Actor(s): TA428
There is no description at this point.
rule win_cotx_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.cotx." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cotx" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8d85bcebffff 50 e8???????? 8d8dbcebffff } // n = 4, score = 500 // 8d85bcebffff | lea eax, [ebp - 0x1444] // 50 | push eax // e8???????? | // 8d8dbcebffff | lea ecx, [ebp - 0x1444] $sequence_1 = { c705????????2b3d0396 c705????????e54dcca2 c705????????92d61819 c705????????0c56aef3 } // n = 4, score = 500 // c705????????2b3d0396 | // c705????????e54dcca2 | // c705????????92d61819 | // c705????????0c56aef3 | $sequence_2 = { c705????????79e66d38 c705????????ba66ea37 c705????????1671e665 c705????????6d8ddc0b } // n = 4, score = 500 // c705????????79e66d38 | // c705????????ba66ea37 | // c705????????1671e665 | // c705????????6d8ddc0b | $sequence_3 = { c705????????e54dcca2 c705????????92d61819 c705????????0c56aef3 c705????????c8a4ea05 } // n = 4, score = 500 // c705????????e54dcca2 | // c705????????92d61819 | // c705????????0c56aef3 | // c705????????c8a4ea05 | $sequence_4 = { c705????????c4b85363 c705????????3abf261f c705????????890e9944 c705????????dbd99823 c705????????d468bcb5 c705????????a1a14538 } // n = 6, score = 500 // c705????????c4b85363 | // c705????????3abf261f | // c705????????890e9944 | // c705????????dbd99823 | // c705????????d468bcb5 | // c705????????a1a14538 | $sequence_5 = { f3a4 50 0f1185a8faffff e8???????? } // n = 4, score = 500 // f3a4 | rep movsb byte ptr es:[edi], byte ptr [esi] // 50 | push eax // 0f1185a8faffff | movups xmmword ptr [ebp - 0x558], xmm0 // e8???????? | $sequence_6 = { 75f8 0f2805???????? 8d85bdfaffff 8bca c785b8faffff39313044 } // n = 5, score = 500 // 75f8 | jne 0xfffffffa // 0f2805???????? | // 8d85bdfaffff | lea eax, [ebp - 0x543] // 8bca | mov ecx, edx // c785b8faffff39313044 | mov dword ptr [ebp - 0x548], 0x44303139 $sequence_7 = { 6a00 50 68???????? ff15???????? 8b0d???????? } // n = 5, score = 500 // 6a00 | push 0 // 50 | push eax // 68???????? | // ff15???????? | // 8b0d???????? | $sequence_8 = { c705????????d468bcb5 c705????????a1a14538 c705????????2086e659 c705????????eec45abf } // n = 4, score = 500 // c705????????d468bcb5 | // c705????????a1a14538 | // c705????????2086e659 | // c705????????eec45abf | $sequence_9 = { 8975e0 e8???????? b906010200 85c0 } // n = 4, score = 500 // 8975e0 | mov dword ptr [ebp - 0x20], esi // e8???????? | // b906010200 | mov ecx, 0x20106 // 85c0 | test eax, eax condition: 7 of them and filesize < 1171456 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY