Actor(s): Shamoon, Magic Hound, Timberworm, COBALT GIPSY
There is no description at this point.
rule win_disttrack_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-08-05" version = "1" description = "Detects win.disttrack." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack" malpedia_rule_date = "20220805" malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71" malpedia_version = "20220808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 58 5e 5d c3 6a0c 68???????? e8???????? } // n = 7, score = 200 // 58 | pop eax // 5e | pop esi // 5d | pop ebp // c3 | ret // 6a0c | push 0xc // 68???????? | // e8???????? | $sequence_1 = { e8???????? 83c404 50 e8???????? 83c404 68???????? ff15???????? } // n = 7, score = 200 // e8???????? | // 83c404 | cmp eax, ecx // 50 | imul edx, edx, 0x3e8 // e8???????? | // 83c404 | dec eax // 68???????? | // ff15???????? | $sequence_2 = { ff15???????? 5d 5b 8bc7 5f 5e } // n = 6, score = 200 // ff15???????? | // 5d | mov eax, dword ptr [ebp - 0x50] // 5b | dec eax // 8bc7 | mov dword ptr [eax], edx // 5f | dec eax // 5e | mov eax, dword ptr [ebp - 0x50] $sequence_3 = { 52 6a00 6a00 6848000700 } // n = 4, score = 200 // 52 | mov ebx, ecx // 6a00 | dec eax // 6a00 | test eax, eax // 6848000700 | je 0x7e $sequence_4 = { e8???????? 6a07 e8???????? 59 c3 6a10 } // n = 6, score = 200 // e8???????? | // 6a07 | push 7 // e8???????? | // 59 | pop ecx // c3 | ret // 6a10 | push 0x10 $sequence_5 = { 68???????? ff15???????? 8d45dc 50 ff15???????? 8b4ddc } // n = 6, score = 200 // 68???????? | // ff15???????? | // 8d45dc | dec eax // 50 | lea ecx, [0x125e7] // ff15???????? | // 8b4ddc | dec eax $sequence_6 = { c3 8bff 56 57 33ff ffb740004200 } // n = 6, score = 100 // c3 | ret // 8bff | mov edi, edi // 56 | push esi // 57 | push edi // 33ff | xor edi, edi // ffb740004200 | push dword ptr [edi + 0x420040] $sequence_7 = { 8a80446c4200 08443b1d 0fb64601 47 } // n = 4, score = 100 // 8a80446c4200 | dec eax // 08443b1d | mov eax, dword ptr [esp + 0x28] // 0fb64601 | dec eax // 47 | mov ecx, dword ptr [esp + 0x40] $sequence_8 = { 8d3c8540174200 8b07 c1e606 8a4c3004 } // n = 4, score = 100 // 8d3c8540174200 | lea edi, [eax*4 + 0x421740] // 8b07 | mov eax, dword ptr [edi] // c1e606 | shl esi, 6 // 8a4c3004 | mov cl, byte ptr [eax + esi + 4] $sequence_9 = { 83c802 395938 751e 83c804 eb19 8b542434 8b4a04 } // n = 7, score = 100 // 83c802 | or eax, 2 // 395938 | cmp dword ptr [ecx + 0x38], ebx // 751e | jne 0x20 // 83c804 | or eax, 4 // eb19 | jmp 0x1b // 8b542434 | mov edx, dword ptr [esp + 0x34] // 8b4a04 | mov ecx, dword ptr [edx + 4] $sequence_10 = { 395938 7503 83c804 83e017 89410c 854110 740d } // n = 7, score = 100 // 395938 | lea eax, [ebp - 0x24] // 7503 | push eax // 83c804 | mov ecx, dword ptr [ebp - 0x24] // 83e017 | add esp, 4 // 89410c | push eax // 854110 | add esp, 4 // 740d | pop ebp $sequence_11 = { 83f908 7229 f3a5 ff249560474100 } // n = 4, score = 100 // 83f908 | pop ebp // 7229 | pop ebx // f3a5 | mov eax, edi // ff249560474100 | pop edi $sequence_12 = { 744f 8b542414 52 68???????? 68???????? } // n = 5, score = 100 // 744f | je 0x51 // 8b542414 | mov edx, dword ptr [esp + 0x14] // 52 | push edx // 68???????? | // 68???????? | $sequence_13 = { 488bd9 4885c0 7479 488d0de7250100 483bc1 } // n = 5, score = 100 // 488bd9 | add eax, eax // 4885c0 | mov edx, eax // 7479 | dec eax // 488d0de7250100 | lea ecx, [esp + edx*2 + 0x40] // 483bc1 | dec eax $sequence_14 = { 84c0 750c 498bcc e8???????? 32c0 } // n = 5, score = 100 // 84c0 | dec eax // 750c | cmp dword ptr [esp + 0x58], ecx // 498bcc | je 0x3c // e8???????? | // 32c0 | dec eax $sequence_15 = { 8b442450 46891cb7 894704 e9???????? 488d0d957d0100 48394c2458 7427 } // n = 7, score = 100 // 8b442450 | dec eax // 46891cb7 | lea ecx, [0x19b16] // 894704 | dec eax // e9???????? | // 488d0d957d0100 | mov edx, ecx // 48394c2458 | dec esp // 7427 | lea eax, [0x1c3ec] $sequence_16 = { 83c40c 81c600040000 4f 75e4 } // n = 4, score = 100 // 83c40c | push edx // 81c600040000 | push 0 // 4f | push 0 // 75e4 | push 0x70048 $sequence_17 = { 6a02 8b4518 50 8b4d10 51 } // n = 5, score = 100 // 6a02 | push 7 // 8b4518 | pop ecx // 50 | ret // 8b4d10 | push 0x10 // 51 | push ebx $sequence_18 = { 488b4308 488d4c2430 48899cc2d03a0200 488b4308 fe8402203b0200 e8???????? } // n = 6, score = 100 // 488b4308 | dec eax // 488d4c2430 | lea edx, [esp + 0xa0] // 48899cc2d03a0200 | dec eax // 488b4308 | lea ecx, [esp + 0x30] // fe8402203b0200 | inc ecx // e8???????? | $sequence_19 = { 486bd258 490314c8 488d0d1f9b0100 eb11 488d0d169b0100 488bd1 4c8d05ecc30100 } // n = 7, score = 100 // 486bd258 | dec eax // 490314c8 | imul edx, edx, 0x58 // 488d0d1f9b0100 | dec ecx // eb11 | add edx, dword ptr [eax + ecx*8] // 488d0d169b0100 | dec eax // 488bd1 | lea ecx, [0x19b1f] // 4c8d05ecc30100 | jmp 0x13 $sequence_20 = { 488bcf 448bc0 4d03c0 e8???????? 8bd0 488d4c5440 488bd3 } // n = 7, score = 100 // 488bcf | mov eax, dword ptr [esp + 0x50] // 448bc0 | inc esi // 4d03c0 | mov dword ptr [edi + esi*4], ebx // e8???????? | // 8bd0 | mov dword ptr [edi + 4], eax // 488d4c5440 | dec eax // 488bd3 | lea ecx, [0x17d95] $sequence_21 = { 488d9424a0000000 488d4c2430 41b9ff000000 41b832000000 e8???????? } // n = 5, score = 100 // 488d9424a0000000 | mov ecx, edi // 488d4c2430 | inc esp // 41b9ff000000 | mov eax, eax // 41b832000000 | dec ebp // e8???????? | $sequence_22 = { 69d2e8030000 488b45b0 488910 488b45b0 c6400d10 488b45b0 } // n = 6, score = 100 // 69d2e8030000 | mov edx, ebx // 488b45b0 | test al, al // 488910 | jne 0xe // 488b45b0 | dec ecx // c6400d10 | mov ecx, esp // 488b45b0 | xor al, al $sequence_23 = { 8bd0 83e01f c1fa05 8b149540174200 c1e006 8d440224 } // n = 6, score = 100 // 8bd0 | mov edx, eax // 83e01f | and eax, 0x1f // c1fa05 | sar edx, 5 // 8b149540174200 | mov edx, dword ptr [edx*4 + 0x421740] // c1e006 | shl eax, 6 // 8d440224 | lea eax, [edx + eax + 0x24] $sequence_24 = { 8945ec 3bf3 7508 32c0 5f 5b 8be5 } // n = 7, score = 100 // 8945ec | pop ebx // 3bf3 | mov eax, edi // 7508 | pop edi // 32c0 | pop esi // 5f | push ebx // 5b | pop ebp // 8be5 | pop ebx $sequence_25 = { 83f903 7c62 8b4708 8d5002 668b08 } // n = 5, score = 100 // 83f903 | cmp ecx, 3 // 7c62 | jl 0x64 // 8b4708 | mov eax, dword ptr [edi + 8] // 8d5002 | lea edx, [eax + 2] // 668b08 | mov cx, word ptr [eax] condition: 7 of them and filesize < 1112064 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY
