Actor(s): APT41
According to FireEye, CROSSWALK is a skeletal, modular backdoor capable of system survey and adding modules in response to C&C replies.
rule win_crosswalk_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.crosswalk." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crosswalk" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 33f6 8d6e20 8bcd e8???????? } // n = 4, score = 1300 // 33f6 | inc ebp // 8d6e20 | xor ecx, ecx // 8bcd | inc ebp // e8???????? | $sequence_1 = { 4885c9 7402 ffd1 b801000000 } // n = 4, score = 1300 // 4885c9 | xor edx, edx // 7402 | inc ecx // ffd1 | movsx eax, byte ptr [eax] // b801000000 | dec ecx $sequence_2 = { ff15???????? 448bf0 4533c9 4533c0 } // n = 4, score = 1300 // ff15???????? | // 448bf0 | add edx, eax // 4533c9 | imul eax, edx, 0xe89 // 4533c0 | inc ebp $sequence_3 = { 49ffc0 d3ca 03d0 4183ef01 } // n = 4, score = 1300 // 49ffc0 | mov eax, esi // d3ca | xor edx, edx // 03d0 | dec eax // 4183ef01 | mov ecx, eax $sequence_4 = { 8bc2 c1e81f 03d0 69c2890e0000 } // n = 4, score = 1300 // 8bc2 | sub edi, 1 // c1e81f | dec eax // 03d0 | test ecx, ecx // 69c2890e0000 | je 4 $sequence_5 = { 41b88d56e68c 418bc0 f7e9 03d1 c1fa0b 8bc2 } // n = 6, score = 1300 // 41b88d56e68c | inc ecx // 418bc0 | mov eax, 0x8ce6568d // f7e9 | inc ecx // 03d1 | mov eax, eax // c1fa0b | imul ecx // 8bc2 | add edx, ecx $sequence_6 = { 458bc6 33d2 488bc8 e8???????? 4533c9 4533c0 } // n = 6, score = 1300 // 458bc6 | mov eax, eax // 33d2 | imul ecx // 488bc8 | add edx, ecx // e8???????? | // 4533c9 | sar edx, 0xb // 4533c0 | mov eax, edx $sequence_7 = { 4c8bc6 33d2 410fbe00 49ffc0 } // n = 4, score = 1300 // 4c8bc6 | sar edx, 0xb // 33d2 | mov eax, edx // 410fbe00 | dec esp // 49ffc0 | mov eax, esi $sequence_8 = { c1f906 03048d808e4100 eb02 8bc6 80782900 7522 } // n = 6, score = 200 // c1f906 | sar ecx, 6 // 03048d808e4100 | add eax, dword ptr [ecx*4 + 0x418e80] // eb02 | jmp 4 // 8bc6 | mov eax, esi // 80782900 | cmp byte ptr [eax + 0x29], 0 // 7522 | jne 0x24 $sequence_9 = { 50 e8???????? 8bc6 c1e002 50 8b85a4f8ffff 0fb70485c4574100 } // n = 7, score = 200 // 50 | push eax // e8???????? | // 8bc6 | mov eax, esi // c1e002 | shl eax, 2 // 50 | push eax // 8b85a4f8ffff | mov eax, dword ptr [ebp - 0x75c] // 0fb70485c4574100 | movzx eax, word ptr [eax*4 + 0x4157c4] $sequence_10 = { 660f28b8505b4100 660f54f0 660f5cc6 660f59f4 660f5cf2 } // n = 5, score = 200 // 660f28b8505b4100 | movapd xmm7, xmmword ptr [eax + 0x415b50] // 660f54f0 | andpd xmm6, xmm0 // 660f5cc6 | subpd xmm0, xmm6 // 660f59f4 | mulpd xmm6, xmm4 // 660f5cf2 | subpd xmm6, xmm2 $sequence_11 = { 8bc1 c1f806 83e13f 6bc930 53 8b5d10 8b0485808e4100 } // n = 7, score = 200 // 8bc1 | mov eax, ecx // c1f806 | sar eax, 6 // 83e13f | and ecx, 0x3f // 6bc930 | imul ecx, ecx, 0x30 // 53 | push ebx // 8b5d10 | mov ebx, dword ptr [ebp + 0x10] // 8b0485808e4100 | mov eax, dword ptr [eax*4 + 0x418e80] $sequence_12 = { c1ff06 6bf630 8b04bd808e4100 f644302880 741f e8???????? } // n = 6, score = 200 // c1ff06 | sar edi, 6 // 6bf630 | imul esi, esi, 0x30 // 8b04bd808e4100 | mov eax, dword ptr [edi*4 + 0x418e80] // f644302880 | test byte ptr [eax + esi + 0x28], 0x80 // 741f | je 0x21 // e8???????? | $sequence_13 = { 8b45fc 817848f0844100 7409 ff7048 e8???????? 59 } // n = 6, score = 200 // 8b45fc | mov eax, dword ptr [ebp - 4] // 817848f0844100 | cmp dword ptr [eax + 0x48], 0x4184f0 // 7409 | je 0xb // ff7048 | push dword ptr [eax + 0x48] // e8???????? | // 59 | pop ecx $sequence_14 = { 8975e0 8975f0 c745f430234100 8b7485bc } // n = 4, score = 200 // 8975e0 | mov dword ptr [ebp - 0x20], esi // 8975f0 | mov dword ptr [ebp - 0x10], esi // c745f430234100 | mov dword ptr [ebp - 0xc], 0x412330 // 8b7485bc | mov esi, dword ptr [ebp + eax*4 - 0x44] $sequence_15 = { 8d049dc88b4100 8b30 8945fc 85f6 } // n = 4, score = 200 // 8d049dc88b4100 | lea eax, [ebx*4 + 0x418bc8] // 8b30 | mov esi, dword ptr [eax] // 8945fc | mov dword ptr [ebp - 4], eax // 85f6 | test esi, esi condition: 7 of them and filesize < 286720 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY
