Actor(s): Shamoon, Magic Hound, Timberworm, COBALT GIPSY
There is no description at this point.
rule win_disttrack_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2021-06-10" version = "1" description = "Detects win.disttrack." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack" malpedia_rule_date = "20210604" malpedia_hash = "be09d5d71e77373c0f538068be31a2ad4c69cfbd" malpedia_version = "20210616" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 58 5e 5d c3 6a0c 68???????? } // n = 6, score = 200 // 58 | pop eax // 5e | pop esi // 5d | pop ebp // c3 | ret // 6a0c | push 0xc // 68???????? | $sequence_1 = { 53 ff15???????? 5d 5b 8bc7 5f 5e } // n = 7, score = 200 // 53 | dec esp // ff15???????? | // 5d | lea eax, dword ptr [0xfffeb5bf] // 5b | je 0x1c // 8bc7 | jmp 0x16 // 5f | jne 0x141 // 5e | dec eax $sequence_2 = { ff15???????? 8d45dc 50 ff15???????? 8b4ddc } // n = 5, score = 200 // ff15???????? | // 8d45dc | arpl word ptr [eax + 4], cx // 50 | dec eax // ff15???????? | // 8b4ddc | lea eax, dword ptr [0x120b4] $sequence_3 = { 52 6a00 6a00 6848000700 } // n = 4, score = 200 // 52 | dec eax // 6a00 | cmp ecx, eax // 6a00 | je 0x1c // 6848000700 | cmp dword ptr [ecx + 0x160], 0 $sequence_4 = { 83c404 50 e8???????? 83c404 68???????? ff15???????? e8???????? } // n = 7, score = 200 // 83c404 | dec eax // 50 | or edx, 0xffffffff // e8???????? | // 83c404 | cmp byte ptr [ebp + 0x58], 0xa // 68???????? | // ff15???????? | // e8???????? | $sequence_5 = { 57 e8???????? 6a07 e8???????? 59 c3 6a10 } // n = 7, score = 200 // 57 | push edi // e8???????? | // 6a07 | push 7 // e8???????? | // 59 | pop ecx // c3 | ret // 6a10 | push 0x10 $sequence_6 = { 8bd6 83e203 8a8a2c7a4200 8b55f4 320c16 } // n = 5, score = 100 // 8bd6 | mov ecx, dword ptr [ebp - 0x24] // 83e203 | add esp, 4 // 8a8a2c7a4200 | push eax // 8b55f4 | add esp, 4 // 320c16 | push ebx $sequence_7 = { 8d0445e40a4200 8bc8 2bce 6a03 } // n = 4, score = 100 // 8d0445e40a4200 | lea eax, dword ptr [eax*2 + 0x420ae4] // 8bc8 | mov ecx, eax // 2bce | sub ecx, esi // 6a03 | push 3 $sequence_8 = { c1fa05 c1e006 03049540174200 eb05 b8???????? f6400420 7415 } // n = 7, score = 100 // c1fa05 | sar edx, 5 // c1e006 | shl eax, 6 // 03049540174200 | add eax, dword ptr [edx*4 + 0x421740] // eb05 | jmp 7 // b8???????? | // f6400420 | test byte ptr [eax + 4], 0x20 // 7415 | je 0x17 $sequence_9 = { 41b801000000 4883caff e8???????? 807d580a 4c8d05bfb5feff 740f eb07 } // n = 7, score = 100 // 41b801000000 | mov eax, ebx // 4883caff | dec eax // e8???????? | // 807d580a | lea edx, dword ptr [0x1fb33] // 4c8d05bfb5feff | inc ebp // 740f | mov eax, edi // eb07 | dec ecx $sequence_10 = { 488bcd 4889442420 e8???????? 4c8d2dcef50000 4c8d7768 4c8d05c7f60000 } // n = 6, score = 100 // 488bcd | dec eax // 4889442420 | mov ecx, ebp // e8???????? | // 4c8d2dcef50000 | dec eax // 4c8d7768 | mov dword ptr [esp + 0x20], eax // 4c8d05c7f60000 | dec esp $sequence_11 = { 4885ff 744a 488d4c2430 e8???????? 488d15ee520100 448bc3 } // n = 6, score = 100 // 4885ff | lea eax, dword ptr [0xf6c7] // 744a | dec eax // 488d4c2430 | lea eax, dword ptr [0x13ede] // e8???????? | // 488d15ee520100 | dec eax // 448bc3 | add ecx, ecx $sequence_12 = { 0f853b010000 488d2dffd00100 c605????????00 488bcd ff15???????? e8???????? 8bc8 } // n = 7, score = 100 // 0f853b010000 | mov ecx, ebp // 488d2dffd00100 | dec eax // c605????????00 | // 488bcd | mov ecx, edx // ff15???????? | // e8???????? | // 8bc8 | dec esp $sequence_13 = { 488d05de3e0100 4803c9 488b0cc8 48ff25???????? 48895c2408 } // n = 5, score = 100 // 488d05de3e0100 | lea ebp, dword ptr [0xf5ce] // 4803c9 | dec esp // 488b0cc8 | lea esi, dword ptr [edi + 0x68] // 48ff25???????? | // 48895c2408 | dec esp $sequence_14 = { 2bc1 03c2 c1fb05 83e61f 8d1c9d40174200 894508 } // n = 6, score = 100 // 2bc1 | sub eax, ecx // 03c2 | add eax, edx // c1fb05 | sar ebx, 5 // 83e61f | and esi, 0x1f // 8d1c9d40174200 | lea ebx, dword ptr [ebx*4 + 0x421740] // 894508 | mov dword ptr [ebp + 8], eax $sequence_15 = { 57 ff15???????? 8bf0 85f6 7405 83feff } // n = 6, score = 100 // 57 | push 0 // ff15???????? | // 8bf0 | push 0 // 85f6 | push 0x70048 // 7405 | lea eax, dword ptr [ebp - 0x24] // 83feff | push eax $sequence_16 = { 8d55a0 52 8d4dd0 e8???????? 8bc8 } // n = 5, score = 100 // 8d55a0 | pop ebp // 52 | pop ebx // 8d4dd0 | mov eax, edi // e8???????? | // 8bc8 | pop edi $sequence_17 = { 488d05b4200100 483bc8 741a 83b96001000000 7511 e8???????? } // n = 6, score = 100 // 488d05b4200100 | dec eax // 483bc8 | lea ecx, dword ptr [esp + 0x30] // 741a | dec eax // 83b96001000000 | lea edx, dword ptr [0x152ee] // 7511 | inc esp // e8???????? | $sequence_18 = { e8???????? 488d1533fb0100 458bc7 498bcd e8???????? } // n = 5, score = 100 // e8???????? | // 488d1533fb0100 | dec eax // 458bc7 | mov ecx, dword ptr [eax + ecx*8] // 498bcd | dec eax // e8???????? | $sequence_19 = { 8d8dd0f9ffff e9???????? 8db588faffff e9???????? 8d8db8f9ffff e9???????? 8db5a4faffff } // n = 7, score = 100 // 8d8dd0f9ffff | lea eax, dword ptr [ebp - 0x24] // e9???????? | // 8db588faffff | push eax // e9???????? | // 8d8db8f9ffff | mov ecx, dword ptr [ebp - 0x24] // e9???????? | // 8db5a4faffff | push edx $sequence_20 = { 488bca e8???????? 4c8be8 4c8b06 4d634804 } // n = 5, score = 100 // 488bca | mov dword ptr [esp + 8], ebx // e8???????? | // 4c8be8 | dec eax // 4c8b06 | test edi, edi // 4d634804 | je 0x4f $sequence_21 = { 8bec 8b4508 56 8d34c5f8664200 } // n = 4, score = 100 // 8bec | pop ebp // 8b4508 | pop ebx // 56 | mov eax, edi // 8d34c5f8664200 | pop edi $sequence_22 = { ff15???????? 6a64 68???????? ff15???????? 8b4d08 83f902 0f8ca3020000 } // n = 7, score = 100 // ff15???????? | // 6a64 | push 0x64 // 68???????? | // ff15???????? | // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 83f902 | cmp ecx, 2 // 0f8ca3020000 | jl 0x2a9 $sequence_23 = { 8b5104 8d8c15c4feffff e8???????? 0fb6c0 } // n = 4, score = 100 // 8b5104 | pop esi // 8d8c15c4feffff | add esp, 4 // e8???????? | // 0fb6c0 | push eax $sequence_24 = { 5d c3 8b04cd24fc4100 5d } // n = 4, score = 100 // 5d | pop ebp // c3 | ret // 8b04cd24fc4100 | mov eax, dword ptr [ecx*8 + 0x41fc24] // 5d | pop ebp $sequence_25 = { 7414 8bc8 83e01f c1f905 c1e006 03048d40174200 } // n = 6, score = 100 // 7414 | je 0x16 // 8bc8 | mov ecx, eax // 83e01f | and eax, 0x1f // c1f905 | sar ecx, 5 // c1e006 | shl eax, 6 // 03048d40174200 | add eax, dword ptr [ecx*4 + 0x421740] condition: 7 of them and filesize < 1112064 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY
