Actor(s): Lazarus Group
There is no description at this point.
rule win_duuzer_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.duuzer." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duuzer" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 83f804 7408 83c8ff e9???????? } // n = 4, score = 200 // 83f804 | cmp eax, 4 // 7408 | je 0xa // 83c8ff | or eax, 0xffffffff // e9???????? | $sequence_1 = { 0145f0 1155f4 85c9 7533 } // n = 4, score = 100 // 0145f0 | cmp eax, -0x75 // 1155f4 | jne 0x175 // 85c9 | xor eax, eax // 7533 | dec esp $sequence_2 = { 4c89742408 4d8bf0 488bf2 4c8bd1 418d5c2410 4439a1f4160000 0f84ba030000 } // n = 7, score = 100 // 4c89742408 | mov ebx, esi // 4d8bf0 | inc edx // 488bf2 | lea eax, [esi + ebp] // 4c8bd1 | inc ecx // 418d5c2410 | mov eax, 0x10 // 4439a1f4160000 | dec esp // 0f84ba030000 | mov dword ptr [ebx + 0x60], esi $sequence_3 = { 4c89742430 4c8d85a0600000 4183c9ff 33d2 } // n = 4, score = 100 // 4c89742430 | dec eax // 4c8d85a0600000 | mov dword ptr [esp + 0x60], edi // 4183c9ff | nop // 33d2 | dec esp $sequence_4 = { 4c897360 48894358 eb03 498bde } // n = 4, score = 100 // 4c897360 | dec esp // 48894358 | mov dword ptr [ebx + 0x60], esi // eb03 | dec eax // 498bde | mov dword ptr [ebx + 0x58], eax $sequence_5 = { 014dec 83bf8400000000 7708 398780000000 } // n = 4, score = 100 // 014dec | ror dword ptr [edx - 0x75f877fa], 1 // 83bf8400000000 | inc esi // 7708 | add al, ah // 398780000000 | xor eax, 0x36040041 $sequence_6 = { 01442410 3bfb 75c4 8b4630 } // n = 4, score = 100 // 01442410 | mov dword ptr [esp + 0x28], edi // 3bfb | dec esp // 75c4 | mov dword ptr [esp + 0x30], esi // 8b4630 | dec esp $sequence_7 = { 4c89742428 41b116 488bca 448bc2 } // n = 4, score = 100 // 4c89742428 | dec eax // 41b116 | mov dword ptr [esp + 0x50], esi // 488bca | dec esp // 448bc2 | mov dword ptr [esp + 0x20], esi $sequence_8 = { 4c89742420 41be04000000 4d3be6 0f86dd000000 } // n = 4, score = 100 // 4c89742420 | dec eax // 41be04000000 | mov dword ptr [ebx + 0x58], eax // 4d3be6 | jmp 5 // 0f86dd000000 | dec ecx $sequence_9 = { 4c89742420 ff15???????? 8bf8 8d4801 } // n = 4, score = 100 // 4c89742420 | cmp dword ptr [ecx + 0x16f4], esp // ff15???????? | // 8bf8 | je 0x3d2 // 8d4801 | dec esp $sequence_10 = { 00f4 c640001c c740008a460323 d188470383ee } // n = 4, score = 100 // 00f4 | dec esp // c640001c | mov dword ptr [esp + 0x30], esi // c740008a460323 | dec esp // d188470383ee | lea eax, [ebp + 0x60a0] $sequence_11 = { 4c89742430 e8???????? 83f88b 0f856c010000 } // n = 4, score = 100 // 4c89742430 | dec esp // e8???????? | // 83f88b | mov dword ptr [esp + 0x28], esi // 0f856c010000 | inc ecx $sequence_12 = { 014dec 66837dec00 0f8efc010000 0fbf45ec } // n = 4, score = 100 // 014dec | dec esp // 66837dec00 | lea esp, [0x1ca24] // 0f8efc010000 | dec esp // 0fbf45ec | mov dword ptr [esp + 0x50], edi $sequence_13 = { 00e0 3541000436 41 0023 } // n = 4, score = 100 // 00e0 | dec esp // 3541000436 | mov dword ptr [esp + 0x30], esi // 41 | dec esp // 0023 | lea eax, [ebp + 0x60a0] $sequence_14 = { 010b 014e4c 014e48 014e54 } // n = 4, score = 100 // 010b | inc ecx // 014e4c | or ecx, 0xffffffff // 014e48 | xor edx, edx // 014e54 | xor ecx, ecx condition: 7 of them and filesize < 491520 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY