There is no description at this point.
rule win_devopt_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.devopt." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.devopt" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { eb42 8b45fc f7402810000000 7402 eb34 8b45fc 80b8a900000000 } // n = 7, score = 100 // eb42 | jmp 0x44 // 8b45fc | mov eax, dword ptr [ebp - 4] // f7402810000000 | test dword ptr [eax + 0x28], 0x10 // 7402 | je 4 // eb34 | jmp 0x36 // 8b45fc | mov eax, dword ptr [ebp - 4] // 80b8a900000000 | cmp byte ptr [eax + 0xa9], 0 $sequence_1 = { eb11 3b5df0 7e02 eba3 8d7600 c745f0ffffffff 8b45f0 } // n = 7, score = 100 // eb11 | jmp 0x13 // 3b5df0 | cmp ebx, dword ptr [ebp - 0x10] // 7e02 | jle 4 // eba3 | jmp 0xffffffa5 // 8d7600 | lea esi, [esi] // c745f0ffffffff | mov dword ptr [ebp - 0x10], 0xffffffff // 8b45f0 | mov eax, dword ptr [ebp - 0x10] $sequence_2 = { eb0b 8b45fc 8b4034 8945d4 eb25 8b45d0 83e00f } // n = 7, score = 100 // eb0b | jmp 0xd // 8b45fc | mov eax, dword ptr [ebp - 4] // 8b4034 | mov eax, dword ptr [eax + 0x34] // 8945d4 | mov dword ptr [ebp - 0x2c], eax // eb25 | jmp 0x27 // 8b45d0 | mov eax, dword ptr [ebp - 0x30] // 83e00f | and eax, 0xf $sequence_3 = { ff9240040000 84c0 7502 eb0b 8b55f8 8b45fc e8???????? } // n = 7, score = 100 // ff9240040000 | call dword ptr [edx + 0x440] // 84c0 | test al, al // 7502 | jne 4 // eb0b | jmp 0xd // 8b55f8 | mov edx, dword ptr [ebp - 8] // 8b45fc | mov eax, dword ptr [ebp - 4] // e8???????? | $sequence_4 = { e8???????? 8b45f4 ba???????? 8955e8 8945ec 8d55e8 31c0 } // n = 7, score = 100 // e8???????? | // 8b45f4 | mov eax, dword ptr [ebp - 0xc] // ba???????? | // 8955e8 | mov dword ptr [ebp - 0x18], edx // 8945ec | mov dword ptr [ebp - 0x14], eax // 8d55e8 | lea edx, [ebp - 0x18] // 31c0 | xor eax, eax $sequence_5 = { 8b4240 8b55f4 8b4a40 8b11 ff5268 8945f0 89d7 } // n = 7, score = 100 // 8b4240 | mov eax, dword ptr [edx + 0x40] // 8b55f4 | mov edx, dword ptr [ebp - 0xc] // 8b4a40 | mov ecx, dword ptr [edx + 0x40] // 8b11 | mov edx, dword ptr [ecx] // ff5268 | call dword ptr [edx + 0x68] // 8945f0 | mov dword ptr [ebp - 0x10], eax // 89d7 | mov edi, edx $sequence_6 = { ff93a8020000 8b45d4 8d40fc 50 8b45d0 8d48fc 8b45f8 } // n = 7, score = 100 // ff93a8020000 | call dword ptr [ebx + 0x2a8] // 8b45d4 | mov eax, dword ptr [ebp - 0x2c] // 8d40fc | lea eax, [eax - 4] // 50 | push eax // 8b45d0 | mov eax, dword ptr [ebp - 0x30] // 8d48fc | lea ecx, [eax - 4] // 8b45f8 | mov eax, dword ptr [ebp - 8] $sequence_7 = { 8d6424e0 53 8945f4 8955fc 894df8 837dfc00 7e02 } // n = 7, score = 100 // 8d6424e0 | lea esp, [esp - 0x20] // 53 | push ebx // 8945f4 | mov dword ptr [ebp - 0xc], eax // 8955fc | mov dword ptr [ebp - 4], edx // 894df8 | mov dword ptr [ebp - 8], ecx // 837dfc00 | cmp dword ptr [ebp - 4], 0 // 7e02 | jle 4 $sequence_8 = { ff75f0 ff75fc e8???????? 31d2 58 83c40c 648902 } // n = 7, score = 100 // ff75f0 | push dword ptr [ebp - 0x10] // ff75fc | push dword ptr [ebp - 4] // e8???????? | // 31d2 | xor edx, edx // 58 | pop eax // 83c40c | add esp, 0xc // 648902 | mov dword ptr fs:[edx], eax $sequence_9 = { eb1e 8b45f8 a9ffffffff 7402 eb12 8b45f4 e8???????? } // n = 7, score = 100 // eb1e | jmp 0x20 // 8b45f8 | mov eax, dword ptr [ebp - 8] // a9ffffffff | test eax, 0xffffffff // 7402 | je 4 // eb12 | jmp 0x14 // 8b45f4 | mov eax, dword ptr [ebp - 0xc] // e8???????? | condition: 7 of them and filesize < 4645888 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY