SYMBOLCOMMON_NAMEaka. SYNONYMS
win.dyre (Back to overview)

Dyre

aka: Dyreza

Actor(s): WIZARD SPIDER

VTCollection    

There is no description at this point.

References
2021-01-01SecureworksSecureWorks
Threat Profile: GOLD BLACKBURN
Buer Dyre TrickBot WIZARD SPIDER
2020-10-26CheckpointEyal Itkin, Itay Cohen
Exploit Developer Spotlight: The Story of PlayBit
Dyre Maze PyLocky Ramnit REvil
2020-08-09F5 LabsDebbie Walkowski, Remi Cohen
Banking Trojans: A Reference Guide to the Malware Family Tree
BackSwap Carberp Citadel DanaBot Dridex Dyre Emotet Gozi Kronos PandaBanker Ramnit Shylock SpyEye Tinba TrickBot Vawtrak Zeus
2020-01-01SecureworksSecureWorks
GOLD BLACKBURN
Dyre TrickBot
2019-09-09McAfeeChintan Shah, Marc Rivero López, Thomas Roccia
Evolution of Malware Sandbox Evasion Tactics – A Retrospective Study
Cutwail Dridex Dyre Kovter Locky Phorpiex Simda
2019-02-15CrowdStrikeBex Hartley, Brendon Feeley
“Sin”-ful SPIDERS: WIZARD SPIDER and LUNAR SPIDER Sharing the Same Web
Dyre IcedID TrickBot Vawtrak LUNAR SPIDER WIZARD SPIDER
2017-05-15SecureworksCounter Threat Unit ResearchTeam
Evolution of the GOLD EVERGREEN Threat Group
CryptoLocker Dridex Dyre Gameover P2P Murofet TrickBot Zeus GOLD EVERGREEN
2017-05-04ForbesThomas Brewster
Behind The Mystery Of Russia's 'Dyre' Hackers Who Stole Millions From American Business
Dyre
2015-11-04Malwarebyteshasherezade
A Technical Look At Dyreza
Dyre
2015-10-26BluelivBlueliv
Chasing cybercrime: network insights of Dyre and Dridex Trojan bankers
Dridex Dyre
2015-07-07FireEyeSudeep Singh, Yu Wang
Dyre Banking Trojan Exploits CVE-2015-0057
Dyre
2014-12-17SecureworksBrett Stone-Gross, Pallav Khandhar
Dyre Banking Trojan
Dyre Vawtrak WIZARD SPIDER
Yara Rules
[TLP:WHITE] win_dyre_auto (20230808 | Detects win.dyre.)
rule win_dyre_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.dyre."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyre"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6814020000 e8???????? 59 c3 }
            // n = 4, score = 600
            //   6814020000           | push                0x214
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   c3                   | ret                 

        $sequence_1 = { e9???????? 68f4010000 ff15???????? 56 }
            // n = 4, score = 600
            //   e9????????           |                     
            //   68f4010000           | push                0x1f4
            //   ff15????????         |                     
            //   56                   | push                esi

        $sequence_2 = { 7244 6801010000 ff15???????? 8b4d18 663901 }
            // n = 5, score = 600
            //   7244                 | jb                  0x46
            //   6801010000           | push                0x101
            //   ff15????????         |                     
            //   8b4d18               | mov                 ecx, dword ptr [ebp + 0x18]
            //   663901               | cmp                 word ptr [ecx], ax

        $sequence_3 = { 7502 c9 c3 33c0 837dfc20 }
            // n = 5, score = 600
            //   7502                 | jne                 4
            //   c9                   | leave               
            //   c3                   | ret                 
            //   33c0                 | xor                 eax, eax
            //   837dfc20             | cmp                 dword ptr [ebp - 4], 0x20

        $sequence_4 = { 0fb7c8 c1e110 e8???????? 0fb7c0 0bc1 c9 c3 }
            // n = 7, score = 600
            //   0fb7c8               | movzx               ecx, ax
            //   c1e110               | shl                 ecx, 0x10
            //   e8????????           |                     
            //   0fb7c0               | movzx               eax, ax
            //   0bc1                 | or                  eax, ecx
            //   c9                   | leave               
            //   c3                   | ret                 

        $sequence_5 = { 773d 0fbec0 83e857 8ada 2ad9 c1e004 80fb09 }
            // n = 7, score = 600
            //   773d                 | ja                  0x3f
            //   0fbec0               | movsx               eax, al
            //   83e857               | sub                 eax, 0x57
            //   8ada                 | mov                 bl, dl
            //   2ad9                 | sub                 bl, cl
            //   c1e004               | shl                 eax, 4
            //   80fb09               | cmp                 bl, 9

        $sequence_6 = { c1fa02 8b1496 83e103 c1e103 }
            // n = 4, score = 600
            //   c1fa02               | sar                 edx, 2
            //   8b1496               | mov                 edx, dword ptr [esi + edx*4]
            //   83e103               | and                 ecx, 3
            //   c1e103               | shl                 ecx, 3

        $sequence_7 = { 41 3bc8 7cf4 83f903 }
            // n = 4, score = 600
            //   41                   | inc                 ecx
            //   3bc8                 | cmp                 ecx, eax
            //   7cf4                 | jl                  0xfffffff6
            //   83f903               | cmp                 ecx, 3

        $sequence_8 = { 57 4883ec20 4032ff 488bda 8bf1 4885d2 }
            // n = 6, score = 500
            //   57                   | xor                 edi, edi
            //   4883ec20             | dec                 eax
            //   4032ff               | mov                 esi, edx
            //   488bda               | dec                 ecx
            //   8bf1                 | mov                 dword ptr [ebx - 0x28], eax
            //   4885d2               | dec                 ecx

        $sequence_9 = { 488bc8 ff15???????? 85c0 7455 4c8d442434 }
            // n = 5, score = 500
            //   488bc8               | jne                 0x32
            //   ff15????????         |                     
            //   85c0                 | mov                 eax, dword ptr [esi + 4]
            //   7455                 | cmp                 dword ptr [edi + 4], eax
            //   4c8d442434           | jne                 0x32

        $sequence_10 = { 488bcb e8???????? 4c8d5e01 41b8f7ffffff 6666660f1f840000000000 488bcf 418d4008 }
            // n = 7, score = 500
            //   488bcb               | lea                 eax, [ebx + 0x18]
            //   e8????????           |                     
            //   4c8d5e01             | dec                 eax
            //   41b8f7ffffff         | mov                 ebx, ecx
            //   6666660f1f840000000000     | dec    eax
            //   488bcf               | mov                 edx, ecx
            //   418d4008             | push                edi

        $sequence_11 = { 4433c0 418bc5 23c6 33c8 418bc1 4403c1 }
            // n = 6, score = 500
            //   4433c0               | cmp                 word ptr [edi], ax
            //   418bc5               | jne                 0x32
            //   23c6                 | mov                 eax, dword ptr [esi + 4]
            //   33c8                 | cmp                 dword ptr [edi + 4], eax
            //   418bc1               | dec                 eax
            //   4403c1               | mov                 ecx, ebx

        $sequence_12 = { 663907 7530 8b4604 394704 7528 8b4608 394708 }
            // n = 7, score = 500
            //   663907               | dec                 eax
            //   7530                 | sub                 esp, 0x20
            //   8b4604               | inc                 eax
            //   394704               | xor                 bh, bh
            //   7528                 | dec                 eax
            //   8b4608               | mov                 ebx, edx
            //   394708               | mov                 esi, ecx

        $sequence_13 = { 498d43e8 33ff 488bf2 498943d8 498d4318 488bd9 488bd1 }
            // n = 7, score = 500
            //   498d43e8             | dec                 eax
            //   33ff                 | mov                 ecx, ebx
            //   488bf2               | test                eax, eax
            //   498943d8             | jne                 0x14
            //   498d4318             | xor                 eax, eax
            //   488bd9               | dec                 ecx
            //   488bd1               | lea                 eax, [ebx - 0x18]

        $sequence_14 = { 440fb69c249f000000 0fb68c249d000000 0fb694249c000000 440fb694249b000000 }
            // n = 4, score = 500
            //   440fb69c249f000000     | inc    esp
            //   0fb68c249d000000     | movzx               ebx, byte ptr [esp + 0x9f]
            //   0fb694249c000000     | movzx               ecx, byte ptr [esp + 0x9d]
            //   440fb694249b000000     | movzx    edx, byte ptr [esp + 0x9c]

        $sequence_15 = { 488bcb e8???????? 85c0 750d 33c0 488b5c2430 }
            // n = 6, score = 500
            //   488bcb               | inc                 esp
            //   e8????????           |                     
            //   85c0                 | movzx               edx, byte ptr [esp + 0x9b]
            //   750d                 | dec                 eax
            //   33c0                 | mov                 ecx, ebx
            //   488b5c2430           | test                eax, eax

    condition:
        7 of them and filesize < 590848
}
Download all Yara Rules