Actor(s): Lazarus Group
According to Cisco Talos, CRAT is a remote access trojan with plugin capabilites, used by Lazarus since at least May 2020.
rule win_crat_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-04-08" version = "1" description = "Detects win.crat." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crat" malpedia_rule_date = "20220405" malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a" malpedia_version = "20220411" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 498bc4 48833d????????10 480f4305???????? 482bc8 } // n = 4, score = 500 // 498bc4 | lea ecx, dword ptr [ebp - 8] // 48833d????????10 | // 480f4305???????? | // 482bc8 | nop $sequence_1 = { e8???????? 488bd0 488d8d00010000 e8???????? 90 } // n = 5, score = 500 // e8???????? | // 488bd0 | dec eax // 488d8d00010000 | mov edx, eax // e8???????? | // 90 | dec eax $sequence_2 = { 48f7c20000ffff 7523 0fb7fa 8bcf e8???????? 4885c0 7427 } // n = 7, score = 500 // 48f7c20000ffff | dec eax // 7523 | lea ecx, dword ptr [ebp + 0x168] // 0fb7fa | nop // 8bcf | dec eax // e8???????? | // 4885c0 | mov edx, eax // 7427 | dec eax $sequence_3 = { e8???????? 488bc8 4885c0 7433 } // n = 4, score = 500 // e8???????? | // 488bc8 | dec eax // 4885c0 | mov edx, eax // 7433 | dec eax $sequence_4 = { 488bd0 488d8d68010000 e8???????? 90 } // n = 4, score = 500 // 488bd0 | lea ecx, dword ptr [ebp + 0x188] // 488d8d68010000 | dec eax // e8???????? | // 90 | mov ecx, eax $sequence_5 = { e8???????? 488bd0 488d8d88010000 e8???????? } // n = 4, score = 500 // e8???????? | // 488bd0 | lea ecx, dword ptr [ebp + 0x100] // 488d8d88010000 | nop // e8???????? | $sequence_6 = { e8???????? 488bd0 488d8de8000000 e8???????? } // n = 4, score = 500 // e8???????? | // 488bd0 | dec eax // 488d8de8000000 | mov edx, eax // e8???????? | $sequence_7 = { e8???????? 488bd0 488d4df8 e8???????? 90 } // n = 5, score = 500 // e8???????? | // 488bd0 | dec eax // 488d4df8 | test eax, eax // e8???????? | // 90 | je 0x35 $sequence_8 = { 33d2 c1e902 f7f1 eb02 } // n = 4, score = 300 // 33d2 | jmp 0x30 // c1e902 | cmp byte ptr [ebp - 0x1f], 0 // f7f1 | je 0x14 // eb02 | push dword ptr [ebp - 0x24] $sequence_9 = { ffd0 85c0 750f ff15???????? 83f87a } // n = 5, score = 300 // ffd0 | jne 0x2c // 85c0 | movzx edi, dx // 750f | mov ecx, edi // ff15???????? | // 83f87a | dec eax $sequence_10 = { ff75fc 8bcf 33db 56 } // n = 4, score = 200 // ff75fc | jmp 0x30 // 8bcf | cmp byte ptr [ebp - 0x1f], 0 // 33db | push dword ptr [ebp - 0x28] // 56 | jmp 0x30 $sequence_11 = { ff7508 57 6a00 ff750c } // n = 4, score = 200 // ff7508 | push esi // 57 | push dword ptr [ebp - 0x24] // 6a00 | push dword ptr [ebp - 0x28] // ff750c | jmp 0x33 $sequence_12 = { ff75a4 c745a800000000 e8???????? 83c408 c745a400000000 eb0e } // n = 6, score = 200 // ff75a4 | mov eax, esp // c745a800000000 | dec eax // e8???????? | // 83c408 | sub ecx, eax // c745a400000000 | dec eax // eb0e | mov edx, eax $sequence_13 = { ff7720 e8???????? ff771c e8???????? } // n = 4, score = 200 // ff7720 | push esi // e8???????? | // ff771c | cmp dword ptr [edi + 0x18], 0 // e8???????? | $sequence_14 = { ff75d8 e8???????? eb2e 807de100 } // n = 4, score = 200 // ff75d8 | lea ecx, dword ptr [ebp + 0x150] // e8???????? | // eb2e | nop // 807de100 | call eax $sequence_15 = { ff75fc 8bcf 56 e8???????? 837f1800 } // n = 5, score = 200 // ff75fc | jmp 0x33 // 8bcf | push dword ptr [ebp - 4] // 56 | mov ecx, edi // e8???????? | // 837f1800 | xor ebx, ebx $sequence_16 = { ff7508 56 e8???????? 8b450c 83c40c } // n = 5, score = 200 // ff7508 | mov ecx, edi // 56 | push esi // e8???????? | // 8b450c | cmp dword ptr [edi + 0x18], 0 // 83c40c | jne 0x82 condition: 7 of them and filesize < 4161536 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY