Actor(s): Shamoon, Magic Hound, Timberworm, COBALT GIPSY
There is no description at this point.
rule win_disttrack_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-05-30" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.4.0" tool_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack" malpedia_rule_date = "20200529" malpedia_hash = "92c362319514e5a6da26204961446caa3a8b32a8" malpedia_version = "20200529" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using yara-signator. * The code and documentation / approach is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 52 6a00 6a00 6848000700 } // n = 4, score = 200 // 52 | push edx // 6a00 | push 0 // 6a00 | push 0 // 6848000700 | push 0x70048 $sequence_1 = { ff15???????? 5d 5b 8bc7 5f 5e } // n = 6, score = 200 // ff15???????? | // 5d | pop ebp // 5b | pop ebx // 8bc7 | mov eax, edi // 5f | pop edi // 5e | pop esi $sequence_2 = { ebb2 6a16 58 5e 5d c3 6a0c } // n = 7, score = 200 // ebb2 | jmp 0xffffffb4 // 6a16 | push 0x16 // 58 | pop eax // 5e | pop esi // 5d | pop ebp // c3 | ret // 6a0c | push 0xc $sequence_3 = { 83c404 50 e8???????? 83c404 68???????? ff15???????? } // n = 6, score = 200 // 83c404 | add esp, 4 // 50 | push eax // e8???????? | // 83c404 | add esp, 4 // 68???????? | // ff15???????? | $sequence_4 = { e8???????? 6a07 e8???????? 59 c3 6a10 68???????? } // n = 7, score = 200 // e8???????? | // 6a07 | push 7 // e8???????? | // 59 | pop ecx // c3 | ret // 6a10 | push 0x10 // 68???????? | $sequence_5 = { 68???????? ff15???????? 8d45dc 50 ff15???????? 8b4ddc } // n = 6, score = 200 // 68???????? | // ff15???????? | // 8d45dc | lea eax, [ebp - 0x24] // 50 | push eax // ff15???????? | // 8b4ddc | mov ecx, dword ptr [ebp - 0x24] $sequence_6 = { 8d4618 c74402e8242a4200 8b48f8 8b5104 } // n = 4, score = 100 // 8d4618 | pop ebp // c74402e8242a4200 | pop ebx // 8b48f8 | mov eax, edi // 8b5104 | pop edi $sequence_7 = { 8bce c745fc02000000 e8???????? 85c0 7524 8b8d20ffffff 8b4904 } // n = 7, score = 100 // 8bce | pop esi // c745fc02000000 | push edx // e8???????? | // 85c0 | push 0 // 7524 | push 0 // 8b8d20ffffff | push 0x70048 // 8b4904 | add esp, 4 $sequence_8 = { 56 57 33f6 bf???????? 833cf5ecfd410001 751d } // n = 6, score = 100 // 56 | push esi // 57 | push edi // 33f6 | xor esi, esi // bf???????? | // 833cf5ecfd410001 | cmp dword ptr [esi*8 + 0x41fdec], 1 // 751d | jne 0x1f $sequence_9 = { eb43 bb01000000 391d???????? 7e34 8d7b07 488d0d914a0100 e8???????? } // n = 7, score = 100 // eb43 | dec eax // bb01000000 | test edx, edx // 391d???????? | // 7e34 | je 0x20 // 8d7b07 | dec esp // 488d0d914a0100 | mov ecx, ecx // e8???????? | $sequence_10 = { e8???????? 488b0d???????? 4885c9 7463 488b09 } // n = 5, score = 100 // e8???????? | // 488b0d???????? | // 4885c9 | lea ecx, [esp + 0x24] // 7463 | inc eax // 488b09 | mov ch, byte ptr [esp + 0x27] $sequence_11 = { e8???????? 56 ff15???????? 81c3ffff0000 6683fb30 0f87fbfeffff 8b0d???????? } // n = 7, score = 100 // e8???????? | // 56 | push eax // ff15???????? | // 81c3ffff0000 | add esp, 4 // 6683fb30 | lea eax, [ebp - 0x24] // 0f87fbfeffff | push eax // 8b0d???????? | $sequence_12 = { 488b4768 4c8b0d???????? 4889442428 488d05ecf60000 8bd3 } // n = 5, score = 100 // 488b4768 | dec eax // 4c8b0d???????? | // 4889442428 | mov eax, dword ptr [edi + 0x68] // 488d05ecf60000 | dec eax // 8bd3 | mov dword ptr [esp + 0x28], eax $sequence_13 = { 8b0cb524174200 8b14b520174200 8b04b5b8044200 53 51 52 } // n = 6, score = 100 // 8b0cb524174200 | mov ecx, dword ptr [esi*4 + 0x421724] // 8b14b520174200 | mov edx, dword ptr [esi*4 + 0x421720] // 8b04b5b8044200 | mov eax, dword ptr [esi*4 + 0x4204b8] // 53 | push ebx // 51 | push ecx // 52 | push edx $sequence_14 = { 83f845 7526 8b4d14 51 e8???????? } // n = 5, score = 100 // 83f845 | cmp eax, 0x45 // 7526 | jne 0x28 // 8b4d14 | mov ecx, dword ptr [ebp + 0x14] // 51 | push ecx // e8???????? | $sequence_15 = { 8d5dfc 884dfc e8???????? 8b4df4 88440df8 } // n = 5, score = 100 // 8d5dfc | lea ebx, [ebp - 4] // 884dfc | mov byte ptr [ebp - 4], cl // e8???????? | // 8b4df4 | mov ecx, dword ptr [ebp - 0xc] // 88440df8 | mov byte ptr [ebp + ecx - 8], al $sequence_16 = { 838578feffff02 6683bd72feffff00 75df 8b8d78feffff } // n = 4, score = 100 // 838578feffff02 | add dword ptr [ebp - 0x188], 2 // 6683bd72feffff00 | cmp word ptr [ebp - 0x18e], 0 // 75df | jne 0xffffffe1 // 8b8d78feffff | mov ecx, dword ptr [ebp - 0x188] $sequence_17 = { 448bd0 e8???????? 488d1533fb0100 458bc7 498bcd e8???????? 478d0412 } // n = 7, score = 100 // 448bd0 | dec eax // e8???????? | // 488d1533fb0100 | lea eax, [0xf6ec] // 458bc7 | mov edx, ebx // 498bcd | inc esp // e8???????? | // 478d0412 | mov edx, eax $sequence_18 = { 85c0 751c 8b4c2434 8b4904 8b440c40 8d4c0c34 83c802 } // n = 7, score = 100 // 85c0 | test eax, eax // 751c | jne 0x1e // 8b4c2434 | mov ecx, dword ptr [esp + 0x34] // 8b4904 | mov ecx, dword ptr [ecx + 4] // 8b440c40 | mov eax, dword ptr [esp + ecx + 0x40] // 8d4c0c34 | lea ecx, [esp + ecx + 0x34] // 83c802 | or eax, 2 $sequence_19 = { 488d4c2424 e8???????? 408a6c2427 40b701 } // n = 4, score = 100 // 488d4c2424 | mov ecx, ebp // e8???????? | // 408a6c2427 | inc edi // 40b701 | lea eax, [edx + edx] $sequence_20 = { 03d1 6bd264 443bca 751e 418bc2 } // n = 5, score = 100 // 03d1 | inc eax // 6bd264 | mov bh, 1 // 443bca | jmp 0x52 // 751e | mov ebx, 1 // 418bc2 | jle 0x4a $sequence_21 = { 895c2418 e8???????? 83c404 6800c80000 8bf0 53 56 } // n = 7, score = 100 // 895c2418 | mov dword ptr [esp + 0x18], ebx // e8???????? | // 83c404 | add esp, 4 // 6800c80000 | push 0xc800 // 8bf0 | mov esi, eax // 53 | push ebx // 56 | push esi $sequence_22 = { 4885d2 741e 4c8bc9 4585c0 7412 } // n = 5, score = 100 // 4885d2 | dec eax // 741e | lea edx, [0x1fb33] // 4c8bc9 | inc ebp // 4585c0 | mov eax, edi // 7412 | dec ecx $sequence_23 = { 83f8ff 7505 bf04000000 8b4c2444 8b4904 } // n = 5, score = 100 // 83f8ff | cmp eax, -1 // 7505 | jne 7 // bf04000000 | mov edi, 4 // 8b4c2444 | mov ecx, dword ptr [esp + 0x44] // 8b4904 | mov ecx, dword ptr [ecx + 4] $sequence_24 = { ff15???????? 8ac3 eb02 32c0 4c8d9c24e0000000 } // n = 5, score = 100 // ff15???????? | // 8ac3 | inc ebp // eb02 | test eax, eax // 32c0 | je 0x1c // 4c8d9c24e0000000 | dec eax $sequence_25 = { 770f 0fbec2 0fbe8050ff4100 83e00f eb02 } // n = 5, score = 100 // 770f | pop esi // 0fbec2 | lea eax, [ebp - 0x24] // 0fbe8050ff4100 | push eax // 83e00f | mov ecx, dword ptr [ebp - 0x24] // eb02 | push ebx condition: 7 of them and filesize < 1112064 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY
