Actor(s): Shamoon, Magic Hound, Timberworm, COBALT GIPSY
There is no description at this point.
rule win_disttrack_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.disttrack." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.disttrack" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 52 6a00 6a00 6848000700 } // n = 4, score = 200 // 52 | dec eax // 6a00 | mov dword ptr [ecx], eax // 6a00 | nop // 6848000700 | dec esp $sequence_1 = { 58 5e 5d c3 6a0c } // n = 5, score = 200 // 58 | pop eax // 5e | pop esi // 5d | pop ebp // c3 | ret // 6a0c | push 0xc $sequence_2 = { 68???????? ff15???????? 8d45dc 50 ff15???????? 8b4ddc } // n = 6, score = 200 // 68???????? | // ff15???????? | // 8d45dc | inc ecx // 50 | or edx, 0xffffffff // ff15???????? | // 8b4ddc | inc ecx $sequence_3 = { 53 ff15???????? 5d 5b 8bc7 5f 5e } // n = 7, score = 200 // 53 | dec eax // ff15???????? | // 5d | lea ebx, [ebp + ebx + 0x1e0] // 5b | inc ecx // 8bc7 | mov byte ptr [esi], cl // 5f | dec ebx // 5e | mov eax, dword ptr [ecx + edi*8 + 0x24e80] $sequence_4 = { 57 e8???????? 6a07 e8???????? 59 c3 6a10 } // n = 7, score = 200 // 57 | push edi // e8???????? | // 6a07 | push 7 // e8???????? | // 59 | pop ecx // c3 | ret // 6a10 | push 0x10 $sequence_5 = { 83c404 50 e8???????? 83c404 68???????? ff15???????? } // n = 6, score = 200 // 83c404 | add ebx, edx // 50 | dec ecx // e8???????? | // 83c404 | lea edx, [esi + 1] // 68???????? | // ff15???????? | $sequence_6 = { ff15???????? 32c0 488b8d70030000 4833cc e8???????? 4c8d9c2480040000 } // n = 6, score = 100 // ff15???????? | // 32c0 | dec eax // 488b8d70030000 | lea esi, [0x1527e] // 4833cc | dec eax // e8???????? | // 4c8d9c2480040000 | mov ecx, esi $sequence_7 = { ff15???????? 8bd8 83fbff 0f840a010000 } // n = 4, score = 100 // ff15???????? | // 8bd8 | mov ebx, eax // 83fbff | cmp ebx, -1 // 0f840a010000 | je 0x110 $sequence_8 = { 838568f8ffff01 80bd67f8ffff00 75e1 8bbd68f8ffff } // n = 4, score = 100 // 838568f8ffff01 | push 0xc // 80bd67f8ffff00 | jmp 0xffffffb4 // 75e1 | push 0x16 // 8bbd68f8ffff | pop eax $sequence_9 = { 488d4c2430 488d153d0e0100 41b898000000 498bf1 e8???????? 48638528050000 498b16 } // n = 7, score = 100 // 488d4c2430 | dec eax // 488d153d0e0100 | lea ecx, [esp + 0x30] // 41b898000000 | dec eax // 498bf1 | lea edx, [0x10e3d] // e8???????? | // 48638528050000 | inc ecx // 498b16 | mov eax, 0x98 $sequence_10 = { e8???????? 488d5510 488d4dd0 488945c8 488d05a0500100 48894510 } // n = 6, score = 100 // e8???????? | // 488d5510 | dec ecx // 488d4dd0 | mov esi, ecx // 488945c8 | dec eax // 488d05a0500100 | arpl word ptr [ebp + 0x528], ax // 48894510 | dec ecx $sequence_11 = { 57 ff15???????? 8bf0 85f6 741a 83feff 7415 } // n = 7, score = 100 // 57 | pop ebx // ff15???????? | // 8bf0 | mov eax, edi // 85f6 | pop edi // 741a | pop esi // 83feff | lea eax, [ebp - 0x24] // 7415 | push eax $sequence_12 = { 41880e 4b8b84f9804e0200 4183caff 4103da 498d5601 458d60f7 } // n = 6, score = 100 // 41880e | dec eax // 4b8b84f9804e0200 | lea eax, [0x12304] // 4183caff | dec eax // 4103da | mov ecx, dword ptr [esp + 0x30] // 498d5601 | test eax, eax // 458d60f7 | jne 0x10b $sequence_13 = { 488d0550210100 488901 e8???????? 90 } // n = 4, score = 100 // 488d0550210100 | dec eax // 488901 | lea edx, [esp + 0x30] // e8???????? | // 90 | dec eax $sequence_14 = { 7442 4885db 741b f0ff0b 7516 488d0504230100 488b4c2430 } // n = 7, score = 100 // 7442 | mov edx, dword ptr [esi] // 4885db | dec eax // 741b | lea edx, [ebp + 0x10] // f0ff0b | dec eax // 7516 | lea ecx, [ebp - 0x30] // 488d0504230100 | dec eax // 488b4c2430 | mov dword ptr [ebp - 0x38], eax $sequence_15 = { 0f84aa000000 0fb6d3 52 e8???????? 83c404 85c0 750e } // n = 7, score = 100 // 0f84aa000000 | je 0xb0 // 0fb6d3 | movzx edx, bl // 52 | push edx // e8???????? | // 83c404 | add esp, 4 // 85c0 | test eax, eax // 750e | jne 0x10 $sequence_16 = { 83c40c 56 ff15???????? b8???????? 8d5002 668b08 } // n = 6, score = 100 // 83c40c | mov ecx, dword ptr [ebp - 0x24] // 56 | add esp, 4 // ff15???????? | // b8???????? | // 8d5002 | push eax // 668b08 | add esp, 4 $sequence_17 = { c1f905 8d3c8d40174200 8bf0 83e61f c1e606 8b0f 0fbe4c3104 } // n = 7, score = 100 // c1f905 | sar ecx, 5 // 8d3c8d40174200 | lea edi, [ecx*4 + 0x421740] // 8bf0 | mov esi, eax // 83e61f | and esi, 0x1f // c1e606 | shl esi, 6 // 8b0f | mov ecx, dword ptr [edi] // 0fbe4c3104 | movsx ecx, byte ptr [ecx + esi + 4] $sequence_18 = { c1f905 8b0c8d40174200 83e21f c1e206 } // n = 4, score = 100 // c1f905 | sar ecx, 5 // 8b0c8d40174200 | mov ecx, dword ptr [ecx*4 + 0x421740] // 83e21f | and edx, 0x1f // c1e206 | shl edx, 6 $sequence_19 = { 488d8de0010000 448bf8 4b8d1c3f 4c8bc3 e8???????? 488d9c1de0010000 } // n = 6, score = 100 // 488d8de0010000 | dec eax // 448bf8 | test ebx, ebx // 4b8d1c3f | je 0x1d // 4c8bc3 | lock dec dword ptr [ebx] // e8???????? | // 488d9c1de0010000 | jne 0x1d $sequence_20 = { 50 e8???????? 8b8d28fcffff 83c40c 51 } // n = 5, score = 100 // 50 | push eax // e8???????? | // 8b8d28fcffff | mov ecx, dword ptr [ebp - 0x3d8] // 83c40c | add esp, 0xc // 51 | push ecx $sequence_21 = { 0fb64d08 83f901 752d 0fb795d8fdffff } // n = 4, score = 100 // 0fb64d08 | pop esi // 83f901 | pop ebp // 752d | ret // 0fb795d8fdffff | push 0xc $sequence_22 = { 8b11 8b7208 8931 8b7208 385e19 7503 } // n = 6, score = 100 // 8b11 | and ecx, 0x1f // 8b7208 | dec eax // 8931 | sar eax, 5 // 8b7208 | dec eax // 385e19 | imul ecx, ecx, 0x58 // 7503 | dec ecx $sequence_23 = { c644240f00 8db2201c0000 837c241000 7566 6800080000 e8???????? } // n = 6, score = 100 // c644240f00 | mov byte ptr [esp + 0xf], 0 // 8db2201c0000 | lea esi, [edx + 0x1c20] // 837c241000 | cmp dword ptr [esp + 0x10], 0 // 7566 | jne 0x68 // 6800080000 | push 0x800 // e8???????? | $sequence_24 = { 8905???????? 85c0 0f8503010000 488d357e520100 488bce e8???????? 488d542430 } // n = 7, score = 100 // 8905???????? | // 85c0 | dec eax // 0f8503010000 | lea eax, [0x150a0] // 488d357e520100 | dec eax // 488bce | mov dword ptr [ebp + 0x10], eax // e8???????? | // 488d542430 | je 0x44 $sequence_25 = { 8b421c ffd0 c745fc01000000 e9???????? 8345e4ff } // n = 5, score = 100 // 8b421c | mov eax, dword ptr [esi + eax*8] // ffd0 | and byte ptr [eax + ecx + 8], 0xfe // c745fc01000000 | push ebx // e9???????? | // 8345e4ff | pop ebp condition: 7 of them and filesize < 1112064 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY
