SYMBOLCOMMON_NAMEaka. SYNONYMS
win.crutch (Back to overview)

Crutch

Actor(s): Turla Group


There is no description at this point.

References
2021-04-29ESET ResearchRobert Lipovsky, Matthieu Faou, Tony Anscombe, Andy Garth, Daniel Chromek
@techreport{lipovsky:20210429:eset:ff67b6c, author = {Robert Lipovsky and Matthieu Faou and Tony Anscombe and Andy Garth and Daniel Chromek}, title = {{ESET Industry Report on Government: Targeted but not alone}}, date = {2021-04-29}, institution = {ESET Research}, url = {https://www.welivesecurity.com/wp-content/uploads/2021/04/ESET_Industry_Report_Government.pdf}, language = {English}, urldate = {2021-05-03} } ESET Industry Report on Government: Targeted but not alone
Exaramel Crutch Exaramel HyperBro HyperSSL InvisiMole XDSpy
2020-12-02ESET ResearchMatthieu Faou
@online{faou:20201202:turla:7f8c935, author = {Matthieu Faou}, title = {{Turla Crutch: Keeping the “back door” open}}, date = {2020-12-02}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/}, language = {English}, urldate = {2020-12-08} } Turla Crutch: Keeping the “back door” open
Crutch Gazer Turla
Yara Rules
[TLP:WHITE] win_crutch_auto (20221125 | Detects win.crutch.)
rule win_crutch_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.crutch."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crutch"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 5e 8982f0030000 8bc5 5d 5b 83c40c c3 }
            // n = 7, score = 100
            //   5e                   | pop                 esi
            //   8982f0030000         | mov                 dword ptr [edx + 0x3f0], eax
            //   8bc5                 | mov                 eax, ebp
            //   5d                   | pop                 ebp
            //   5b                   | pop                 ebx
            //   83c40c               | add                 esp, 0xc
            //   c3                   | ret                 

        $sequence_1 = { 5e c3 8b4c2410 8bc7 5f 5b 8931 }
            // n = 7, score = 100
            //   5e                   | pop                 esi
            //   c3                   | ret                 
            //   8b4c2410             | mov                 ecx, dword ptr [esp + 0x10]
            //   8bc7                 | mov                 eax, edi
            //   5f                   | pop                 edi
            //   5b                   | pop                 ebx
            //   8931                 | mov                 dword ptr [ecx], esi

        $sequence_2 = { 8b4c2420 5f 5e 89818c020000 8981cc050000 8bc5 5d }
            // n = 7, score = 100
            //   8b4c2420             | mov                 ecx, dword ptr [esp + 0x20]
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   89818c020000         | mov                 dword ptr [ecx + 0x28c], eax
            //   8981cc050000         | mov                 dword ptr [ecx + 0x5cc], eax
            //   8bc5                 | mov                 eax, ebp
            //   5d                   | pop                 ebp

        $sequence_3 = { c3 094838 68???????? 55 c7460803000000 e8???????? 83c408 }
            // n = 7, score = 100
            //   c3                   | ret                 
            //   094838               | or                  dword ptr [eax + 0x38], ecx
            //   68????????           |                     
            //   55                   | push                ebp
            //   c7460803000000       | mov                 dword ptr [esi + 8], 3
            //   e8????????           |                     
            //   83c408               | add                 esp, 8

        $sequence_4 = { 51 e8???????? 83c40c 5f 5e 5d b823000000 }
            // n = 7, score = 100
            //   51                   | push                ecx
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   b823000000           | mov                 eax, 0x23

        $sequence_5 = { 33c4 898424a4090000 53 55 8b2f 56 33db }
            // n = 7, score = 100
            //   33c4                 | xor                 eax, esp
            //   898424a4090000       | mov                 dword ptr [esp + 0x9a4], eax
            //   53                   | push                ebx
            //   55                   | push                ebp
            //   8b2f                 | mov                 ebp, dword ptr [edi]
            //   56                   | push                esi
            //   33db                 | xor                 ebx, ebx

        $sequence_6 = { 33ed 50 56 89aec8020000 e8???????? 8be8 83c408 }
            // n = 7, score = 100
            //   33ed                 | xor                 ebp, ebp
            //   50                   | push                eax
            //   56                   | push                esi
            //   89aec8020000         | mov                 dword ptr [esi + 0x2c8], ebp
            //   e8????????           |                     
            //   8be8                 | mov                 ebp, eax
            //   83c408               | add                 esp, 8

        $sequence_7 = { ff15???????? 83c410 897e04 eb0c 8d3489 c1e604 03b3b4470000 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   83c410               | add                 esp, 0x10
            //   897e04               | mov                 dword ptr [esi + 4], edi
            //   eb0c                 | jmp                 0xe
            //   8d3489               | lea                 esi, [ecx + ecx*4]
            //   c1e604               | shl                 esi, 4
            //   03b3b4470000         | add                 esi, dword ptr [ebx + 0x47b4]

        $sequence_8 = { 83e1f7 bd???????? bb05000000 894f04 eb26 83faff 7404 }
            // n = 7, score = 100
            //   83e1f7               | and                 ecx, 0xfffffff7
            //   bd????????           |                     
            //   bb05000000           | mov                 ebx, 5
            //   894f04               | mov                 dword ptr [edi + 4], ecx
            //   eb26                 | jmp                 0x28
            //   83faff               | cmp                 edx, -1
            //   7404                 | je                  6

        $sequence_9 = { ffd2 8b442450 8b0d???????? 8b5140 50 ffd2 8b0d???????? }
            // n = 7, score = 100
            //   ffd2                 | call                edx
            //   8b442450             | mov                 eax, dword ptr [esp + 0x50]
            //   8b0d????????         |                     
            //   8b5140               | mov                 edx, dword ptr [ecx + 0x40]
            //   50                   | push                eax
            //   ffd2                 | call                edx
            //   8b0d????????         |                     

    condition:
        7 of them and filesize < 1067008
}
Download all Yara Rules