Actor(s): Equation Group
There is no description at this point.
rule win_doublefantasy_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.doublefantasy." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.doublefantasy" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { c1e202 0bd6 8a92908c2700 eb02 b23d } // n = 5, score = 200 // c1e202 | shl edx, 2 // 0bd6 | or edx, esi // 8a92908c2700 | mov dl, byte ptr [edx + 0x278c90] // eb02 | jmp 4 // b23d | mov dl, 0x3d $sequence_1 = { 50 ff75d8 ff7514 ff750c ff7508 e8???????? 83c414 } // n = 7, score = 200 // 50 | push eax // ff75d8 | push dword ptr [ebp - 0x28] // ff7514 | push dword ptr [ebp + 0x14] // ff750c | push dword ptr [ebp + 0xc] // ff7508 | push dword ptr [ebp + 8] // e8???????? | // 83c414 | add esp, 0x14 $sequence_2 = { 8a91908c2700 8b4c2408 8811 33d2 8a10 56 0fb67001 } // n = 7, score = 200 // 8a91908c2700 | mov dl, byte ptr [ecx + 0x278c90] // 8b4c2408 | mov ecx, dword ptr [esp + 8] // 8811 | mov byte ptr [ecx], dl // 33d2 | xor edx, edx // 8a10 | mov dl, byte ptr [eax] // 56 | push esi // 0fb67001 | movzx esi, byte ptr [eax + 1] $sequence_3 = { 50 68???????? e8???????? 8b4605 c68094a3270000 ff35???????? ff35???????? } // n = 7, score = 200 // 50 | push eax // 68???????? | // e8???????? | // 8b4605 | mov eax, dword ptr [esi + 5] // c68094a3270000 | mov byte ptr [eax + 0x27a394], 0 // ff35???????? | // ff35???????? | $sequence_4 = { ff7618 8b4508 ff7018 e8???????? 83c420 8945dc 83c704 } // n = 7, score = 200 // ff7618 | push dword ptr [esi + 0x18] // 8b4508 | mov eax, dword ptr [ebp + 8] // ff7018 | push dword ptr [eax + 0x18] // e8???????? | // 83c420 | add esp, 0x20 // 8945dc | mov dword ptr [ebp - 0x24], eax // 83c704 | add edi, 4 $sequence_5 = { 837c241001 8a92908c2700 885101 7e1c 0fb67002 } // n = 5, score = 200 // 837c241001 | cmp dword ptr [esp + 0x10], 1 // 8a92908c2700 | mov dl, byte ptr [edx + 0x278c90] // 885101 | mov byte ptr [ecx + 1], dl // 7e1c | jle 0x1e // 0fb67002 | movzx esi, byte ptr [eax + 2] $sequence_6 = { 8b45e0 83c02c 50 ff750c ffd3 ff750c e8???????? } // n = 7, score = 200 // 8b45e0 | mov eax, dword ptr [ebp - 0x20] // 83c02c | add eax, 0x2c // 50 | push eax // ff750c | push dword ptr [ebp + 0xc] // ffd3 | call ebx // ff750c | push dword ptr [ebp + 0xc] // e8???????? | $sequence_7 = { 33c0 85c9 7616 8da42400000000 8d50fd 891485a4ab2700 } // n = 6, score = 200 // 33c0 | xor eax, eax // 85c9 | test ecx, ecx // 7616 | jbe 0x18 // 8da42400000000 | lea esp, [esp] // 8d50fd | lea edx, [eax - 3] // 891485a4ab2700 | mov dword ptr [eax*4 + 0x27aba4], edx $sequence_8 = { 68???????? 8b45e0 83c014 50 ff15???????? } // n = 5, score = 200 // 68???????? | // 8b45e0 | mov eax, dword ptr [ebp - 0x20] // 83c014 | add eax, 0x14 // 50 | push eax // ff15???????? | $sequence_9 = { 8945e0 6840010000 ff15???????? 8945dc 837de400 0f8428010000 } // n = 6, score = 200 // 8945e0 | mov dword ptr [ebp - 0x20], eax // 6840010000 | push 0x140 // ff15???????? | // 8945dc | mov dword ptr [ebp - 0x24], eax // 837de400 | cmp dword ptr [ebp - 0x1c], 0 // 0f8428010000 | je 0x12e $sequence_10 = { 8d8510ffffff 50 56 8d45dc } // n = 4, score = 200 // 8d8510ffffff | lea eax, [ebp - 0xf0] // 50 | push eax // 56 | push esi // 8d45dc | lea eax, [ebp - 0x24] $sequence_11 = { 50 8b4609 03c6 50 53 e8???????? } // n = 6, score = 200 // 50 | push eax // 8b4609 | mov eax, dword ptr [esi + 9] // 03c6 | add eax, esi // 50 | push eax // 53 | push ebx // e8???????? | $sequence_12 = { 0fb6c0 8a80ad8c2700 eb02 32c0 } // n = 4, score = 200 // 0fb6c0 | movzx eax, al // 8a80ad8c2700 | mov al, byte ptr [eax + 0x278cad] // eb02 | jmp 4 // 32c0 | xor al, al $sequence_13 = { 3945dc 75de 50 ff75e4 } // n = 4, score = 200 // 3945dc | cmp dword ptr [ebp - 0x24], eax // 75de | jne 0xffffffe0 // 50 | push eax // ff75e4 | push dword ptr [ebp - 0x1c] $sequence_14 = { 7e0f 0fb64002 83e03f 8a80908c2700 eb02 b03d } // n = 6, score = 200 // 7e0f | jle 0x11 // 0fb64002 | movzx eax, byte ptr [eax + 2] // 83e03f | and eax, 0x3f // 8a80908c2700 | mov al, byte ptr [eax + 0x278c90] // eb02 | jmp 4 // b03d | mov al, 0x3d $sequence_15 = { 891485a4ab2700 40 3bc1 72f1 833d????????fd } // n = 5, score = 200 // 891485a4ab2700 | mov dword ptr [eax*4 + 0x27aba4], edx // 40 | inc eax // 3bc1 | cmp eax, ecx // 72f1 | jb 0xfffffff3 // 833d????????fd | condition: 7 of them and filesize < 172032 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY