SYMBOLCOMMON_NAMEaka. SYNONYMS
win.dreambot (Back to overview)

DreamBot

URLhaus    

2010 Gozi v2.0, Gozi ISFB, ISFB, Pandemyia(*)
2014 Dreambot (Gozi ISFB variant)

In 2014, a variant of Gozi ISFB was developed. Mainly, the dropper performs additional anti-vm checks (vmware, vbox, qemu), while the actual bot-dll remains unchanged in most parts. New functionality, such as TOR support, was added though and often, the Fluxxy fast-flux network is used.

See win.gozi for additional historical information.

References
2021-01-28Youtube (Virus Bulletin)Benoît Ancel
@online{ancel:20210128:bagsu:7de60de, author = {Benoît Ancel}, title = {{The Bagsu banker case}}, date = {2021-01-28}, organization = {Youtube (Virus Bulletin)}, url = {https://www.youtube.com/watch?v=EyDiIAt__dI}, language = {English}, urldate = {2021-02-01} } The Bagsu banker case
Azorult DreamBot Emotet Pony TrickBot ZeusAction
2020-09-02RiskIQJordan Herman
@online{herman:20200902:inter:93b8c50, author = {Jordan Herman}, title = {{The Inter Skimmer Kit}}, date = {2020-09-02}, organization = {RiskIQ}, url = {https://community.riskiq.com/article/30f22a00}, language = {English}, urldate = {2020-09-04} } The Inter Skimmer Kit
magecart DreamBot TeslaCrypt
2020-08-28CheckpointCheck Point Research
@online{research:20200828:gozi:944c005, author = {Check Point Research}, title = {{Gozi: The Malware with a Thousand Faces}}, date = {2020-08-28}, organization = {Checkpoint}, url = {https://research.checkpoint.com/2020/gozi-the-malware-with-a-thousand-faces/}, language = {English}, urldate = {2020-09-01} } Gozi: The Malware with a Thousand Faces
DreamBot ISFB LOLSnif SaiGon
2020-05-01CSISBenoît Ancel
@online{ancel:20200501:end:939414e, author = {Benoît Ancel}, title = {{The end of Dreambot? Obituary for a loved piece of Gozi.}}, date = {2020-05-01}, organization = {CSIS}, url = {https://medium.com/csis-techblog/the-end-of-dreambot-a-loved-piece-of-gozi-24cc9bfc8122}, language = {English}, urldate = {2020-05-05} } The end of Dreambot? Obituary for a loved piece of Gozi.
DreamBot
2020-02-07Medium CSIS TechblogBenoît Ancel
@online{ancel:20200207:installcapital:23b3760, author = {Benoît Ancel}, title = {{InstallCapital — When AdWare Becomes Pay-per-Install Cyber-Crime}}, date = {2020-02-07}, organization = {Medium CSIS Techblog}, url = {https://medium.com/csis-techblog/installcapital-when-adware-becomes-pay-per-install-cyber-crime-15516249a451}, language = {English}, urldate = {2020-02-09} } InstallCapital — When AdWare Becomes Pay-per-Install Cyber-Crime
DreamBot Glupteba
2017-05-29Lokalhost.plMaciej Kotowicz
@online{kotowicz:20170529:gozi:96e962d, author = {Maciej Kotowicz}, title = {{Gozi Tree}}, date = {2017-05-29}, organization = {Lokalhost.pl}, url = {https://lokalhost.pl/gozi_tree.txt}, language = {English}, urldate = {2020-01-08} } Gozi Tree
DreamBot Gozi ISFB Powersniff
2016-08-29ProofpointProofpoint Staff
@online{staff:20160829:nightmare:2268343, author = {Proofpoint Staff}, title = {{Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality}}, date = {2016-08-29}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/ursnif-variant-dreambot-adds-tor-functionality}, language = {English}, urldate = {2019-12-20} } Nightmare on Tor Street: Ursnif variant Dreambot adds Tor functionality
DreamBot
Yara Rules
[TLP:WHITE] win_dreambot_auto (20211008 | Detects win.dreambot.)
rule win_dreambot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.dreambot."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dreambot"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 85ff 7410 ff7320 6a00 }
            // n = 4, score = 700
            //   85ff                 | je                  0x4b
            //   7410                 | dec                 ecx
            //   ff7320               | cmp                 edi, ebp
            //   6a00                 | je                  0x87

        $sequence_1 = { 8b4618 53 33db 57 895df8 e8???????? }
            // n = 6, score = 700
            //   8b4618               | je                  0x98
            //   53                   | inc                 ecx
            //   33db                 | mov                 eax, 3
            //   57                   | jmp                 0xffffffc5
            //   895df8               | dec                 ecx
            //   e8????????           |                     

        $sequence_2 = { ff35???????? ffd6 897b20 6a00 68???????? ff7320 }
            // n = 6, score = 700
            //   ff35????????         |                     
            //   ffd6                 | inc                 ecx
            //   897b20               | cmp                 esi, ebp
            //   6a00                 | je                  0x61
            //   68????????           |                     
            //   ff7320               | mov                 edx, esi

        $sequence_3 = { 39451c 7475 8b4618 e8???????? 8bf8 85ff 7547 }
            // n = 7, score = 700
            //   39451c               | dec                 eax
            //   7475                 | mov                 ecx, edi
            //   8b4618               | mov                 ebx, 0x57
            //   e8????????           |                     
            //   8bf8                 | mov                 ebx, 0x57
            //   85ff                 | inc                 ecx
            //   7547                 | cmp                 eax, ebp

        $sequence_4 = { 836730f9 c7472801000000 8b4730 a801 7454 68???????? 68???????? }
            // n = 7, score = 700
            //   836730f9             | cmp                 edi, ebp
            //   c7472801000000       | inc                 ebp
            //   8b4730               | xor                 eax, eax
            //   a801                 | xor                 edx, edx
            //   7454                 | xor                 ecx, ecx
            //   68????????           |                     
            //   68????????           |                     

        $sequence_5 = { 85db 0f8414020000 8b4320 be???????? }
            // n = 4, score = 700
            //   85db                 | inc                 ecx
            //   0f8414020000         | cmp                 esi, ebp
            //   8b4320               | je                  0x87
            //   be????????           |                     

        $sequence_6 = { 894730 e9???????? 55 8bec }
            // n = 4, score = 700
            //   894730               | dec                 eax
            //   e9????????           |                     
            //   55                   | test                eax, eax
            //   8bec                 | dec                 esp

        $sequence_7 = { 56 ff742410 89442418 ff15???????? }
            // n = 4, score = 700
            //   56                   | mov                 esp, eax
            //   ff742410             | xor                 edx, edx
            //   89442418             | xor                 ecx, ecx
            //   ff15????????         |                     

        $sequence_8 = { bb57000000 e8???????? 413bc5 7446 }
            // n = 4, score = 500
            //   bb57000000           | dec                 eax
            //   e8????????           |                     
            //   413bc5               | add                 edx, dword ptr [esp + 0x60]
            //   7446                 | inc                 ecx

        $sequence_9 = { 33d2 33c9 ff15???????? 4885c0 4c8be0 }
            // n = 5, score = 500
            //   33d2                 | dec                 eax
            //   33c9                 | test                eax, eax
            //   ff15????????         |                     
            //   4885c0               | inc                 ecx
            //   4c8be0               | lea                 edx, dword ptr [esi + 0x20]

        $sequence_10 = { 488b9424a8000000 4533c9 4533c0 ff5028 }
            // n = 4, score = 500
            //   488b9424a8000000     | pop                 ebp
            //   4533c9               | inc                 ecx
            //   4533c0               | pop                 esp
            //   ff5028               | pop                 edi

        $sequence_11 = { 0f8492000000 41b803000000 ebbd 493bfd }
            // n = 4, score = 500
            //   0f8492000000         | dec                 eax
            //   41b803000000         | mov                 edx, dword ptr [esp + 0x60]
            //   ebbd                 | inc                 ebp
            //   493bfd               | xor                 ecx, ecx

        $sequence_12 = { ff15???????? e9???????? 493bfd 0f84d9000000 413bf5 }
            // n = 5, score = 500
            //   ff15????????         |                     
            //   e9????????           |                     
            //   493bfd               | dec                 eax
            //   0f84d9000000         | add                 edx, dword ptr [esp + 0x60]
            //   413bf5               | inc                 ecx

        $sequence_13 = { 7528 493bfd 7423 41b904000000 413bf1 7518 }
            // n = 6, score = 500
            //   7528                 | inc                 ebp
            //   493bfd               | xor                 ecx, ecx
            //   7423                 | dec                 eax
            //   41b904000000         | mov                 ecx, eax
            //   413bf1               | dec                 ecx
            //   7518                 | sub                 edx, eax

        $sequence_14 = { 493bfd 0f8481000000 413bf5 747c }
            // n = 4, score = 500
            //   493bfd               | call                dword ptr [edx + 0x20]
            //   0f8481000000         | dec                 esp
            //   413bf5               | mov                 eax, dword ptr [esp + 0x60]
            //   747c                 | dec                 ecx

        $sequence_15 = { 492bd0 4803542460 41ff5220 4c8b442460 }
            // n = 4, score = 500
            //   492bd0               | lea                 ecx, dword ptr [eax + 0x10]
            //   4803542460           | dec                 esp
            //   41ff5220             | mov                 eax, esi
            //   4c8b442460           | dec                 eax

        $sequence_16 = { 418d5620 498bcf ff15???????? 4c8bf0 }
            // n = 4, score = 500
            //   418d5620             | mov                 ecx, dword ptr [ebx]
            //   498bcf               | and                 eax, 0x80
            //   ff15????????         |                     
            //   4c8bf0               | inc                 ecx

        $sequence_17 = { e8???????? 4c8b1d???????? ba0d000000 41834b3401 }
            // n = 4, score = 500
            //   e8????????           |                     
            //   4c8b1d????????       |                     
            //   ba0d000000           | xor                 ecx, ecx
            //   41834b3401           | dec                 eax

        $sequence_18 = { 4c8b18 488b542460 4533c9 488bc8 }
            // n = 4, score = 500
            //   4c8b18               | dec                 ecx
            //   488b542460           | cmp                 eax, ebp
            //   4533c9               | je                  0xc5
            //   488bc8               | dec                 eax

        $sequence_19 = { 413bf5 745f 8bd6 488bcf bb57000000 }
            // n = 5, score = 500
            //   413bf5               | call                dword ptr [edx + 0x20]
            //   745f                 | dec                 esp
            //   8bd6                 | mov                 eax, dword ptr [esp + 0x60]
            //   488bcf               | dec                 ecx
            //   bb57000000           | sub                 edx, eax

        $sequence_20 = { 488d5e10 4533f6 488b0b 2580000000 418d5620 }
            // n = 5, score = 500
            //   488d5e10             | dec                 eax
            //   4533f6               | lea                 ebx, dword ptr [esi + 0x10]
            //   488b0b               | inc                 ebp
            //   2580000000           | xor                 esi, esi
            //   418d5620             | dec                 eax

        $sequence_21 = { 5f c3 4053 4883ec20 4c8b4108 488bd9 4d85c0 }
            // n = 7, score = 500
            //   5f                   | dec                 ecx
            //   c3                   | mov                 ecx, edi
            //   4053                 | dec                 esp
            //   4883ec20             | mov                 esi, eax
            //   4c8b4108             | dec                 eax
            //   488bd9               | test                eax, eax
            //   4d85c0               | inc                 ebp

        $sequence_22 = { 4c896c2420 e8???????? 4c8b442468 488b0d???????? }
            // n = 4, score = 500
            //   4c896c2420           | dec                 eax
            //   e8????????           |                     
            //   4c8b442468           | lea                 ebx, dword ptr [esi + 0x10]
            //   488b0d????????       |                     

        $sequence_23 = { 3decc7eea6 0f84e8000000 3d0470a8c4 0f8486000000 }
            // n = 4, score = 400
            //   3decc7eea6           | xor                 esi, esi
            //   0f84e8000000         | dec                 eax
            //   3d0470a8c4           | mov                 ecx, dword ptr [ebx]
            //   0f8486000000         | and                 eax, 0x80

        $sequence_24 = { 8b87184a0000 56 33f6 46 8945f8 85c0 }
            // n = 6, score = 400
            //   8b87184a0000         | push                eax
            //   56                   | mov                 eax, dword ptr [ebp + 0xc]
            //   33f6                 | xor                 ebx, ebx
            //   46                   | xor                 ebx, ebx
            //   8945f8               | mov                 dword ptr [ebp - 4], ebx
            //   85c0                 | mov                 dword ptr [ebp - 8], eax

        $sequence_25 = { 493bce 740a e8???????? 413bc6 7509 4489764c e9???????? }
            // n = 7, score = 400
            //   493bce               | mov                 ecx, eax
            //   740a                 | inc                 ecx
            //   e8????????           |                     
            //   413bc6               | call                dword ptr [ebx + 0x18]
            //   7509                 | dec                 esp
            //   4489764c             | mov                 dword ptr [esp + 0x20], ebp
            //   e9????????           |                     

        $sequence_26 = { 3dd4047797 0f843dfeffff 3decc7eea6 0f8459010000 }
            // n = 4, score = 400
            //   3dd4047797           | xor                 edx, edx
            //   0f843dfeffff         | mov                 edx, 0xd
            //   3decc7eea6           | inc                 ecx
            //   0f8459010000         | or                  dword ptr [ebx + 0x34], 1

        $sequence_27 = { ff15???????? 4883f8ff 488bf8 7445 488d842488000000 }
            // n = 5, score = 400
            //   ff15????????         |                     
            //   4883f8ff             | mov                 ecx, eax
            //   488bf8               | inc                 ecx
            //   7445                 | call                dword ptr [ebx + 0x18]
            //   488d842488000000     | dec                 eax

        $sequence_28 = { 3bca 745f 33c0 899424e0030000 899424c0030000 898424e4030000 }
            // n = 6, score = 400
            //   3bca                 | dec                 ecx
            //   745f                 | mov                 ecx, edi
            //   33c0                 | dec                 ecx
            //   899424e0030000       | inc                 edi
            //   899424c0030000       | inc                 ecx
            //   898424e4030000       | lea                 edx, dword ptr [esi + 0x20]

        $sequence_29 = { 7751 4d85e4 0f843bffffff 4c8b4c2478 4c8bc6 498bd7 498bcd }
            // n = 7, score = 400
            //   7751                 | mov                 eax, dword ptr [esp + 0x60]
            //   4d85e4               | dec                 ecx
            //   0f843bffffff         | mov                 ecx, ebx
            //   4c8b4c2478           | dec                 ecx
            //   4c8bc6               | sub                 edx, eax
            //   498bd7               | dec                 eax
            //   498bcd               | add                 edx, dword ptr [esp + 0x60]

        $sequence_30 = { 4885db 7417 488b0d???????? 4c8bc3 }
            // n = 4, score = 400
            //   4885db               | dec                 esp
            //   7417                 | mov                 eax, dword ptr [esp + 0x60]
            //   488b0d????????       |                     
            //   4c8bc3               | dec                 ecx

        $sequence_31 = { 4883ec30 837a3c04 4c8b2a 488bf2 488bd9 }
            // n = 5, score = 400
            //   4883ec30             | inc                 ecx
            //   837a3c04             | call                dword ptr [edx + 0x20]
            //   4c8b2a               | dec                 esp
            //   488bf2               | mov                 eax, dword ptr [esp + 0x60]
            //   488bd9               | dec                 eax

        $sequence_32 = { e8???????? 8b9424c8000000 488bcb e8???????? f7d0 eb07 }
            // n = 6, score = 400
            //   e8????????           |                     
            //   8b9424c8000000       | add                 edx, dword ptr [esp + 0x60]
            //   488bcb               | inc                 ecx
            //   e8????????           |                     
            //   f7d0                 | call                dword ptr [edx + 0x20]
            //   eb07                 | dec                 esp

        $sequence_33 = { ff15???????? 85c0 7411 8b542438 488bcb 03d2 }
            // n = 6, score = 400
            //   ff15????????         |                     
            //   85c0                 | inc                 ecx
            //   7411                 | mov                 eax, dword ptr [esp + 0x1c]
            //   8b542438             | dec                 eax
            //   488bcb               | lea                 ebx, dword ptr [esi + 0x10]
            //   03d2                 | inc                 ebp

        $sequence_34 = { e8???????? 488d4c2440 ff15???????? 0fb74c2442 b856555555 }
            // n = 5, score = 400
            //   e8????????           |                     
            //   488d4c2440           | mov                 dword ptr [esp + 0x20], ebp
            //   ff15????????         |                     
            //   0fb74c2442           | dec                 esp
            //   b856555555           | mov                 eax, dword ptr [esp + 0x68]

        $sequence_35 = { 6810040000 ff15???????? 8945fc 85c0 741a 6804010000 8d4f10 }
            // n = 7, score = 400
            //   6810040000           | mov                 dword ptr [ebp + 0xc], esi
            //   ff15????????         |                     
            //   8945fc               | lea                 esi, dword ptr [ebp + 0xc]
            //   85c0                 | mov                 esi, eax
            //   741a                 | cmp                 esi, ebx
            //   6804010000           | xor                 edi, edi
            //   8d4f10               | jmp                 5

        $sequence_36 = { 85c0 7551 ff33 50 6810040000 ff15???????? }
            // n = 6, score = 400
            //   85c0                 | xor                 edi, edi
            //   7551                 | jmp                 5
            //   ff33                 | mov                 esi, dword ptr [ebp + 0xc]
            //   50                   | push                dword ptr [ebp - 8]
            //   6810040000           | add                 esi, 0x3c6ef35f
            //   ff15????????         |                     

        $sequence_37 = { 817424105085b8ed 33ff 47 57 be???????? 56 8d542418 }
            // n = 7, score = 400
            //   817424105085b8ed     | dec                 esp
            //   33ff                 | mov                 eax, dword ptr [ecx + 8]
            //   47                   | dec                 eax
            //   57                   | mov                 ebx, ecx
            //   be????????           |                     
            //   56                   | dec                 ebp
            //   8d542418             | test                eax, eax

        $sequence_38 = { 492bd6 75f5 eb06 8b05???????? 35fc5585cf }
            // n = 5, score = 400
            //   492bd6               | mov                 ecx, ebx
            //   75f5                 | dec                 ecx
            //   eb06                 | sub                 edx, eax
            //   8b05????????         |                     
            //   35fc5585cf           | dec                 eax

        $sequence_39 = { 56 8db4083089b9ed 57 8d45f4 50 }
            // n = 5, score = 400
            //   56                   | ret                 
            //   8db4083089b9ed       | inc                 eax
            //   57                   | push                ebx
            //   8d45f4               | dec                 eax
            //   50                   | sub                 esp, 0x20

        $sequence_40 = { c3 6a00 6800004000 6a00 ff15???????? a3???????? 85c0 }
            // n = 7, score = 400
            //   c3                   | dec                 eax
            //   6a00                 | lea                 ebx, dword ptr [esi + 0x10]
            //   6800004000           | inc                 ebp
            //   6a00                 | xor                 esi, esi
            //   ff15????????         |                     
            //   a3????????           |                     
            //   85c0                 | dec                 eax

        $sequence_41 = { 8d8718020000 50 ff7310 ff15???????? 33d2 89b7184a0000 }
            // n = 6, score = 400
            //   8d8718020000         | add                 esi, 0x3c6ef35f
            //   50                   | mov                 dword ptr [ebp + 0xc], esi
            //   ff7310               | push                dword ptr [ebp - 0xc]
            //   ff15????????         |                     
            //   33d2                 | add                 esi, 0x3c6ef35f
            //   89b7184a0000         | mov                 dword ptr [ebp + 0xc], esi

        $sequence_42 = { 488bc8 eb03 498bce 8b464c 83e040 0b4724 44897630 }
            // n = 7, score = 400
            //   488bc8               | dec                 esp
            //   eb03                 | mov                 eax, dword ptr [esp + 0x68]
            //   498bce               | dec                 esp
            //   8b464c               | mov                 dword ptr [esp + 0x20], ebp
            //   83e040               | dec                 esp
            //   0b4724               | mov                 eax, dword ptr [esp + 0x68]
            //   44897630             | xor                 edx, edx

        $sequence_43 = { e8???????? 8945f8 33ff eb03 }
            // n = 4, score = 400
            //   e8????????           |                     
            //   8945f8               | pop                 edi
            //   33ff                 | ret                 
            //   eb03                 | inc                 eax

        $sequence_44 = { ff75f4 81c65ff36e3c 89750c 8d750c e8???????? }
            // n = 5, score = 400
            //   ff75f4               | dec                 ecx
            //   81c65ff36e3c         | sub                 edx, eax
            //   89750c               | dec                 eax
            //   8d750c               | add                 edx, dword ptr [esp + 0x60]
            //   e8????????           |                     

        $sequence_45 = { 8d750c e8???????? 8bf0 3bf3 }
            // n = 4, score = 400
            //   8d750c               | push                ebx
            //   e8????????           |                     
            //   8bf0                 | dec                 eax
            //   3bf3                 | sub                 esp, 0x20

        $sequence_46 = { 458d343b 4183fe18 7718 488b9424d8000000 }
            // n = 4, score = 400
            //   458d343b             | mov                 dword ptr [esp + 0x20], ebp
            //   4183fe18             | dec                 esp
            //   7718                 | mov                 eax, dword ptr [esp + 0x68]
            //   488b9424d8000000     | dec                 esp

        $sequence_47 = { 8b750c ff75f8 69f60d661900 ff75f4 81c65ff36e3c }
            // n = 5, score = 400
            //   8b750c               | sub                 edx, eax
            //   ff75f8               | dec                 eax
            //   69f60d661900         | add                 edx, dword ptr [esp + 0x60]
            //   ff75f4               | inc                 ecx
            //   81c65ff36e3c         | call                dword ptr [edx + 0x20]

        $sequence_48 = { 33ff eb03 8b750c ff75f8 }
            // n = 4, score = 400
            //   33ff                 | dec                 eax
            //   eb03                 | add                 edx, dword ptr [esp + 0x60]
            //   8b750c               | inc                 ecx
            //   ff75f8               | call                dword ptr [edx + 0x20]

        $sequence_49 = { f605????????04 740e 44893d???????? 44893d???????? 488d442440 4c8d4c2440 }
            // n = 6, score = 300
            //   f605????????04       |                     
            //   740e                 | mov                 ecx, dword ptr [ebx]
            //   44893d????????       |                     
            //   44893d????????       |                     
            //   488d442440           | and                 eax, 0x80
            //   4c8d4c2440           | inc                 ecx

        $sequence_50 = { 4c8bc6 ff15???????? 488bd8 493bc7 }
            // n = 4, score = 300
            //   4c8bc6               | lea                 ecx, dword ptr [esp + 0x40]
            //   ff15????????         |                     
            //   488bd8               | je                  0x10
            //   493bc7               | dec                 eax

        $sequence_51 = { 53 6a03 6800000080 8d85a0fcffff 50 ff15???????? }
            // n = 6, score = 300
            //   53                   | dec                 eax
            //   6a03                 | mov                 ebp, dword ptr [esp + 0x68]
            //   6800000080           | mov                 eax, ebx
            //   8d85a0fcffff         | dec                 eax
            //   50                   | mov                 ebx, dword ptr [esp + 0x60]
            //   ff15????????         |                     

        $sequence_52 = { 897dfc 393d???????? 754a a1???????? }
            // n = 4, score = 300
            //   897dfc               | dec                 eax
            //   393d????????         |                     
            //   754a                 | add                 esp, 0x30
            //   a1????????           |                     

        $sequence_53 = { 488b0d???????? 4885c9 7405 e8???????? 4883c428 c3 4053 }
            // n = 7, score = 300
            //   488b0d????????       |                     
            //   4885c9               | test                eax, eax
            //   7405                 | dec                 ecx
            //   e8????????           |                     
            //   4883c428             | inc                 edi
            //   c3                   | inc                 ecx
            //   4053                 | lea                 edx, dword ptr [esi + 0x20]

        $sequence_54 = { 4d3bef 7415 498bd5 4883c9ff }
            // n = 4, score = 300
            //   4d3bef               | inc                 ecx
            //   7415                 | mov                 eax, dword ptr [esp + 0x1c]
            //   498bd5               | dec                 eax
            //   4883c9ff             | lea                 ebx, dword ptr [esi + 0x10]

        $sequence_55 = { 3bf3 0f85d7feffff ff75fc e8???????? ff75ec e8???????? }
            // n = 6, score = 300
            //   3bf3                 | lea                 edx, dword ptr [esi + 0x20]
            //   0f85d7feffff         | dec                 eax
            //   ff75fc               | mov                 ebp, dword ptr [esp + 0x68]
            //   e8????????           |                     
            //   ff75ec               | mov                 eax, ebx
            //   e8????????           |                     

        $sequence_56 = { 8b4508 8d843800ffffff 50 8d442418 }
            // n = 4, score = 300
            //   8b4508               | dec                 eax
            //   8d843800ffffff       | mov                 ecx, dword ptr [ebx]
            //   50                   | and                 eax, 0x80
            //   8d442418             | inc                 ecx

        $sequence_57 = { 3bfb 0f84fe030000 68???????? ff15???????? e9???????? }
            // n = 5, score = 300
            //   3bfb                 | dec                 eax
            //   0f84fe030000         | mov                 ebx, dword ptr [esp + 0x60]
            //   68????????           |                     
            //   ff15????????         |                     
            //   e9????????           |                     

        $sequence_58 = { 493bc5 742f 488d4810 ff15???????? }
            // n = 4, score = 300
            //   493bc5               | dec                 eax
            //   742f                 | lea                 eax, dword ptr [esp + 0x40]
            //   488d4810             | dec                 esp
            //   ff15????????         |                     

        $sequence_59 = { 56 8818 e8???????? 50 }
            // n = 4, score = 300
            //   56                   | inc                 ecx
            //   8818                 | pop                 esp
            //   e8????????           |                     
            //   50                   | pop                 edi

        $sequence_60 = { 83f803 7438 8b4614 8945fc }
            // n = 4, score = 300
            //   83f803               | dec                 eax
            //   7438                 | lea                 ebx, dword ptr [esi + 0x10]
            //   8b4614               | inc                 ebp
            //   8945fc               | xor                 esi, esi

        $sequence_61 = { 83412801 8a8111170000 eb0b 85c0 }
            // n = 4, score = 200
            //   83412801             | xor                 ebx, ebx
            //   8a8111170000         | mov                 dword ptr [ebp - 4], ebx
            //   eb0b                 | mov                 dword ptr [ebp - 8], eax
            //   85c0                 | xor                 edi, edi

        $sequence_62 = { 8b4036 85c0 75ec a1???????? }
            // n = 4, score = 200
            //   8b4036               | jmp                 ecx
            //   85c0                 | dec                 eax
            //   75ec                 | mov                 edx, ebp
            //   a1????????           |                     

        $sequence_63 = { 8bc5 0fb7cd f7d0 c1e810 3bc8 0f8545ffffff 894f48 }
            // n = 7, score = 200
            //   8bc5                 | push                dword ptr [ebp - 8]
            //   0fb7cd               | imul                esi, esi, 0x19660d
            //   f7d0                 | imul                esi, esi, 0x19660d
            //   c1e810               | push                dword ptr [ebp - 0xc]
            //   3bc8                 | add                 esi, 0x3c6ef35f
            //   0f8545ffffff         | mov                 dword ptr [ebp + 0xc], esi
            //   894f48               | mov                 eax, dword ptr [ebp + 0xc]

        $sequence_64 = { 83839c000000ff 89b390000000 e9???????? 39bb90000000 }
            // n = 4, score = 200
            //   83839c000000ff       | mov                 dword ptr [ebp - 8], eax
            //   89b390000000         | xor                 edi, edi
            //   e9????????           |                     
            //   39bb90000000         | jmp                 7

        $sequence_65 = { 6a3a 56 50 e8???????? }
            // n = 4, score = 200
            //   6a3a                 | dec                 eax
            //   56                   | mov                 ecx, edi
            //   50                   | dec                 ecx
            //   e8????????           |                     

        $sequence_66 = { 85c0 0f85b7000000 56 ff742428 ffd7 8bf8 }
            // n = 6, score = 200
            //   85c0                 | test                eax, eax
            //   0f85b7000000         | jne                 0xbd
            //   56                   | push                esi
            //   ff742428             | push                dword ptr [esp + 0x28]
            //   ffd7                 | call                edi
            //   8bf8                 | mov                 edi, eax

        $sequence_67 = { 813d????????58876837 56 0f84e9000000 ff74241c ffd7 8bf8 }
            // n = 6, score = 200
            //   813d????????58876837     |     
            //   56                   | push                esi
            //   0f84e9000000         | je                  0xef
            //   ff74241c             | push                dword ptr [esp + 0x1c]
            //   ffd7                 | call                edi
            //   8bf8                 | mov                 edi, eax

        $sequence_68 = { 83432801 b910000000 8d42f5 2aca }
            // n = 4, score = 200
            //   83432801             | lea                 eax, dword ptr [ebp - 0xc]
            //   b910000000           | push                eax
            //   8d42f5               | add                 esi, 0x3c6ef35f
            //   2aca                 | mov                 dword ptr [ebp + 0xc], esi

        $sequence_69 = { c9 c20800 55 8bec 81ec1c010000 8d4807 }
            // n = 6, score = 200
            //   c9                   | leave               
            //   c20800               | ret                 8
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   81ec1c010000         | sub                 esp, 0x11c
            //   8d4807               | lea                 ecx, dword ptr [eax + 7]

        $sequence_70 = { 4439ab1c4a0000 0f848a000000 0fb74d20 66413bcd }
            // n = 4, score = 200
            //   4439ab1c4a0000       | mov                 esi, dword ptr [ebp + 0xc]
            //   0f848a000000         | push                dword ptr [ebp - 8]
            //   0fb74d20             | imul                esi, esi, 0x19660d
            //   66413bcd             | push                dword ptr [ebp - 0xc]

        $sequence_71 = { ff15???????? 483bc3 7431 4889442430 488d442468 }
            // n = 5, score = 200
            //   ff15????????         |                     
            //   483bc3               | pop                 edi
            //   7431                 | mov                 ebx, eax
            //   4889442430           | dec                 eax
            //   488d442468           | mov                 ebp, dword ptr [esp + 0x68]

        $sequence_72 = { 83a78c00000000 33c0 c3 51 e8???????? 0558020000 83d200 }
            // n = 7, score = 200
            //   83a78c00000000       | and                 dword ptr [edi + 0x8c], 0
            //   33c0                 | xor                 eax, eax
            //   c3                   | ret                 
            //   51                   | push                ecx
            //   e8????????           |                     
            //   0558020000           | add                 eax, 0x258
            //   83d200               | adc                 edx, 0

        $sequence_73 = { 493bfd 0f84da050000 413bf5 0f84d1050000 }
            // n = 4, score = 200
            //   493bfd               | dec                 eax
            //   0f84da050000         | mov                 ebx, dword ptr [esp + 0x60]
            //   413bf5               | mov                 ebx, eax
            //   0f84d1050000         | dec                 eax

        $sequence_74 = { 8be5 5d c3 0fb708 6683f902 }
            // n = 5, score = 200
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   0fb708               | movzx               ecx, word ptr [eax]
            //   6683f902             | cmp                 cx, 2

        $sequence_75 = { 8b4f7c 6689844f88000000 015f7c e9???????? 66837c243610 }
            // n = 5, score = 200
            //   8b4f7c               | mov                 esi, dword ptr [ebp + 0xc]
            //   6689844f88000000     | xor                 dword ptr [esp + 0x10], 0xedb88550
            //   015f7c               | xor                 edi, edi
            //   e9????????           |                     
            //   66837c243610         | inc                 edi

        $sequence_76 = { ffe1 488bd5 488bcf e8???????? e9???????? 493bfd 0f84da050000 }
            // n = 7, score = 200
            //   ffe1                 | mov                 ebx, dword ptr [esp + 0x60]
            //   488bd5               | dec                 eax
            //   488bcf               | add                 esp, 0x30
            //   e8????????           |                     
            //   e9????????           |                     
            //   493bfd               | inc                 ecx
            //   0f84da050000         | pop                 esp

        $sequence_77 = { 488d442470 4533c9 4533c0 8bd7 4889442420 e8???????? 8bf8 }
            // n = 7, score = 200
            //   488d442470           | mov                 ebx, eax
            //   4533c9               | dec                 eax
            //   4533c0               | mov                 ebp, dword ptr [esp + 0x68]
            //   8bd7                 | mov                 eax, ebx
            //   4889442420           | dec                 eax
            //   e8????????           |                     
            //   8bf8                 | mov                 ebx, dword ptr [esp + 0x60]

        $sequence_78 = { 413bdd 0f8517050000 4c8b642440 448b05???????? }
            // n = 4, score = 200
            //   413bdd               | dec                 eax
            //   0f8517050000         | mov                 ebp, dword ptr [esp + 0x68]
            //   4c8b642440           | mov                 eax, ebx
            //   448b05????????       |                     

        $sequence_79 = { ffb72c080000 e8???????? 5e 5d 5b c3 eb10 }
            // n = 7, score = 200
            //   ffb72c080000         | push                dword ptr [edi + 0x82c]
            //   e8????????           |                     
            //   5e                   | pop                 esi
            //   5d                   | pop                 ebp
            //   5b                   | pop                 ebx
            //   c3                   | ret                 
            //   eb10                 | jmp                 0x12

        $sequence_80 = { 413bf5 0f84d1050000 488d4c2458 33d2 }
            // n = 4, score = 200
            //   413bf5               | dec                 eax
            //   0f84d1050000         | add                 esp, 0x30
            //   488d4c2458           | mov                 eax, ebx
            //   33d2                 | dec                 eax

        $sequence_81 = { e8???????? 418b44241c 488d5e10 4533f6 }
            // n = 4, score = 200
            //   e8????????           |                     
            //   418b44241c           | dec                 esp
            //   488d5e10             | lea                 ecx, dword ptr [esp + 0x40]
            //   4533f6               | dec                 esp

        $sequence_82 = { c9 c21000 a1???????? 83c01e }
            // n = 4, score = 200
            //   c9                   | cmp                 edi, ebp
            //   c21000               | je                  0x5e6
            //   a1????????           |                     
            //   83c01e               | dec                 eax

        $sequence_83 = { 8b5018 8b481c 2b5748 8d0413 3bc1 766a }
            // n = 6, score = 200
            //   8b5018               | jmp                 0xd
            //   8b481c               | mov                 esi, dword ptr [ebp + 0xc]
            //   2b5748               | lea                 esi, dword ptr [ebp + 0xc]
            //   8d0413               | mov                 esi, eax
            //   3bc1                 | cmp                 esi, ebx
            //   766a                 | imul                esi, esi, 0x19660d

        $sequence_84 = { 83ffff 0f84a0010000 3bfe 0f8498010000 ff742418 ff15???????? eb2a }
            // n = 7, score = 200
            //   83ffff               | cmp                 edi, -1
            //   0f84a0010000         | je                  0x1a6
            //   3bfe                 | cmp                 edi, esi
            //   0f8498010000         | je                  0x19e
            //   ff742418             | push                dword ptr [esp + 0x18]
            //   ff15????????         |                     
            //   eb2a                 | jmp                 0x2c

        $sequence_85 = { 4889442420 e8???????? 3bc3 0f859b000000 488d542478 }
            // n = 5, score = 200
            //   4889442420           | mov                 word ptr [edi + ecx*2 + 0x88], ax
            //   e8????????           |                     
            //   3bc3                 | add                 dword ptr [edi + 0x7c], ebx
            //   0f859b000000         | cmp                 word ptr [esp + 0x36], 0x10
            //   488d542478           | jne                 0x71

        $sequence_86 = { c3 33c0 483bc8 7458 488b5128 483bd0 }
            // n = 6, score = 200
            //   c3                   | lea                 esi, dword ptr [eax + ecx - 0x124676d0]
            //   33c0                 | push                edi
            //   483bc8               | lea                 eax, dword ptr [ebp - 0xc]
            //   7458                 | push                eax
            //   488b5128             | push                dword ptr [ebp - 0xc]
            //   483bd0               | add                 esi, 0x3c6ef35f

        $sequence_87 = { 897004 5f 5e 5b c20800 51 53 }
            // n = 7, score = 200
            //   897004               | mov                 dword ptr [eax + 4], esi
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   c20800               | ret                 8
            //   51                   | push                ecx
            //   53                   | push                ebx

        $sequence_88 = { 7462 2bcb 0f84df000000 2bcb 0f844f010000 2bcb }
            // n = 6, score = 200
            //   7462                 | cmp                 esi, ebx
            //   2bcb                 | je                  0x26
            //   0f84df000000         | imul                esi, esi, 0x19660d
            //   2bcb                 | push                dword ptr [ebp - 0xc]
            //   0f844f010000         | add                 esi, 0x3c6ef35f
            //   2bcb                 | mov                 dword ptr [ebp + 0xc], esi

        $sequence_89 = { 884604 a1???????? 83c01e 50 ff15???????? }
            // n = 5, score = 200
            //   884604               | xor                 eax, eax
            //   a1????????           |                     
            //   83c01e               | mov                 edx, edi
            //   50                   | dec                 eax
            //   ff15????????         |                     

        $sequence_90 = { 57 ff742410 8b3d???????? ff742410 57 e8???????? }
            // n = 6, score = 100
            //   57                   | sub                 esp, 0x20
            //   ff742410             | dec                 esp
            //   8b3d????????         |                     
            //   ff742410             | mov                 eax, dword ptr [ecx + 8]
            //   57                   | dec                 eax
            //   e8????????           |                     

        $sequence_91 = { 0fb704451ac90310 8d844692810000 66ff00 8b4650 48 }
            // n = 5, score = 100
            //   0fb704451ac90310     | dec                 esp
            //   8d844692810000       | mov                 eax, dword ptr [ecx + 8]
            //   66ff00               | dec                 eax
            //   8b4650               | mov                 ebx, ecx
            //   48                   | dec                 ebp

        $sequence_92 = { 8907 0f8566010000 68???????? 33ff 47 57 56 }
            // n = 7, score = 100
            //   8907                 | test                eax, eax
            //   0f8566010000         | ret                 
            //   68????????           |                     
            //   33ff                 | inc                 eax
            //   47                   | push                ebx
            //   57                   | dec                 eax
            //   56                   | sub                 esp, 0x20

        $sequence_93 = { 33ff 57 50 8d45f8 50 8d45fc }
            // n = 6, score = 100
            //   33ff                 | sub                 esp, 0x20
            //   57                   | dec                 esp
            //   50                   | mov                 eax, dword ptr [ecx + 8]
            //   8d45f8               | dec                 eax
            //   50                   | mov                 ebx, ecx
            //   8d45fc               | jne                 0x2a

        $sequence_94 = { 50 8bc6 e8???????? 85c0 8945f8 0f85d3010000 ff7508 }
            // n = 7, score = 100
            //   50                   | pop                 edi
            //   8bc6                 | ret                 
            //   e8????????           |                     
            //   85c0                 | inc                 eax
            //   8945f8               | push                ebx
            //   0f85d3010000         | dec                 eax
            //   ff7508               | sub                 esp, 0x20

        $sequence_95 = { 8d41ff 85c0 7c10 3934850875be03 7403 }
            // n = 5, score = 100
            //   8d41ff               | dec                 esp
            //   85c0                 | mov                 eax, dword ptr [ecx + 8]
            //   7c10                 | dec                 eax
            //   3934850875be03       | mov                 ebx, ecx
            //   7403                 | pop                 edi

        $sequence_96 = { 8bd8 ffd7 3bde 7420 56 }
            // n = 5, score = 100
            //   8bd8                 | sub                 esp, 0x20
            //   ffd7                 | dec                 esp
            //   3bde                 | mov                 eax, dword ptr [ecx + 8]
            //   7420                 | ret                 
            //   56                   | inc                 eax

        $sequence_97 = { 895c243c e8???????? ff35???????? 8d442428 }
            // n = 4, score = 100
            //   895c243c             | push                ebx
            //   e8????????           |                     
            //   ff35????????         |                     
            //   8d442428             | dec                 eax

        $sequence_98 = { a3???????? 8b831c70be03 3305???????? 8b3d???????? 50 33f6 56 }
            // n = 7, score = 100
            //   a3????????           |                     
            //   8b831c70be03         | mov                 ebx, ecx
            //   3305????????         |                     
            //   8b3d????????         |                     
            //   50                   | dec                 ebp
            //   33f6                 | test                eax, eax
            //   56                   | je                  0x21

        $sequence_99 = { b3ea e42c d08b19ec3bc2 14e1 }
            // n = 4, score = 100
            //   b3ea                 | ret                 
            //   e42c                 | inc                 eax
            //   d08b19ec3bc2         | push                ebx
            //   14e1                 | dec                 eax

        $sequence_100 = { 74c5 3bf3 0f8581020000 a1???????? 53 e8???????? 85c0 }
            // n = 7, score = 100
            //   74c5                 | ret                 
            //   3bf3                 | inc                 eax
            //   0f8581020000         | push                ebx
            //   a1????????           |                     
            //   53                   | dec                 eax
            //   e8????????           |                     
            //   85c0                 | sub                 esp, 0x20

    condition:
        7 of them and filesize < 802816
}
Download all Yara Rules