SYMBOLCOMMON_NAMEaka. SYNONYMS
win.dyepack (Back to overview)

DYEPACK

aka: swift

Actor(s): Lazarus Group


There is no description at this point.

References
2021-08-22media.ccc.deLars Wallenborn
@online{wallenborn:20210822:bangladesh:46f557f, author = {Lars Wallenborn}, title = {{The Bangladesh cyber bank robbery: Tracking down major criminals with malware analysis}}, date = {2021-08-22}, organization = {media.ccc.de}, url = {https://media.ccc.de/v/froscon2021-2670-der_cyber-bankraub_von_bangladesch}, language = {German}, urldate = {2021-09-10} } The Bangladesh cyber bank robbery: Tracking down major criminals with malware analysis
DYEPACK
2020-02-19LexfoLexfo
@techreport{lexfo:20200219:lazarus:f293c37, author = {Lexfo}, title = {{The Lazarus Constellation A study on North Korean malware}}, date = {2020-02-19}, institution = {Lexfo}, url = {https://blog.lexfo.fr/ressources/Lexfo-WhitePaper-The_Lazarus_Constellation.pdf}, language = {English}, urldate = {2020-03-11} } The Lazarus Constellation A study on North Korean malware
FastCash AppleJeus BADCALL Bankshot Brambul Dtrack Duuzer DYEPACK ELECTRICFISH HARDRAIN Hermes HOPLIGHT Joanap KEYMARBLE Kimsuky MimiKatz MyDoom NACHOCHEESE NavRAT PowerRatankba RokRAT Sierra(Alfa,Bravo, ...) Volgmer WannaCryptor
2019-03-20Github (649)@037
@online{037:20190320:apt38:4c7f1d4, author = {@037}, title = {{APT38 DYEPACK FRAMEWORK}}, date = {2019-03-20}, organization = {Github (649)}, url = {https://github.com/649/APT38-DYEPACK}, language = {English}, urldate = {2019-12-17} } APT38 DYEPACK FRAMEWORK
DYEPACK
2018FireEyeFireEye
@online{fireeye:2018:apt38:20161b7, author = {FireEye}, title = {{APT38}}, date = {2018}, organization = {FireEye}, url = {https://content.fireeye.com/apt/rpt-apt38}, language = {English}, urldate = {2020-01-13} } APT38
Bitsran BLINDTOAD BOOTWRECK Contopee DarkComet DYEPACK HOTWAX NESTEGG PowerRatankba REDSHAWL WORMHOLE Lazarus Group
2017-04-03Kaspersky LabsGReAT
@online{great:20170403:lazarus:689432c, author = {GReAT}, title = {{Lazarus under the Hood}}, date = {2017-04-03}, organization = {Kaspersky Labs}, url = {https://securelist.com/blog/sas/77908/lazarus-under-the-hood/}, language = {English}, urldate = {2019-12-20} } Lazarus under the Hood
Alreay DYEPACK
Yara Rules
[TLP:WHITE] win_dyepack_auto (20220411 | Detects win.dyepack.)
rule win_dyepack_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-04-08"
        version = "1"
        description = "Detects win.dyepack."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyepack"
        malpedia_rule_date = "20220405"
        malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a"
        malpedia_version = "20220411"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 2bcd 1bc7 7815 7f08 }
            // n = 4, score = 300
            //   2bcd                 | sub                 ecx, ebp
            //   1bc7                 | sbb                 eax, edi
            //   7815                 | js                  0x17
            //   7f08                 | jg                  0xa

        $sequence_1 = { 03e8 8b442414 13fb 3bf8 }
            // n = 4, score = 300
            //   03e8                 | add                 ebp, eax
            //   8b442414             | mov                 eax, dword ptr [esp + 0x14]
            //   13fb                 | adc                 edi, ebx
            //   3bf8                 | cmp                 edi, eax

        $sequence_2 = { 53 6800000040 50 ff15???????? 8bf0 83feff 7510 }
            // n = 7, score = 300
            //   53                   | push                ebx
            //   6800000040           | push                0x40000000
            //   50                   | push                eax
            //   ff15????????         |                     
            //   8bf0                 | mov                 esi, eax
            //   83feff               | cmp                 esi, -1
            //   7510                 | jne                 0x12

        $sequence_3 = { 3bf8 7cb2 7f08 8b4c2410 }
            // n = 4, score = 300
            //   3bf8                 | cmp                 edi, eax
            //   7cb2                 | jl                  0xffffffb4
            //   7f08                 | jg                  0xa
            //   8b4c2410             | mov                 ecx, dword ptr [esp + 0x10]

        $sequence_4 = { ff15???????? 8d442410 895c2410 50 56 895c241c }
            // n = 6, score = 300
            //   ff15????????         |                     
            //   8d442410             | lea                 eax, dword ptr [esp + 0x10]
            //   895c2410             | mov                 dword ptr [esp + 0x10], ebx
            //   50                   | push                eax
            //   56                   | push                esi
            //   895c241c             | mov                 dword ptr [esp + 0x1c], ebx

        $sequence_5 = { aa 8b842434100000 53 6800000040 }
            // n = 4, score = 300
            //   aa                   | stosb               byte ptr es:[edi], al
            //   8b842434100000       | mov                 eax, dword ptr [esp + 0x1034]
            //   53                   | push                ebx
            //   6800000040           | push                0x40000000

        $sequence_6 = { 8b4c2410 33ed 33ff 3bc3 7c60 }
            // n = 5, score = 300
            //   8b4c2410             | mov                 ecx, dword ptr [esp + 0x10]
            //   33ed                 | xor                 ebp, ebp
            //   33ff                 | xor                 edi, edi
            //   3bc3                 | cmp                 eax, ebx
            //   7c60                 | jl                  0x62

        $sequence_7 = { 56 ff15???????? 56 ff15???????? 8d442410 895c2410 }
            // n = 6, score = 300
            //   56                   | push                esi
            //   ff15????????         |                     
            //   56                   | push                esi
            //   ff15????????         |                     
            //   8d442410             | lea                 eax, dword ptr [esp + 0x10]
            //   895c2410             | mov                 dword ptr [esp + 0x10], ebx

        $sequence_8 = { 85c0 741e 8b442418 3bc3 7416 03e8 8b442414 }
            // n = 7, score = 300
            //   85c0                 | test                eax, eax
            //   741e                 | je                  0x20
            //   8b442418             | mov                 eax, dword ptr [esp + 0x18]
            //   3bc3                 | cmp                 eax, ebx
            //   7416                 | je                  0x18
            //   03e8                 | add                 ebp, eax
            //   8b442414             | mov                 eax, dword ptr [esp + 0x14]

        $sequence_9 = { 8d7c2421 885c2420 f3ab 66ab 53 6880000000 }
            // n = 6, score = 300
            //   8d7c2421             | lea                 edi, dword ptr [esp + 0x21]
            //   885c2420             | mov                 byte ptr [esp + 0x20], bl
            //   f3ab                 | rep stosd           dword ptr es:[edi], eax
            //   66ab                 | stosw               word ptr es:[edi], ax
            //   53                   | push                ebx
            //   6880000000           | push                0x80

    condition:
        7 of them and filesize < 212992
}
Download all Yara Rules