SYMBOLCOMMON_NAMEaka. SYNONYMS
win.cookiebag (Back to overview)

CookieBag

Actor(s): Comment Crew

VTCollection    

There is no description at this point.

References
2018-01-01MandiantMandiant
APT1
Auriga Biscuit Bouncer Combos CookieBag Dairy GetMail GlooxMail Goggles Hacksfase Helauto Kurton ManItsMe MAPIget MiniASP NewsReels SeaSalt StarsyPound Sword TabMsgSQL Tarsip WebC2-AdSpace WebC2-Ausov WebC2-Bolid WebC2-Cson WebC2-DIV WebC2-GreenCat WebC2-Head WebC2-Kt3 WebC2-Qbp WebC2-Rave WebC2-Table WebC2-UGX WebC2-Yahoo
Yara Rules
[TLP:WHITE] win_cookiebag_auto (20230808 | Detects win.cookiebag.)
rule win_cookiebag_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.cookiebag."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cookiebag"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0f8e39050000 8a442437 bf???????? 88442424 83c9ff 33c0 33ed }
            // n = 7, score = 100
            //   0f8e39050000         | jle                 0x53f
            //   8a442437             | mov                 al, byte ptr [esp + 0x37]
            //   bf????????           |                     
            //   88442424             | mov                 byte ptr [esp + 0x24], al
            //   83c9ff               | or                  ecx, 0xffffffff
            //   33c0                 | xor                 eax, eax
            //   33ed                 | xor                 ebp, ebp

        $sequence_1 = { 51 8b4c2414 55 e8???????? 84c0 7412 8b442418 }
            // n = 7, score = 100
            //   51                   | push                ecx
            //   8b4c2414             | mov                 ecx, dword ptr [esp + 0x14]
            //   55                   | push                ebp
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   7412                 | je                  0x14
            //   8b442418             | mov                 eax, dword ptr [esp + 0x18]

        $sequence_2 = { 51 e8???????? 83c404 eb1d 8b4608 8b7604 3bf3 }
            // n = 7, score = 100
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   eb1d                 | jmp                 0x1f
            //   8b4608               | mov                 eax, dword ptr [esi + 8]
            //   8b7604               | mov                 esi, dword ptr [esi + 4]
            //   3bf3                 | cmp                 esi, ebx

        $sequence_3 = { 50 53 52 e8???????? 8bce e8???????? 8b4c2428 }
            // n = 7, score = 100
            //   50                   | push                eax
            //   53                   | push                ebx
            //   52                   | push                edx
            //   e8????????           |                     
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   8b4c2428             | mov                 ecx, dword ptr [esp + 0x28]

        $sequence_4 = { 83c1fe 51 e8???????? 83c404 8b4c242c 897c243c 3bcf }
            // n = 7, score = 100
            //   83c1fe               | add                 ecx, -2
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   8b4c242c             | mov                 ecx, dword ptr [esp + 0x2c]
            //   897c243c             | mov                 dword ptr [esp + 0x3c], edi
            //   3bcf                 | cmp                 ecx, edi

        $sequence_5 = { e8???????? 68???????? e8???????? 83c404 8bd8 8dbe14010000 6a01 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   68????????           |                     
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   8bd8                 | mov                 ebx, eax
            //   8dbe14010000         | lea                 edi, [esi + 0x114]
            //   6a01                 | push                1

        $sequence_6 = { 895c2428 e8???????? 84c0 7427 8b7c2418 8bcd }
            // n = 6, score = 100
            //   895c2428             | mov                 dword ptr [esp + 0x28], ebx
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   7427                 | je                  0x29
            //   8b7c2418             | mov                 edi, dword ptr [esp + 0x18]
            //   8bcd                 | mov                 ecx, ebp

        $sequence_7 = { 85c0 7454 8b87dc000000 85c0 764a 8b44240c }
            // n = 6, score = 100
            //   85c0                 | test                eax, eax
            //   7454                 | je                  0x56
            //   8b87dc000000         | mov                 eax, dword ptr [edi + 0xdc]
            //   85c0                 | test                eax, eax
            //   764a                 | jbe                 0x4c
            //   8b44240c             | mov                 eax, dword ptr [esp + 0xc]

        $sequence_8 = { e8???????? 83c414 b001 5f 5e c20400 5f }
            // n = 7, score = 100
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   b001                 | mov                 al, 1
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   c20400               | ret                 4
            //   5f                   | pop                 edi

        $sequence_9 = { 6a01 8d4c241c c7442444ffffffff e8???????? 8b4c2438 64890d00000000 }
            // n = 6, score = 100
            //   6a01                 | push                1
            //   8d4c241c             | lea                 ecx, [esp + 0x1c]
            //   c7442444ffffffff     | mov                 dword ptr [esp + 0x44], 0xffffffff
            //   e8????????           |                     
            //   8b4c2438             | mov                 ecx, dword ptr [esp + 0x38]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx

    condition:
        7 of them and filesize < 311296
}
Download all Yara Rules