Actor(s): Lazarus Group
According to Cisco Talos, CRAT is a remote access trojan with plugin capabilites, used by Lazarus since at least May 2020.
rule win_crat_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.crat." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crat" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { ebd0 498bc4 48833d????????10 480f4305???????? } // n = 4, score = 500 // ebd0 | dec eax // 498bc4 | lea ecx, [ebp + 0x170] // 48833d????????10 | // 480f4305???????? | $sequence_1 = { e8???????? 488bd0 488d8da0010000 e8???????? 90 } // n = 5, score = 500 // e8???????? | // 488bd0 | dec eax // 488d8da0010000 | mov edx, eax // e8???????? | // 90 | dec eax $sequence_2 = { e8???????? 488bd0 488d8d40010000 e8???????? 90 } // n = 5, score = 500 // e8???????? | // 488bd0 | lea ecx, [ebp + 0x158] // 488d8d40010000 | nop // e8???????? | // 90 | dec eax $sequence_3 = { e8???????? 488bd0 488d8d70010000 e8???????? } // n = 4, score = 500 // e8???????? | // 488bd0 | dec eax // 488d8d70010000 | mov edx, eax // e8???????? | $sequence_4 = { e8???????? 488bd0 488d8d78010000 e8???????? 90 } // n = 5, score = 500 // e8???????? | // 488bd0 | nop // 488d8d78010000 | dec eax // e8???????? | // 90 | mov edx, eax $sequence_5 = { e8???????? 488bd0 488d8d90010000 e8???????? 90 } // n = 5, score = 500 // e8???????? | // 488bd0 | mov edx, eax // 488d8d90010000 | dec eax // e8???????? | // 90 | lea ecx, [ebp + 0x1a0] $sequence_6 = { e8???????? 488bd0 488d8d58010000 e8???????? 90 } // n = 5, score = 500 // e8???????? | // 488bd0 | jmp 0xffffffd2 // 488d8d58010000 | dec ecx // e8???????? | // 90 | mov eax, esp $sequence_7 = { 483bc8 7406 e8???????? 90 488b542420 4883c2e8 } // n = 6, score = 500 // 483bc8 | dec eax // 7406 | lea ecx, [ebp + 0x140] // e8???????? | // 90 | nop // 488b542420 | dec eax // 4883c2e8 | mov edx, eax $sequence_8 = { ffd0 85c0 750f ff15???????? } // n = 4, score = 300 // ffd0 | dec eax // 85c0 | mov edx, dword ptr [esp + 0x20] // 750f | dec eax // ff15???????? | $sequence_9 = { 33d2 c1e902 f7f1 eb02 } // n = 4, score = 300 // 33d2 | mov edi, dword ptr [esi] // c1e902 | inc dword ptr [esi + 4] // f7f1 | shr eax, 0xc // eb02 | and al, 0x3f $sequence_10 = { e8???????? c645fc02 83c9ff 8b55ec } // n = 4, score = 200 // e8???????? | // c645fc02 | mov dword ptr [esi + 0x24], 0 // 83c9ff | mov dword ptr [esi + 0x28], 0 // 8b55ec | lea ecx, [esi + 0x30] $sequence_11 = { 8d4e2c 68???????? c7461c00000000 c7462000000000 c7462400000000 c7462800000000 e8???????? } // n = 7, score = 200 // 8d4e2c | dec eax // 68???????? | // c7461c00000000 | mov edx, eax // c7462000000000 | dec eax // c7462400000000 | lea ecx, [ebp + 0x338] // c7462800000000 | nop // e8???????? | $sequence_12 = { c1e80c 243f 0c80 8801 8b3e } // n = 5, score = 200 // c1e80c | jmp 0x4d // 243f | cmp eax, 1 // 0c80 | jge 0x11 // 8801 | shr eax, 0xc // 8b3e | or al, 0xe0 $sequence_13 = { 0f42f8 85ff 751f 51 } // n = 4, score = 200 // 0f42f8 | inc dword ptr [esi + 4] // 85ff | mov eax, dword ptr [edi + 0x10] // 751f | sub eax, dword ptr [edi + 0xc] // 51 | lea ecx, [esi + 0x40] $sequence_14 = { c1e80c 0ce0 eb49 83f801 } // n = 4, score = 200 // c1e80c | lea ecx, [ebp + 0x338] // 0ce0 | nop // eb49 | call eax // 83f801 | test eax, eax $sequence_15 = { c1e812 0cf0 8801 8b3e } // n = 4, score = 200 // c1e812 | mov edx, dword ptr [ebp - 0x14] // 0cf0 | add edx, -0x10 // 8801 | lea eax, [edx + 0xc] // 8b3e | mov byte ptr [ebp - 4], 2 $sequence_16 = { e8???????? ffd0 8bf0 eb02 } // n = 4, score = 200 // e8???????? | // ffd0 | nop // 8bf0 | dec eax // eb02 | mov edx, dword ptr [esp + 0x20] $sequence_17 = { 8d4e30 c645fc05 e8???????? c645fc06 } // n = 4, score = 200 // 8d4e30 | dec eax // c645fc05 | cmp ecx, eax // e8???????? | // c645fc06 | je 8 condition: 7 of them and filesize < 4161536 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY