Actor(s): Shamoon, Magic Hound, Timberworm, COBALT GIPSY
There is no description at this point.
rule win_disttrack_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-05-04" version = "1" description = "Detects win.disttrack." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack" malpedia_rule_date = "20260422" malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14" malpedia_version = "20260504" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 52 6a00 6a00 6848000700 } // n = 4, score = 200 // 52 | sub eax, edx // 6a00 | dec ecx // 6a00 | cmp eax, eax // 6848000700 | jae 0x19 $sequence_1 = { 53 ff15???????? 5d 5b 8bc7 5f 5e } // n = 7, score = 200 // 53 | lea ecx, [esp + 0x30] // ff15???????? | // 5d | lea ebx, [eax + eax + 2] // 5b | dec esp // 8bc7 | sub eax, dword ptr [ecx] // 5f | dec ecx // 5e | mov eax, ecx $sequence_2 = { 83c404 50 e8???????? 83c404 68???????? ff15???????? } // n = 6, score = 200 // 83c404 | inc eax // 50 | cmp ch, bh // e8???????? | // 83c404 | je 0x59 // 68???????? | // ff15???????? | $sequence_3 = { 68???????? ff15???????? 8d45dc 50 ff15???????? 8b4ddc } // n = 6, score = 200 // 68???????? | // ff15???????? | // 8d45dc | dec eax // 50 | mov ecx, edi // ff15???????? | // 8b4ddc | dec eax $sequence_4 = { e8???????? 6a07 e8???????? 59 c3 6a10 } // n = 6, score = 200 // e8???????? | // 6a07 | push 7 // e8???????? | // 59 | pop ecx // c3 | ret // 6a10 | push 0x10 $sequence_5 = { 6a64 68???????? ff15???????? 6a64 68???????? } // n = 5, score = 100 // 6a64 | push 0x64 // 68???????? | // ff15???????? | // 6a64 | push 0x64 // 68???????? | $sequence_6 = { 8bf8 c745fc03000000 e8???????? c645fc02 8b7d94 } // n = 5, score = 100 // 8bf8 | add esp, 4 // c745fc03000000 | push eax // e8???????? | // c645fc02 | add esp, 4 // 8b7d94 | add esp, 4 $sequence_7 = { 8bc1 c1f805 8bf1 83e61f 8d3c8540174200 } // n = 5, score = 100 // 8bc1 | mov eax, ecx // c1f805 | sar eax, 5 // 8bf1 | mov esi, ecx // 83e61f | and esi, 0x1f // 8d3c8540174200 | lea edi, [eax*4 + 0x421740] $sequence_8 = { 837d0800 7412 837d0c00 7e0c 837d1000 } // n = 5, score = 100 // 837d0800 | add esp, 4 // 7412 | push eax // 837d0c00 | add esp, 4 // 7e0c | push ebx // 837d1000 | pop ebp $sequence_9 = { 488d4c2432 8945ca 0fb705???????? 33f6 } // n = 4, score = 100 // 488d4c2432 | dec eax // 8945ca | mov edi, dword ptr [ecx + 0x68] // 0fb705???????? | // 33f6 | dec eax $sequence_10 = { 8d4c0c44 3bfb 741e 8b410c 0bc7 } // n = 5, score = 100 // 8d4c0c44 | lea ecx, [esp + ecx + 0x44] // 3bfb | cmp edi, ebx // 741e | je 0x20 // 8b410c | mov eax, dword ptr [ecx + 0xc] // 0bc7 | or eax, edi $sequence_11 = { e8???????? 8bd8 85c0 7432 488bce e8???????? e8???????? } // n = 7, score = 100 // e8???????? | // 8bd8 | lea ebx, [0x3403] // 85c0 | push edi // 7432 | dec eax // 488bce | sub esp, 0x20 // e8???????? | // e8???????? | $sequence_12 = { 48638528050000 498b16 498b0f 4889442468 0fb68540050000 4c8d1d03340000 } // n = 6, score = 100 // 48638528050000 | inc sp // 498b16 | cmp dword ptr [ebp - 0x1a], esp // 498b0f | dec eax // 4889442468 | arpl word ptr [ebp + 0x528], ax // 0fb68540050000 | dec ecx // 4c8d1d03340000 | mov edx, dword ptr [esi] $sequence_13 = { 0fbe89a06d4200 85c9 750d e8???????? } // n = 4, score = 100 // 0fbe89a06d4200 | push eax // 85c9 | add esp, 4 // 750d | add esp, 4 // e8???????? | $sequence_14 = { 408a6c2427 40b701 403aef 7454 } // n = 4, score = 100 // 408a6c2427 | lea eax, [0x14946] // 40b701 | mov esi, edx // 403aef | dec eax // 7454 | mov ebx, ecx $sequence_15 = { 8bff 56 57 33ff ffb740004200 ff15???????? 898740004200 } // n = 7, score = 100 // 8bff | mov edi, edi // 56 | push esi // 57 | push edi // 33ff | xor edi, edi // ffb740004200 | push dword ptr [edi + 0x420040] // ff15???????? | // 898740004200 | mov dword ptr [edi + 0x420040], eax $sequence_16 = { 7406 53 e8???????? 8d44244c e8???????? } // n = 5, score = 100 // 7406 | je 8 // 53 | push ebx // e8???????? | // 8d44244c | lea eax, [esp + 0x4c] // e8???????? | $sequence_17 = { ff15???????? 33d2 75fc eba1 33c0 } // n = 5, score = 100 // ff15???????? | // 33d2 | push 0 // 75fc | push 0 // eba1 | push 0x70048 // 33c0 | lea eax, [ebp - 0x24] $sequence_18 = { eb01 53 e8???????? 8b8c24ec500000 5f 5e } // n = 6, score = 100 // eb01 | jmp 3 // 53 | push ebx // e8???????? | // 8b8c24ec500000 | mov ecx, dword ptr [esp + 0x50ec] // 5f | pop edi // 5e | pop esi $sequence_19 = { 50 e8???????? 6a00 6800020000 52 } // n = 5, score = 100 // 50 | push ebx // e8???????? | // 6a00 | pop ebp // 6800020000 | pop ebx // 52 | mov eax, edi $sequence_20 = { 8b55ec 8b4254 50 e8???????? 83c408 85c0 } // n = 6, score = 100 // 8b55ec | pop ebx // 8b4254 | mov eax, edi // 50 | pop edi // e8???????? | // 83c408 | pop esi // 85c0 | push edx $sequence_21 = { 4a8d4c5c30 e8???????? 488bcf e8???????? 488d4c2430 8d5c0002 e8???????? } // n = 7, score = 100 // 4a8d4c5c30 | dec eax // e8???????? | // 488bcf | mov ecx, esi // e8???????? | // 488d4c2430 | dec eax // 8d5c0002 | lea ecx, [esp + 0x32] // e8???????? | $sequence_22 = { 8d1480 3bd6 7e08 c7442410ffffffff ff442410 e9???????? 83f903 } // n = 7, score = 100 // 8d1480 | lea edx, [eax + eax*4] // 3bd6 | cmp edx, esi // 7e08 | jle 0xa // c7442410ffffffff | mov dword ptr [esp + 0x10], 0xffffffff // ff442410 | inc dword ptr [esp + 0x10] // e9???????? | // 83f903 | cmp ecx, 3 $sequence_23 = { 8b442460 488b4c2458 8907 ff15???????? } // n = 4, score = 100 // 8b442460 | mov ebx, eax // 488b4c2458 | test eax, eax // 8907 | je 0x34 // ff15???????? | $sequence_24 = { 1bc0 23d8 6644396de0 752a 66397de2 7524 66443965e6 } // n = 7, score = 100 // 1bc0 | sbb eax, eax // 23d8 | and ebx, eax // 6644396de0 | inc sp // 752a | cmp dword ptr [ebp - 0x20], ebp // 66397de2 | jne 0x2c // 7524 | cmp word ptr [ebp - 0x1e], di // 66443965e6 | jne 0x26 $sequence_25 = { 33f6 8d85e8feffff 898578ffffff 8d7d94 8d8540ffffff } // n = 5, score = 100 // 33f6 | push eax // 8d85e8feffff | add esp, 4 // 898578ffffff | lea eax, [ebp - 0x24] // 8d7d94 | push eax // 8d8540ffffff | mov ecx, dword ptr [ebp - 0x24] $sequence_26 = { 57 4883ec20 488b7968 488d0546490100 8bf2 488bd9 } // n = 6, score = 100 // 57 | dec ecx // 4883ec20 | mov ecx, dword ptr [edi] // 488b7968 | dec eax // 488d0546490100 | mov dword ptr [esp + 0x68], eax // 8bf2 | movzx eax, byte ptr [ebp + 0x540] // 488bd9 | dec esp condition: 7 of them and filesize < 1112064 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY
