Actor(s): WIZARD SPIDER
There is no description at this point.
rule win_dyre_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.dyre." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dyre" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 6814020000 e8???????? 59 c3 } // n = 4, score = 600 // 6814020000 | push 0x214 // e8???????? | // 59 | pop ecx // c3 | ret $sequence_1 = { e9???????? 68f4010000 ff15???????? 56 } // n = 4, score = 600 // e9???????? | // 68f4010000 | push 0x1f4 // ff15???????? | // 56 | push esi $sequence_2 = { 7244 6801010000 ff15???????? 8b4d18 663901 } // n = 5, score = 600 // 7244 | jb 0x46 // 6801010000 | push 0x101 // ff15???????? | // 8b4d18 | mov ecx, dword ptr [ebp + 0x18] // 663901 | cmp word ptr [ecx], ax $sequence_3 = { 7502 c9 c3 33c0 837dfc20 } // n = 5, score = 600 // 7502 | jne 4 // c9 | leave // c3 | ret // 33c0 | xor eax, eax // 837dfc20 | cmp dword ptr [ebp - 4], 0x20 $sequence_4 = { 0fb7c8 c1e110 e8???????? 0fb7c0 0bc1 c9 c3 } // n = 7, score = 600 // 0fb7c8 | movzx ecx, ax // c1e110 | shl ecx, 0x10 // e8???????? | // 0fb7c0 | movzx eax, ax // 0bc1 | or eax, ecx // c9 | leave // c3 | ret $sequence_5 = { 773d 0fbec0 83e857 8ada 2ad9 c1e004 80fb09 } // n = 7, score = 600 // 773d | ja 0x3f // 0fbec0 | movsx eax, al // 83e857 | sub eax, 0x57 // 8ada | mov bl, dl // 2ad9 | sub bl, cl // c1e004 | shl eax, 4 // 80fb09 | cmp bl, 9 $sequence_6 = { c1fa02 8b1496 83e103 c1e103 } // n = 4, score = 600 // c1fa02 | sar edx, 2 // 8b1496 | mov edx, dword ptr [esi + edx*4] // 83e103 | and ecx, 3 // c1e103 | shl ecx, 3 $sequence_7 = { 41 3bc8 7cf4 83f903 } // n = 4, score = 600 // 41 | inc ecx // 3bc8 | cmp ecx, eax // 7cf4 | jl 0xfffffff6 // 83f903 | cmp ecx, 3 $sequence_8 = { 57 4883ec20 4032ff 488bda 8bf1 4885d2 } // n = 6, score = 500 // 57 | xor edi, edi // 4883ec20 | dec eax // 4032ff | mov esi, edx // 488bda | dec ecx // 8bf1 | mov dword ptr [ebx - 0x28], eax // 4885d2 | dec ecx $sequence_9 = { 488bc8 ff15???????? 85c0 7455 4c8d442434 } // n = 5, score = 500 // 488bc8 | jne 0x32 // ff15???????? | // 85c0 | mov eax, dword ptr [esi + 4] // 7455 | cmp dword ptr [edi + 4], eax // 4c8d442434 | jne 0x32 $sequence_10 = { 488bcb e8???????? 4c8d5e01 41b8f7ffffff 6666660f1f840000000000 488bcf 418d4008 } // n = 7, score = 500 // 488bcb | lea eax, [ebx + 0x18] // e8???????? | // 4c8d5e01 | dec eax // 41b8f7ffffff | mov ebx, ecx // 6666660f1f840000000000 | dec eax // 488bcf | mov edx, ecx // 418d4008 | push edi $sequence_11 = { 4433c0 418bc5 23c6 33c8 418bc1 4403c1 } // n = 6, score = 500 // 4433c0 | cmp word ptr [edi], ax // 418bc5 | jne 0x32 // 23c6 | mov eax, dword ptr [esi + 4] // 33c8 | cmp dword ptr [edi + 4], eax // 418bc1 | dec eax // 4403c1 | mov ecx, ebx $sequence_12 = { 663907 7530 8b4604 394704 7528 8b4608 394708 } // n = 7, score = 500 // 663907 | dec eax // 7530 | sub esp, 0x20 // 8b4604 | inc eax // 394704 | xor bh, bh // 7528 | dec eax // 8b4608 | mov ebx, edx // 394708 | mov esi, ecx $sequence_13 = { 498d43e8 33ff 488bf2 498943d8 498d4318 488bd9 488bd1 } // n = 7, score = 500 // 498d43e8 | dec eax // 33ff | mov ecx, ebx // 488bf2 | test eax, eax // 498943d8 | jne 0x14 // 498d4318 | xor eax, eax // 488bd9 | dec ecx // 488bd1 | lea eax, [ebx - 0x18] $sequence_14 = { 440fb69c249f000000 0fb68c249d000000 0fb694249c000000 440fb694249b000000 } // n = 4, score = 500 // 440fb69c249f000000 | inc esp // 0fb68c249d000000 | movzx ebx, byte ptr [esp + 0x9f] // 0fb694249c000000 | movzx ecx, byte ptr [esp + 0x9d] // 440fb694249b000000 | movzx edx, byte ptr [esp + 0x9c] $sequence_15 = { 488bcb e8???????? 85c0 750d 33c0 488b5c2430 } // n = 6, score = 500 // 488bcb | inc esp // e8???????? | // 85c0 | movzx edx, byte ptr [esp + 0x9b] // 750d | dec eax // 33c0 | mov ecx, ebx // 488b5c2430 | test eax, eax condition: 7 of them and filesize < 590848 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY