0 75d2 8d041f } // n = 7, score = 4800 // 8b4508 | mov eax, dword ptr [ebp + 8] // 6a03 | push 3 // e8???????? | // 894508 | mov dword ptr [ebp + 8], eax // 85c0 | test eax, eax // 75d2 | jne 0xffffffd4 // 8d041f | lea eax, [edi + ebx] $sequence_14 = { 6a01 8bc6 e8???????? 8b4d08 8bd8 e8???????? } // n = 6, score = 4800 // 6a01 | push 1 // 8bc6 | mov eax, esi // e8???????? | // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 8bd8 | mov ebx, eax // e8???????? | $sequence_15 = { 8a5602 8b4e10 8a5e14 fec8 32d0 8ac2 3245fe } // n = 7, score = 3700 // 8a5602 | mov dl, byte ptr [esi + 2] // 8b4e10 | mov ecx, dword ptr [esi + 0x10] // 8a5e14 | mov bl, byte ptr [esi + 0x14] // fec8 | dec al // 32d0 | xor dl, al // 8ac2 | mov al, dl // 3245fe | xor al, byte ptr [ebp - 2] $sequence_16 = { 0f8417010000 85ff 0f84dd000000 53 } // n = 4, score = 3700 // 0f8417010000 | je 0x11d // 85ff | test edi, edi // 0f84dd000000 | je 0xe3 // 53 | push ebx $sequence_17 = { 73fa 0fb6c9 8b04c8 ebae 32c0 5f c9 } // n = 7, score = 3700 // 73fa | jae 0xfffffffc // 0fb6c9 | movzx ecx, cl // 8b04c8 | mov eax, dword ptr [eax + ecx*8] // ebae | jmp 0xffffffb0 // 32c0 | xor al, al // 5f | pop edi // c9 | leave $sequence_18 = { 8b44c104 e9???????? d0e9 3aca 73fa 0fb6c9 } // n = 6, score = 3700 // 8b44c104 | mov eax, dword ptr [ecx + eax*8 + 4] // e9???????? | // d0e9 | shr cl, 1 // 3aca | cmp cl, dl // 73fa | jae 0xfffffffc // 0fb6c9 | movzx ecx, cl $sequence_19 = { 8a4e09 8a5614 85c0 7404 } // n = 4, score = 3700 // 8a4e09 | mov cl, byte ptr [esi + 9] // 8a5614 | mov dl, byte ptr [esi + 0x14] // 85c0 | test eax, eax // 7404 | je 6 $sequence_20 = { 85f6 0f842b010000 837e1000 0f8421010000 807e1400 } // n = 5, score = 3700 // 85f6 | test esi, esi // 0f842b010000 | je 0x131 // 837e1000 | cmp dword ptr [esi + 0x10], 0 // 0f8421010000 | je 0x127 // 807e1400 | cmp byte ptr [esi + 0x14], 0 $sequence_21 = { 33c0 85c0 740b 8a5604 8a4e01 ffd0 } // n = 6, score = 3700 // 33c0 | xor eax, eax // 85c0 | test eax, eax // 740b | je 0xd // 8a5604 | mov dl, byte ptr [esi + 4] // 8a4e01 | mov cl, byte ptr [esi + 1] // ffd0 | call eax $sequence_22 = { 66ff460c 6639460c 7228 8b4610 8a4e05 8a5614 85c0 } // n = 7, score = 3700 // 66ff460c | inc word ptr [esi + 0xc] // 6639460c | cmp word ptr [esi + 0xc], ax // 7228 | jb 0x2a // 8b4610 | mov eax, dword ptr [esi + 0x10] // 8a4e05 | mov cl, byte ptr [esi + 5] // 8a5614 | mov dl, byte ptr [esi + 0x14] // 85c0 | test eax, eax condition: 7 of them and filesize < 1236992 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY