Actor(s): Comment Crew
There is no description at this point.
rule win_cookiebag_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.cookiebag." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cookiebag" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 0f8e39050000 8a442437 bf???????? 88442424 83c9ff 33c0 33ed } // n = 7, score = 100 // 0f8e39050000 | jle 0x53f // 8a442437 | mov al, byte ptr [esp + 0x37] // bf???????? | // 88442424 | mov byte ptr [esp + 0x24], al // 83c9ff | or ecx, 0xffffffff // 33c0 | xor eax, eax // 33ed | xor ebp, ebp $sequence_1 = { 51 8b4c2414 55 e8???????? 84c0 7412 8b442418 } // n = 7, score = 100 // 51 | push ecx // 8b4c2414 | mov ecx, dword ptr [esp + 0x14] // 55 | push ebp // e8???????? | // 84c0 | test al, al // 7412 | je 0x14 // 8b442418 | mov eax, dword ptr [esp + 0x18] $sequence_2 = { 51 e8???????? 83c404 eb1d 8b4608 8b7604 3bf3 } // n = 7, score = 100 // 51 | push ecx // e8???????? | // 83c404 | add esp, 4 // eb1d | jmp 0x1f // 8b4608 | mov eax, dword ptr [esi + 8] // 8b7604 | mov esi, dword ptr [esi + 4] // 3bf3 | cmp esi, ebx $sequence_3 = { 50 53 52 e8???????? 8bce e8???????? 8b4c2428 } // n = 7, score = 100 // 50 | push eax // 53 | push ebx // 52 | push edx // e8???????? | // 8bce | mov ecx, esi // e8???????? | // 8b4c2428 | mov ecx, dword ptr [esp + 0x28] $sequence_4 = { 83c1fe 51 e8???????? 83c404 8b4c242c 897c243c 3bcf } // n = 7, score = 100 // 83c1fe | add ecx, -2 // 51 | push ecx // e8???????? | // 83c404 | add esp, 4 // 8b4c242c | mov ecx, dword ptr [esp + 0x2c] // 897c243c | mov dword ptr [esp + 0x3c], edi // 3bcf | cmp ecx, edi $sequence_5 = { e8???????? 68???????? e8???????? 83c404 8bd8 8dbe14010000 6a01 } // n = 7, score = 100 // e8???????? | // 68???????? | // e8???????? | // 83c404 | add esp, 4 // 8bd8 | mov ebx, eax // 8dbe14010000 | lea edi, [esi + 0x114] // 6a01 | push 1 $sequence_6 = { 895c2428 e8???????? 84c0 7427 8b7c2418 8bcd } // n = 6, score = 100 // 895c2428 | mov dword ptr [esp + 0x28], ebx // e8???????? | // 84c0 | test al, al // 7427 | je 0x29 // 8b7c2418 | mov edi, dword ptr [esp + 0x18] // 8bcd | mov ecx, ebp $sequence_7 = { 85c0 7454 8b87dc000000 85c0 764a 8b44240c } // n = 6, score = 100 // 85c0 | test eax, eax // 7454 | je 0x56 // 8b87dc000000 | mov eax, dword ptr [edi + 0xdc] // 85c0 | test eax, eax // 764a | jbe 0x4c // 8b44240c | mov eax, dword ptr [esp + 0xc] $sequence_8 = { e8???????? 83c414 b001 5f 5e c20400 5f } // n = 7, score = 100 // e8???????? | // 83c414 | add esp, 0x14 // b001 | mov al, 1 // 5f | pop edi // 5e | pop esi // c20400 | ret 4 // 5f | pop edi $sequence_9 = { 6a01 8d4c241c c7442444ffffffff e8???????? 8b4c2438 64890d00000000 } // n = 6, score = 100 // 6a01 | push 1 // 8d4c241c | lea ecx, [esp + 0x1c] // c7442444ffffffff | mov dword ptr [esp + 0x44], 0xffffffff // e8???????? | // 8b4c2438 | mov ecx, dword ptr [esp + 0x38] // 64890d00000000 | mov dword ptr fs:[0], ecx condition: 7 of them and filesize < 311296 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY