SYMBOLCOMMON_NAMEaka. SYNONYMS
win.emotet (Back to overview)

Emotet

aka: Geodo, Heodo

Actor(s): MUMMY SPIDER, Mealybug

URLhaus                                  

While Emotet historically was a banking malware organized in a botnet, nowadays Emotet is mostly seen as infrastructure as a service for content delivery. For example, since mid 2018 it is used by Trickbot for installs, which may also lead to ransomware attacks using Ryuk, a combination observed several times against high-profile targets.
It is always stealing information from victims but what the criminal gang behind it did, was to open up another business channel by selling their infrastructure delivering additional malicious software. From malware analysts it has been classified into epochs depending on command and control, payloads, and delivery solutions which change over time.

References
2020-06-18NTT SecuritySecurity division of NTT Ltd.
@online{ltd:20200618:behind:a5e168d, author = {Security division of NTT Ltd.}, title = {{Behind the scenes of the Emotet Infrastructure}}, date = {2020-06-18}, organization = {NTT Security}, url = {https://hello.global.ntt/en-us/insights/blog/behind-the-scenes-of-the-emotet-infrastructure}, language = {English}, urldate = {2020-06-20} } Behind the scenes of the Emotet Infrastructure
Emotet
2020-06-12ThreatConnectThreatConnect Research Team
@online{team:20200612:probable:89a5bed, author = {ThreatConnect Research Team}, title = {{Probable Sandworm Infrastructure}}, date = {2020-06-12}, organization = {ThreatConnect}, url = {https://threatconnect.com/blog/threatconnect-research-roundup-probable-sandworm-infrastructure}, language = {English}, urldate = {2020-06-16} } Probable Sandworm Infrastructure
Avaddon Ransomware Emotet Kimsuky
2020-05-28VMWare Carbon BlackTom Kellermann, Ryan Murphy
@techreport{kellermann:20200528:modern:8155ea4, author = {Tom Kellermann and Ryan Murphy}, title = {{Modern Bank Heists 3.0}}, date = {2020-05-28}, institution = {VMWare Carbon Black}, url = {https://cdn.www.carbonblack.com/wp-content/uploads/2020/05/VMWCB-Report-Modern-Bank-Heists-2020.pdf}, language = {English}, urldate = {2020-05-29} } Modern Bank Heists 3.0
Emotet
2020-05-21PICUS SecuritySüleyman Özarslan
@online{zarslan:20200521:t1055:4400f98, author = {Süleyman Özarslan}, title = {{T1055 Process Injection}}, date = {2020-05-21}, organization = {PICUS Security}, url = {https://www.picussecurity.com/blog/picus-10-critical-mitre-attck-techniques-t1055-process-injection}, language = {English}, urldate = {2020-06-03} } T1055 Process Injection
BlackEnergy Cardinal RAT Downdelph Emotet Kazuar RokRAT SOUNDBITE
2020-05-05HornetsecuritySecurity Lab
@online{lab:20200505:awaiting:513382e, author = {Security Lab}, title = {{Awaiting the Inevitable Return of Emotet}}, date = {2020-05-05}, organization = {Hornetsecurity}, url = {https://www.hornetsecurity.com/en/security-information/awaiting-the-inevitable-return-of-emotet/}, language = {English}, urldate = {2020-05-05} } Awaiting the Inevitable Return of Emotet
Emotet
2020-04-22Youtube (Infosec Alpha)Raashid Bhat
@online{bhat:20200422:flattenthecurve:0bdf5a3, author = {Raashid Bhat}, title = {{FlattenTheCurve - Emotet Control Flow Unflattening | Episode 2}}, date = {2020-04-22}, organization = {Youtube (Infosec Alpha)}, url = {https://www.youtube.com/watch?v=8PHCZdpNKrw}, language = {English}, urldate = {2020-04-23} } FlattenTheCurve - Emotet Control Flow Unflattening | Episode 2
Emotet
2020-04-14Intel 471Intel 471
@online{471:20200414:understanding:ca95961, author = {Intel 471}, title = {{Understanding the relationship between Emotet, Ryuk and TrickBot}}, date = {2020-04-14}, organization = {Intel 471}, url = {https://blog.intel471.com/2020/04/14/understanding-the-relationship-between-emotet-ryuk-and-trickbot/}, language = {English}, urldate = {2020-04-26} } Understanding the relationship between Emotet, Ryuk and TrickBot
Emotet Ryuk TrickBot
2020-04-03Bleeping ComputerSergiu Gatlan
@online{gatlan:20200403:microsoft:c12a844, author = {Sergiu Gatlan}, title = {{Microsoft: Emotet Took Down a Network by Overheating All Computers}}, date = {2020-04-03}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/microsoft-emotet-took-down-a-network-by-overheating-all-computers/}, language = {English}, urldate = {2020-04-08} } Microsoft: Emotet Took Down a Network by Overheating All Computers
Emotet
2020-03-31Youtube (Infosec Alpha)Raashid Bhat
@online{bhat:20200331:emotet:50264e0, author = {Raashid Bhat}, title = {{Emotet Binary Deobfuscation | Coconut Paradise | Episode 1}}, date = {2020-03-31}, organization = {Youtube (Infosec Alpha)}, url = {https://www.youtube.com/watch?v=_mGMJFNJWSk}, language = {English}, urldate = {2020-04-23} } Emotet Binary Deobfuscation | Coconut Paradise | Episode 1
Emotet
2020-03-30IntezerMichael Kajiloti
@online{kajiloti:20200330:fantastic:c01db60, author = {Michael Kajiloti}, title = {{Fantastic payloads and where we find them}}, date = {2020-03-30}, organization = {Intezer}, url = {https://intezer.com/blog/intezer-analyze/fantastic-payloads-and-where-we-find-them}, language = {English}, urldate = {2020-04-07} } Fantastic payloads and where we find them
Dridex Emotet ISFB TrickBot
2020-03-30SymantecNguyen Hoang Giang, Mingwei Zhang
@online{giang:20200330:emotet:6034d14, author = {Nguyen Hoang Giang and Mingwei Zhang}, title = {{Emotet: Dangerous Malware Keeps on Evolving}}, date = {2020-03-30}, organization = {Symantec}, url = {https://medium.com/threat-intel/emotet-dangerous-malware-keeps-on-evolving-ac84aadbb8de}, language = {English}, urldate = {2020-04-01} } Emotet: Dangerous Malware Keeps on Evolving
Emotet
2020-03-12Digital ShadowsAlex Guirakhoo
@online{guirakhoo:20200312:how:cf2276f, author = {Alex Guirakhoo}, title = {{How cybercriminals are taking advantage of COVID-19: Scams, fraud, and misinformation}}, date = {2020-03-12}, organization = {Digital Shadows}, url = {https://www.digitalshadows.com/blog-and-research/how-cybercriminals-are-taking-advantage-of-covid-19-scams-fraud-misinformation/}, language = {English}, urldate = {2020-03-19} } How cybercriminals are taking advantage of COVID-19: Scams, fraud, and misinformation
Emotet
2020-03-11Twitter (@raashidbhatt)Raashid Bhat
@online{bhat:20200311:emotet:c178008, author = {Raashid Bhat}, title = {{Tweet on Emotet Deobfuscation with Video}}, date = {2020-03-11}, organization = {Twitter (@raashidbhatt)}, url = {https://twitter.com/raashidbhatt/status/1237853549200936960}, language = {English}, urldate = {2020-03-13} } Tweet on Emotet Deobfuscation with Video
Emotet
2020-03-06TelekomThomas Barabosch
@online{barabosch:20200306:dissecting:809bc54, author = {Thomas Barabosch}, title = {{Dissecting Emotet - Part 2}}, date = {2020-03-06}, organization = {Telekom}, url = {https://www.telekom.com/en/blog/group/article/cybersecurity-dissecting-emotet-part-two-596128}, language = {English}, urldate = {2020-03-09} } Dissecting Emotet - Part 2
Emotet
2020-03-06Binary DefenseJames Quinn
@online{quinn:20200306:emotet:e93ab0b, author = {James Quinn}, title = {{Emotet Wi-Fi Spreader Upgraded}}, date = {2020-03-06}, organization = {Binary Defense}, url = {https://www.binarydefense.com/emotet-wi-fi-spreader-upgraded/}, language = {English}, urldate = {2020-03-09} } Emotet Wi-Fi Spreader Upgraded
Emotet
2020-03-04CrowdStrikeCrowdStrike
@techreport{crowdstrike:20200304:2020:818c85f, author = {CrowdStrike}, title = {{2020 CrowdStrike Global Threat Report}}, date = {2020-03-04}, institution = {CrowdStrike}, url = {https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf}, language = {English}, urldate = {2020-03-04} } 2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze Necurs Nokki Outlook Backdoor Phobos Ransomware Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot vidar Winnti ANTHROPOID SPIDER Anunak APT39 BlackTech BuhTrap Charming Kitten CLOCKWORD SPIDER DOPPEL SPIDER Gamaredon Group Judgment Panda Leviathan MONTY SPIDER Mustang Panda NARWHAL SPIDER NOCTURNAL SPIDER Pinchy Spider Pirate Panda Salty Spider SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER
2020-03-03PWC UKPWC UK
@techreport{uk:20200303:cyber:1f1eef0, author = {PWC UK}, title = {{Cyber Threats 2019:A Year in Retrospect}}, date = {2020-03-03}, institution = {PWC UK}, url = {https://www.pwc.co.uk/cyber-security/assets/cyber-threats-2019-retrospect.pdf}, language = {English}, urldate = {2020-03-03} } Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare
2020-03-02c'tChristian Wölbert
@online{wlbert:20200302:was:1b9cc93, author = {Christian Wölbert}, title = {{Was Emotet anrichtet – und welche Lehren die Opfer daraus ziehen}}, date = {2020-03-02}, organization = {c't}, url = {https://www.heise.de/ct/artikel/Was-Emotet-anrichtet-und-welche-Lehren-die-Opfer-daraus-ziehen-4665958.html}, language = {German}, urldate = {2020-03-02} } Was Emotet anrichtet – und welche Lehren die Opfer daraus ziehen
Emotet Ryuk
2020-02-29ZDNetCatalin Cimpanu
@online{cimpanu:20200229:meet:b1d7dbd, author = {Catalin Cimpanu}, title = {{Meet the white-hat group fighting Emotet, the world's most dangerous malware}}, date = {2020-02-29}, organization = {ZDNet}, url = {https://www.zdnet.com/article/meet-the-white-hat-group-fighting-emotet-the-worlds-most-dangerous-malware/}, language = {English}, urldate = {2020-03-02} } Meet the white-hat group fighting Emotet, the world's most dangerous malware
Emotet
2020-02-18CERT.PLMichał Praszmo
@online{praszmo:20200218:whats:2790998, author = {Michał Praszmo}, title = {{What’s up Emotet?}}, date = {2020-02-18}, organization = {CERT.PL}, url = {https://www.cert.pl/en/news/single/whats-up-emotet/}, language = {English}, urldate = {2020-02-18} } What’s up Emotet?
Emotet
2020-02-13TalosNick Biasini, Edmund Brumaghin
@online{biasini:20200213:threat:443d687, author = {Nick Biasini and Edmund Brumaghin}, title = {{Threat actors attempt to capitalize on coronavirus outbreak}}, date = {2020-02-13}, organization = {Talos}, url = {https://blog.talosintelligence.com/2020/02/coronavirus-themed-malware.html}, language = {English}, urldate = {2020-03-19} } Threat actors attempt to capitalize on coronavirus outbreak
Emotet Nanocore RAT Parallax RAT
2020-02-10MalwarebytesAdam Kujawa, Wendy Zamora, Jérôme Segura, Thomas Reed, Nathan Collier, Jovi Umawing, Chris Boyd, Pieter Arntz, David Ruiz
@techreport{kujawa:20200210:2020:3fdaf12, author = {Adam Kujawa and Wendy Zamora and Jérôme Segura and Thomas Reed and Nathan Collier and Jovi Umawing and Chris Boyd and Pieter Arntz and David Ruiz}, title = {{2020 State of Malware Report}}, date = {2020-02-10}, institution = {Malwarebytes}, url = {https://resources.malwarebytes.com/files/2020/02/2020_State-of-Malware-Report.pdf}, language = {English}, urldate = {2020-02-13} } 2020 State of Malware Report
magecart Emotet QakBot REvil Ryuk TrickBot WannaCryptor
2020-02-08PICUS SecuritySüleyman Özarslan
@online{zarslan:20200208:emotet:1fac6a4, author = {Süleyman Özarslan}, title = {{Emotet Technical Analysis - Part 2 PowerShell Unveiled}}, date = {2020-02-08}, organization = {PICUS Security}, url = {https://www.picussecurity.com/blog/emotet-technical-analysis-part-2-powershell-unveiled}, language = {English}, urldate = {2020-06-03} } Emotet Technical Analysis - Part 2 PowerShell Unveiled
Emotet
2020-02-07Binary DefenseJames Quinn
@online{quinn:20200207:emotet:07de43a, author = {James Quinn}, title = {{Emotet Evolves With New Wi-Fi Spreader}}, date = {2020-02-07}, organization = {Binary Defense}, url = {https://www.binarydefense.com/emotet-evolves-with-new-wi-fi-spreader/}, language = {English}, urldate = {2020-02-09} } Emotet Evolves With New Wi-Fi Spreader
Emotet
2020-02-03TelekomThomas Barabosch
@online{barabosch:20200203:dissecting:c1a6bca, author = {Thomas Barabosch}, title = {{Dissecting Emotet – Part 1}}, date = {2020-02-03}, organization = {Telekom}, url = {https://www.telekom.com/en/blog/group/article/cybersecurity-dissecting-emotet-part-one-592612}, language = {English}, urldate = {2020-02-07} } Dissecting Emotet – Part 1
Emotet
2020-01-30IBM X-Force ExchangeAshkan Vila, Golo Mühr
@online{vila:20200130:coronavirus:f0121b9, author = {Ashkan Vila and Golo Mühr}, title = {{Coronavirus Goes Cyber With Emotet}}, date = {2020-01-30}, organization = {IBM X-Force Exchange}, url = {https://exchange.xforce.ibmcloud.com/collection/18f373debc38779065a26f1958dc260b}, language = {English}, urldate = {2020-02-03} } Coronavirus Goes Cyber With Emotet
Emotet
2020-01-30PICUS SecuritySüleyman Özarslan
@online{zarslan:20200130:emotet:1d5ef78, author = {Süleyman Özarslan}, title = {{Emotet Technical Analysis - Part 1 Reveal the Evil Code}}, date = {2020-01-30}, organization = {PICUS Security}, url = {https://www.picussecurity.com/blog/emotet-technical-analysis-part-1-reveal-the-evil-code}, language = {English}, urldate = {2020-06-03} } Emotet Technical Analysis - Part 1 Reveal the Evil Code
Emotet
2020-01-27T-SystemsT-Systems
@techreport{tsystems:20200127:vorlufiger:39dc989, author = {T-Systems}, title = {{Vorläufiger forensischer Abschlussbericht zur Untersuchung des Incidents beim Berliner Kammergericht}}, date = {2020-01-27}, institution = {T-Systems}, url = {https://www.berlin.de/sen/justva/presse/pressemitteilungen/2020/pm-11-2020-t-systems-forensik_bericht_public_v1.pdf}, language = {German}, urldate = {2020-01-28} } Vorläufiger forensischer Abschlussbericht zur Untersuchung des Incidents beim Berliner Kammergericht
Emotet TrickBot
2020-01-17JPCERT/CCTakayoshi Shiigi
@techreport{shiigi:20200117:looking:bf71db1, author = {Takayoshi Shiigi}, title = {{Looking back on the incidents in 2019}}, date = {2020-01-17}, institution = {JPCERT/CC}, url = {https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_0_JPCERT_en.pdf}, language = {English}, urldate = {2020-04-06} } Looking back on the incidents in 2019
TSCookie NodeRAT Emotet PoshC2 Quasar RAT
2020-01-17Hiroaki Ogawa, Manabu Niseki
@techreport{ogawa:20200117:100:035a7dd, author = {Hiroaki Ogawa and Manabu Niseki}, title = {{100 more behind cockroaches?}}, date = {2020-01-17}, institution = {}, url = {https://jsac.jpcert.or.jp/archive/2020/pdf/JSAC2020_4_ogawa-niseki_en.pdf}, language = {English}, urldate = {2020-01-17} } 100 more behind cockroaches?
MoqHao Emotet Predator The Thief
2020-01-14Bleeping ComputerLawrence Abrams
@online{abrams:20200114:united:a309baa, author = {Lawrence Abrams}, title = {{United Nations Targeted With Emotet Malware Phishing Attack}}, date = {2020-01-14}, organization = {Bleeping Computer}, url = {https://www.bleepingcomputer.com/news/security/united-nations-targeted-with-emotet-malware-phishing-attack/}, language = {English}, urldate = {2020-01-20} } United Nations Targeted With Emotet Malware Phishing Attack
Emotet
2020-01-13GigamonWilliam Peteroy, Ed Miles
@online{peteroy:20200113:emotet:60abae1, author = {William Peteroy and Ed Miles}, title = {{Emotet: Not your Run-of-the-mill Malware}}, date = {2020-01-13}, organization = {Gigamon}, url = {https://atr-blog.gigamon.com/2020/01/13/emotet-not-your-run-of-the-mill-malware/}, language = {English}, urldate = {2020-01-17} } Emotet: Not your Run-of-the-mill Malware
Emotet
2020-01-10CSISCSIS
@techreport{csis:20200110:threat:7454f36, author = {CSIS}, title = {{Threat Matrix H1 2019}}, date = {2020-01-10}, institution = {CSIS}, url = {https://gallery.mailchimp.com/c35aef82661dad887b8162a4f/files/e24e8206-a157-4796-a8cb-2b7262cc76e8/CSIS_Threat_Matrix_H1_2019.pdf}, language = {English}, urldate = {2020-01-22} } Threat Matrix H1 2019
Gustuff magecart Emotet Gandcrab Ramnit TrickBot
2020-01-07Hatching.ioTeam
@online{team:20200107:powershell:fb8264e, author = {Team}, title = {{Powershell Static Analysis & Emotet results}}, date = {2020-01-07}, organization = {Hatching.io}, url = {https://hatching.io/blog/powershell-analysis}, language = {English}, urldate = {2020-01-12} } Powershell Static Analysis & Emotet results
Emotet
2020SecureworksSecureWorks
@online{secureworks:2020:gold:9b89cea, author = {SecureWorks}, title = {{GOLD CRESTWOOD}}, date = {2020}, organization = {Secureworks}, url = {https://www.secureworks.com/research/threat-profiles/gold-crestwood}, language = {English}, urldate = {2020-05-23} } GOLD CRESTWOOD
Emotet MUMMY SPIDER
2019-12-12FireEyeChi-en Shen, Oleg Bondarenko
@online{shen:20191212:cyber:e01baca, author = {Chi-en Shen and Oleg Bondarenko}, title = {{Cyber Threat Landscape in Japan – Revealing Threat in the Shadow}}, date = {2019-12-12}, organization = {FireEye}, url = {https://www.slideshare.net/codeblue_jp/cb19-cyber-threat-landscape-in-japan-revealing-threat-in-the-shadow-by-chi-en-shen-ashley-oleg-bondarenko}, language = {English}, urldate = {2020-04-16} } Cyber Threat Landscape in Japan – Revealing Threat in the Shadow
Cerberus TSCookie Cobalt Strike Dtrack Emotet Formbook IcedID Icefog IRONHALO Loki Password Stealer (PWS) PandaBanker PLEAD poisonplug TrickBot BlackTech
2019-12-10JPCERT/CCJPCERT/CC
@online{jpcertcc:20191210:updated:86aee30, author = {JPCERT/CC}, title = {{[Updated] Alert Regarding Emotet Malware Infection}}, date = {2019-12-10}, organization = {JPCERT/CC}, url = {https://www.jpcert.or.jp/english/at/2019/at190044.html}, language = {English}, urldate = {2020-01-09} } [Updated] Alert Regarding Emotet Malware Infection
Emotet
2019-12-04JPCERT/CCKen Sajo
@online{sajo:20191204:how:60225fe, author = {Ken Sajo}, title = {{How to Respond to Emotet Infection (FAQ)}}, date = {2019-12-04}, organization = {JPCERT/CC}, url = {https://blogs.jpcert.or.jp/en/2019/12/emotetfaq.html}, language = {English}, urldate = {2020-01-13} } How to Respond to Emotet Infection (FAQ)
Emotet
2019-11-06Heise SecurityThomas Hungenberg
@online{hungenberg:20191106:emotet:1605954, author = {Thomas Hungenberg}, title = {{Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail}}, date = {2019-11-06}, organization = {Heise Security}, url = {https://www.heise.de/security/artikel/Emotet-Trickbot-Ryuk-ein-explosiver-Malware-Cocktail-4573848.html}, language = {German}, urldate = {2020-01-06} } Emotet, Trickbot, Ryuk – ein explosiver Malware-Cocktail
Emotet Ryuk TrickBot
2019-10-30ZscalerAtinderpal Singh, Abhay Yadav
@online{singh:20191030:emotet:61821fe, author = {Atinderpal Singh and Abhay Yadav}, title = {{Emotet is back in action after a short break}}, date = {2019-10-30}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/research/emotet-back-action-after-short-break}, language = {English}, urldate = {2020-07-01} } Emotet is back in action after a short break
Emotet
2019-10-14Marco Ramilli
@online{ramilli:20191014:is:de28de6, author = {Marco Ramilli}, title = {{Is Emotet gang targeting companies with external SOC?}}, date = {2019-10-14}, url = {https://marcoramilli.com/2019/10/14/is-emotet-gang-targeting-companies-with-external-soc/}, language = {English}, urldate = {2019-12-20} } Is Emotet gang targeting companies with external SOC?
Emotet
2019-09-24Dissecting MalwareMarius Genheimer
@online{genheimer:20190924:return:f85ef19, author = {Marius Genheimer}, title = {{Return of the Mummy - Welcome back, Emotet}}, date = {2019-09-24}, organization = {Dissecting Malware}, url = {https://dissectingmalwa.re/return-of-the-mummy-welcome-back-emotet.html}, language = {English}, urldate = {2020-03-27} } Return of the Mummy - Welcome back, Emotet
Emotet
2019-09-16MalwarebytesThreat Intelligence Team
@online{team:20190916:emotet:9c6c8f3, author = {Threat Intelligence Team}, title = {{Emotet is back: botnet springs back to life with new spam campaign}}, date = {2019-09-16}, organization = {Malwarebytes}, url = {https://blog.malwarebytes.com/botnets/2019/09/emotet-is-back-botnet-springs-back-to-life-with-new-spam-campaign/}, language = {English}, urldate = {2019-12-20} } Emotet is back: botnet springs back to life with new spam campaign
Emotet
2019-08-13AdalogicsDavid Korczynski
@online{korczynski:20190813:state:a4ad074, author = {David Korczynski}, title = {{The state of advanced code injections}}, date = {2019-08-13}, organization = {Adalogics}, url = {https://adalogics.com/blog/the-state-of-advanced-code-injections}, language = {English}, urldate = {2020-01-13} } The state of advanced code injections
Dridex Emotet Tinba
2019-08-12Schweizerische EidgenossenschaftSchweizerische Eidgenossenschaft
@online{eidgenossenschaft:20190812:trojaner:60574cc, author = {Schweizerische Eidgenossenschaft}, title = {{Trojaner Emotet greift Unternehmensnetzwerke an}}, date = {2019-08-12}, organization = {Schweizerische Eidgenossenschaft}, url = {https://www.melani.admin.ch/melani/de/home/dokumentation/newsletter/Trojaner_Emotet_greift_Unternehmensnetzwerke_an.html}, language = {German}, urldate = {2020-01-08} } Trojaner Emotet greift Unternehmensnetzwerke an
Emotet
2019-06-06FortinetKai Lu
@online{lu:20190606:deep:0ac679a, author = {Kai Lu}, title = {{A Deep Dive into the Emotet Malware}}, date = {2019-06-06}, organization = {Fortinet}, url = {https://www.fortinet.com/blog/threat-research/deep-dive-into-emotet-malware.html}, language = {English}, urldate = {2020-01-07} } A Deep Dive into the Emotet Malware
Emotet
2019-05-15ProofpointAxel F, Proofpoint Threat Insight Team
@online{f:20190515:threat:06b415a, author = {Axel F and Proofpoint Threat Insight Team}, title = {{Threat Actor Profile: TA542, From Banker to Malware Distribution Service}}, date = {2019-05-15}, organization = {Proofpoint}, url = {https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta542-banker-malware-distribution-service}, language = {English}, urldate = {2019-12-20} } Threat Actor Profile: TA542, From Banker to Malware Distribution Service
Emotet MUMMY SPIDER
2019-05-09GovCERT.chGovCERT.ch
@online{govcertch:20190509:severe:2767782, author = {GovCERT.ch}, title = {{Severe Ransomware Attacks Against Swiss SMEs}}, date = {2019-05-09}, organization = {GovCERT.ch}, url = {https://www.govcert.admin.ch/blog/36/severe-ransomware-attacks-against-swiss-smes}, language = {English}, urldate = {2019-07-11} } Severe Ransomware Attacks Against Swiss SMEs
Emotet LockerGoga Ryuk TrickBot
2019-04-29BluelivBlueliv Labs Team
@online{team:20190429:where:8c3db39, author = {Blueliv Labs Team}, title = {{Where is Emotet? Latest geolocation data}}, date = {2019-04-29}, organization = {Blueliv}, url = {https://www.blueliv.com/blog/research/where-is-emotet-latest-geolocation-data/}, language = {English}, urldate = {2020-01-08} } Where is Emotet? Latest geolocation data
Emotet
2019-04-25Trend MicroTrendmicro
@online{trendmicro:20190425:emotet:04884ca, author = {Trendmicro}, title = {{Emotet Adds New Evasion Technique}}, date = {2019-04-25}, organization = {Trend Micro}, url = {https://blog.trendmicro.com/trendlabs-security-intelligence/emotet-adds-new-evasion-technique-and-uses-connected-devices-as-proxy-cc-servers/}, language = {English}, urldate = {2019-11-26} } Emotet Adds New Evasion Technique
Emotet
2019-04-22int 0xcc blogRaashid Bhat
@online{bhat:20190422:dissecting:ffba987, author = {Raashid Bhat}, title = {{Dissecting Emotet’s network communication protocol}}, date = {2019-04-22}, organization = {int 0xcc blog}, url = {https://int0xcc.svbtle.com/dissecting-emotet-s-network-communication-protocol}, language = {English}, urldate = {2020-01-06} } Dissecting Emotet’s network communication protocol
Emotet
2019-04-12SpamTitantitanadmin
@online{titanadmin:20190412:emotet:12ca0e7, author = {titanadmin}, title = {{Emotet Malware Revives Old Email Conversations Threads to Increase Infection Rates}}, date = {2019-04-12}, organization = {SpamTitan}, url = {https://www.spamtitan.com/blog/emotet-malware-revives-old-email-conversations-threads-to-increase-infection-rates/}, language = {English}, urldate = {2020-01-09} } Emotet Malware Revives Old Email Conversations Threads to Increase Infection Rates
Emotet
2019-04-07Sveatoslav Persianov
@online{persianov:20190407:emotet:0aeaa67, author = {Sveatoslav Persianov}, title = {{Emotet malware analysis. Part 2}}, date = {2019-04-07}, url = {https://persianov.net/emotet-malware-analysis-part-2}, language = {English}, urldate = {2020-01-05} } Emotet malware analysis. Part 2
Emotet
2019-04Cafe Babe
@online{babe:201904:analyzing:3a404ff, author = {Cafe Babe}, title = {{Analyzing Emotet with Ghidra — Part 1}}, date = {2019-04}, url = {https://medium.com/@0xd0cf11e/analyzing-emotet-with-ghidra-part-1-4da71a5c8d69}, language = {English}, urldate = {2019-12-06} } Analyzing Emotet with Ghidra — Part 1
Emotet
2019-03-27SpamhausSpamhaus Malware Labs
@online{labs:20190327:emotet:388559f, author = {Spamhaus Malware Labs}, title = {{Emotet adds a further layer of camouflage}}, date = {2019-03-27}, organization = {Spamhaus}, url = {https://www.spamhaus.org/news/article/783/emotet-adds-a-further-layer-of-camouflage}, language = {English}, urldate = {2020-01-06} } Emotet adds a further layer of camouflage
Emotet
2019-03-17Persianov on SecuritySveatoslav Persianov
@online{persianov:20190317:emotet:ee3ed0b, author = {Sveatoslav Persianov}, title = {{Emotet malware analysis. Part 1}}, date = {2019-03-17}, organization = {Persianov on Security}, url = {https://persianov.net/emotet-malware-analysis-part-1}, language = {English}, urldate = {2019-12-17} } Emotet malware analysis. Part 1
Emotet
2019-03-15CofenseThreat Intelligence
@online{intelligence:20190315:flash:c7544fd, author = {Threat Intelligence}, title = {{Flash Bulletin: Emotet Epoch 1 Changes its C2 Communication}}, date = {2019-03-15}, organization = {Cofense}, url = {https://cofense.com/flash-bulletin-emotet-epoch-1-changes-c2-communication/}, language = {English}, urldate = {2019-10-23} } Flash Bulletin: Emotet Epoch 1 Changes its C2 Communication
Emotet
2019-03-08The Daily SwigJames Walker
@online{walker:20190308:emotet:f1a68de, author = {James Walker}, title = {{Emotet trojan implicated in Wolverine Solutions ransomware attack}}, date = {2019-03-08}, organization = {The Daily Swig}, url = {https://portswigger.net/daily-swig/emotet-trojan-implicated-in-wolverine-solutions-ransomware-attack}, language = {English}, urldate = {2019-07-10} } Emotet trojan implicated in Wolverine Solutions ransomware attack
Emotet
2019-02-16Max Kersten's BlogMax Kersten
@online{kersten:20190216:emotet:7cb0628, author = {Max Kersten}, title = {{Emotet droppers}}, date = {2019-02-16}, organization = {Max Kersten's Blog}, url = {https://maxkersten.nl/binary-analysis-course/malware-analysis/emotet-droppers/}, language = {English}, urldate = {2020-01-09} } Emotet droppers
Emotet
2019-01-17SANS ISC InfoSec ForumsBrad Duncan
@online{duncan:20190117:emotet:0754347, author = {Brad Duncan}, title = {{Emotet infections and follow-up malware}}, date = {2019-01-17}, organization = {SANS ISC InfoSec Forums}, url = {https://isc.sans.edu/forums/diary/Emotet+infections+and+followup+malware/24532/}, language = {English}, urldate = {2020-01-13} } Emotet infections and follow-up malware
Emotet
2019-01-05Github (d00rt)d00rt
@online{d00rt:20190105:emotet:8dee25a, author = {d00rt}, title = {{Emotet Research}}, date = {2019-01-05}, organization = {Github (d00rt)}, url = {https://github.com/d00rt/emotet_research}, language = {English}, urldate = {2020-01-10} } Emotet Research
Emotet
2019D00RT_RM
@online{d00rtrm:2019:emutet:8913da8, author = {D00RT_RM}, title = {{Emutet}}, date = {2019}, url = {https://d00rt.github.io/emotet_network_protocol/}, language = {English}, urldate = {2020-01-07} } Emutet
Emotet
2018-12-18Trend MicroTrendmicro
@online{trendmicro:20181218:ursnif:cc5ce31, author = {Trendmicro}, title = {{URSNIF, EMOTET, DRIDEX and BitPaymer Gangs Linked by a Similar Loader}}, date = {2018-12-18}, organization = {Trend Micro}, url = {https://blog.trendmicro.com/trendlabs-security-intelligence/ursnif-emotet-dridex-and-bitpaymer-gangs-linked-by-a-similar-loader/}, language = {English}, urldate = {2020-01-07} } URSNIF, EMOTET, DRIDEX and BitPaymer Gangs Linked by a Similar Loader
Dridex Emotet FriedEx ISFB
2018-11-16Trend MicroTrend Micro
@online{micro:20181116:exploring:be1e153, author = {Trend Micro}, title = {{Exploring Emotet: Examining Emotet’s Activities, Infrastructure}}, date = {2018-11-16}, organization = {Trend Micro}, url = {https://blog.trendmicro.com/trendlabs-security-intelligence/exploring-emotet-examining-emotets-activities-infrastructure/}, language = {English}, urldate = {2020-01-12} } Exploring Emotet: Examining Emotet’s Activities, Infrastructure
Emotet
2018-11-09ESET ResearchESET Research
@online{research:20181109:emotet:b12ec91, author = {ESET Research}, title = {{Emotet launches major new spam campaign}}, date = {2018-11-09}, organization = {ESET Research}, url = {https://www.welivesecurity.com/2018/11/09/emotet-launches-major-new-spam-campaign/}, language = {English}, urldate = {2019-11-14} } Emotet launches major new spam campaign
Emotet
2018-10-31Kryptos LogicKryptos Logic
@online{logic:20181031:emotet:ab7226f, author = {Kryptos Logic}, title = {{Emotet Awakens With New Campaign of Mass Email Exfiltration}}, date = {2018-10-31}, organization = {Kryptos Logic}, url = {https://blog.kryptoslogic.com/malware/2018/10/31/emotet-email-theft.html}, language = {English}, urldate = {2020-01-08} } Emotet Awakens With New Campaign of Mass Email Exfiltration
Emotet
2018-09-12Cryptolaemus PastedumpCryptolaemus
@online{cryptolaemus:20180912:emotet:013e01b, author = {Cryptolaemus}, title = {{Emotet IOC}}, date = {2018-09-12}, organization = {Cryptolaemus Pastedump}, url = {https://paste.cryptolaemus.com}, language = {English}, urldate = {2020-01-13} } Emotet IOC
Emotet
2018-08-01Kryptos LogicKryptos Logic
@online{logic:20180801:inside:e5a8e2c, author = {Kryptos Logic}, title = {{Inside Look at Emotet's Global Victims and Malspam Qakbot Payloads}}, date = {2018-08-01}, organization = {Kryptos Logic}, url = {https://blog.kryptoslogic.com/malware/2018/08/01/emotet.html}, language = {English}, urldate = {2020-01-09} } Inside Look at Emotet's Global Victims and Malspam Qakbot Payloads
Emotet
2018-07-26IntezerItai Tevet
@online{tevet:20180726:mitigating:30dc2fb, author = {Itai Tevet}, title = {{Mitigating Emotet, The Most Common Banking Trojan}}, date = {2018-07-26}, organization = {Intezer}, url = {https://www.intezer.com/mitigating-emotet-the-most-common-banking-trojan/}, language = {English}, urldate = {2019-12-31} } Mitigating Emotet, The Most Common Banking Trojan
Emotet
2018-07-24Check PointOfer Caspi, Ben Herzog
@online{caspi:20180724:emotet:a26725d, author = {Ofer Caspi and Ben Herzog}, title = {{Emotet: The Tricky Trojan that ‘Git Clones’}}, date = {2018-07-24}, organization = {Check Point}, url = {https://research.checkpoint.com/emotet-tricky-trojan-git-clones/}, language = {English}, urldate = {2020-01-13} } Emotet: The Tricky Trojan that ‘Git Clones’
Emotet
2018-07-23MalFindLasq
@online{lasq:20180723:deobfuscating:dd200d6, author = {Lasq}, title = {{Deobfuscating Emotet’s powershell payload}}, date = {2018-07-23}, organization = {MalFind}, url = {https://malfind.com/index.php/2018/07/23/deobfuscating-emotets-powershell-payload/}, language = {English}, urldate = {2020-01-09} } Deobfuscating Emotet’s powershell payload
Emotet
2018-07-20NCCICNational Cybersecurity, Communications Integration Center
@online{cybersecurity:20180720:alert:89ca0c7, author = {National Cybersecurity and Communications Integration Center}, title = {{Alert (TA18-201A) Emotet Malware}}, date = {2018-07-20}, organization = {NCCIC}, url = {https://www.us-cert.gov/ncas/alerts/TA18-201A}, language = {English}, urldate = {2019-10-27} } Alert (TA18-201A) Emotet Malware
Emotet
2018-07-18SymantecSecurity Response Attack Investigation Team
@online{team:20180718:evolution:25e5d39, author = {Security Response Attack Investigation Team}, title = {{The Evolution of Emotet: From Banking Trojan to Threat Distributor}}, date = {2018-07-18}, organization = {Symantec}, url = {https://www.symantec.com/blogs/threat-intelligence/evolution-emotet-trojan-distributor}, language = {English}, urldate = {2019-11-27} } The Evolution of Emotet: From Banking Trojan to Threat Distributor
Emotet
2018-02-08CrowdStrikeAdam Meyers
@online{meyers:20180208:meet:39f25b3, author = {Adam Meyers}, title = {{Meet CrowdStrike’s Adversary of the Month for February: MUMMY SPIDER}}, date = {2018-02-08}, organization = {CrowdStrike}, url = {https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-february-mummy-spider/}, language = {English}, urldate = {2019-12-20} } Meet CrowdStrike’s Adversary of the Month for February: MUMMY SPIDER
Emotet MUMMY SPIDER
2018Quick HealQuick Heal
@techreport{heal:2018:complete:96388ed, author = {Quick Heal}, title = {{The Complete story of EMOTET Most prominent Malware of 2018}}, date = {2018}, institution = {Quick Heal}, url = {https://quickheal.co.in/documents/technical-paper/Whitepaper_HowToPM.pdf}, language = {English}, urldate = {2020-01-13} } The Complete story of EMOTET Most prominent Malware of 2018
Emotet
2017-11-15Trend MicroRubio Wu
@online{wu:20171115:new:dde35b0, author = {Rubio Wu}, title = {{New EMOTET Hijacks a Windows API, Evades Sandbox and Analysis}}, date = {2017-11-15}, organization = {Trend Micro}, url = {https://blog.trendmicro.com/trendlabs-security-intelligence/new-emotet-hijacks-windows-api-evades-sandbox-analysis/}, language = {English}, urldate = {2019-10-14} } New EMOTET Hijacks a Windows API, Evades Sandbox and Analysis
Emotet
2017-11-06MicrosoftMicrosoft Defender ATP Research Team
@online{team:20171106:mitigating:f52d1d9, author = {Microsoft Defender ATP Research Team}, title = {{Mitigating and eliminating info-stealing Qakbot and Emotet in corporate networks}}, date = {2017-11-06}, organization = {Microsoft}, url = {https://cloudblogs.microsoft.com/microsoftsecure/2017/11/06/mitigating-and-eliminating-info-stealing-qakbot-and-emotet-in-corporate-networks/?source=mmpc}, language = {English}, urldate = {2019-12-18} } Mitigating and eliminating info-stealing Qakbot and Emotet in corporate networks
Emotet
2017-10-12G DataG Data
@online{data:20171012:emotet:c99dec0, author = {G Data}, title = {{Emotet beutet Outlook aus}}, date = {2017-10-12}, organization = {G Data}, url = {https://www.gdata.de/blog/2017/10/30110-emotet-beutet-outlook-aus}, language = {English}, urldate = {2019-12-05} } Emotet beutet Outlook aus
Emotet
2017-10-06CERT.PLMaciej Kotowicz, Jarosław Jedynak
@techreport{kotowicz:20171006:peering:668c82e, author = {Maciej Kotowicz and Jarosław Jedynak}, title = {{Peering into spam botnets}}, date = {2017-10-06}, institution = {CERT.PL}, url = {https://lokalhost.pl/txt/peering.into.spam.botnets.VirusBulletin2017.pdf}, language = {English}, urldate = {2020-04-06} } Peering into spam botnets
Emotet Kelihos Necurs SendSafe Tofsee
2017-09-07Trend MicroDon Ladores
@online{ladores:20170907:emotet:bf3075c, author = {Don Ladores}, title = {{EMOTET Returns, Starts Spreading via Spam Botnet}}, date = {2017-09-07}, organization = {Trend Micro}, url = {http://blog.trendmicro.com/trendlabs-security-intelligence/emotet-returns-starts-spreading-via-spam-botnet/}, language = {English}, urldate = {2019-11-28} } EMOTET Returns, Starts Spreading via Spam Botnet
Emotet
2017-05-31ropgadget.comJeff White
@online{white:20170531:writing:1ad3f1b, author = {Jeff White}, title = {{Writing PCRE's for applied passive network defense [Emotet]}}, date = {2017-05-31}, organization = {ropgadget.com}, url = {http://ropgadget.com/posts/defensive_pcres.html}, language = {English}, urldate = {2020-03-06} } Writing PCRE's for applied passive network defense [Emotet]
Emotet
2017-05-24CERT.PLPaweł Srokosz
@online{srokosz:20170524:analysis:1d591e7, author = {Paweł Srokosz}, title = {{Analysis of Emotet v4}}, date = {2017-05-24}, organization = {CERT.PL}, url = {https://www.cert.pl/en/news/single/analysis-of-emotet-v4/}, language = {English}, urldate = {2020-01-09} } Analysis of Emotet v4
Emotet
2017-05-03FortinetXiaopeng Zhang
@online{zhang:20170503:deep:4b1f7c7, author = {Xiaopeng Zhang}, title = {{Deep Analysis of New Emotet Variant - Part 1}}, date = {2017-05-03}, organization = {Fortinet}, url = {http://blog.fortinet.com/2017/05/03/deep-analysis-of-new-emotet-variant-part-1}, language = {English}, urldate = {2019-07-08} } Deep Analysis of New Emotet Variant - Part 1
Emotet
2015-04-09Kaspersky LabsAlexey Shulmin
@online{shulmin:20150409:banking:165b265, author = {Alexey Shulmin}, title = {{The Banking Trojan Emotet: Detailed Analysis}}, date = {2015-04-09}, organization = {Kaspersky Labs}, url = {https://securelist.com/analysis/publications/69560/the-banking-trojan-emotet-detailed-analysis/}, language = {English}, urldate = {2019-12-20} } The Banking Trojan Emotet: Detailed Analysis
Emotet
2013-01-18abuse.chabuse.ch
@online{abusech:20130118:feodo:5354db0, author = {abuse.ch}, title = {{Feodo Tracker}}, date = {2013-01-18}, organization = {abuse.ch}, url = {https://feodotracker.abuse.ch/?filter=version_e}, language = {English}, urldate = {2020-01-13} } Feodo Tracker
Emotet
Yara Rules
[TLP:WHITE] win_emotet_auto (20200529 | autogenerated rule brought to you by yara-signator)
rule win_emotet_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-05-30"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
        malpedia_rule_date = "20200529"
        malpedia_hash = "92c362319514e5a6da26204961446caa3a8b32a8"
        malpedia_version = "20200529"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7307 e8???????? 8bc8 8b4510 }
            // n = 4, score = 3300
            //   7307                 | jae                 9
            //   e8????????           |                     
            //   8bc8                 | mov                 ecx, eax
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]

        $sequence_1 = { 740f 41 6698 668902 83c202 }
            // n = 5, score = 3200
            //   740f                 | je                  0x11
            //   41                   | inc                 ecx
            //   6698                 | cbw                 
            //   668902               | mov                 word ptr [edx], ax
            //   83c202               | add                 edx, 2

        $sequence_2 = { 83c202 8a01 84c0 75ed c7022e004400 33c0 c742044c004c00 }
            // n = 7, score = 3200
            //   83c202               | add                 edx, 2
            //   8a01                 | mov                 al, byte ptr [ecx]
            //   84c0                 | test                al, al
            //   75ed                 | jne                 0xffffffef
            //   c7022e004400         | mov                 dword ptr [edx], 0x44002e
            //   33c0                 | xor                 eax, eax
            //   c742044c004c00       | mov                 dword ptr [edx + 4], 0x4c004c

        $sequence_3 = { 0fb7c0 83c020 eb03 0fb7c0 69d23f000100 }
            // n = 5, score = 3100
            //   0fb7c0               | cbw                 
            //   83c020               | mov                 word ptr [edx], ax
            //   eb03                 | add                 edx, 2
            //   0fb7c0               | mov                 word ptr [edx], ax
            //   69d23f000100         | add                 edx, 2

        $sequence_4 = { 7415 8d4dfc 51 6a00 6a01 }
            // n = 5, score = 3000
            //   7415                 | je                  0x17
            //   8d4dfc               | lea                 ecx, [ebp - 4]
            //   51                   | push                ecx
            //   6a00                 | push                0
            //   6a01                 | push                1

        $sequence_5 = { 8bc8 e8???????? 83c40c 8b45fc }
            // n = 4, score = 3000
            //   8bc8                 | mov                 ecx, eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]

        $sequence_6 = { 85c0 7511 8d85f0fdffff 50 ff15???????? 85c0 }
            // n = 6, score = 2900
            //   85c0                 | test                eax, eax
            //   7511                 | jne                 0x13
            //   8d85f0fdffff         | lea                 eax, [ebp - 0x210]
            //   50                   | push                eax
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax

        $sequence_7 = { 55 8bec 8a01 8d95f0fdffff }
            // n = 4, score = 2900
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   8a01                 | mov                 al, byte ptr [ecx]
            //   8d95f0fdffff         | lea                 edx, [ebp - 0x210]

        $sequence_8 = { 6a01 8d55f8 8bc8 e8???????? }
            // n = 4, score = 2900
            //   6a01                 | push                1
            //   8d55f8               | lea                 edx, [ebp - 8]
            //   8bc8                 | mov                 ecx, eax
            //   e8????????           |                     

        $sequence_9 = { 8a01 8d95f0fdffff 81ec10020000 84c0 7413 3c2e 740f }
            // n = 7, score = 2900
            //   8a01                 | mov                 al, byte ptr [ecx]
            //   8d95f0fdffff         | lea                 edx, [ebp - 0x210]
            //   81ec10020000         | sub                 esp, 0x210
            //   84c0                 | test                al, al
            //   7413                 | je                  0x15
            //   3c2e                 | cmp                 al, 0x2e
            //   740f                 | je                  0x11

        $sequence_10 = { 8d5801 f6c30f 7406 83e3f0 83c310 }
            // n = 5, score = 2700
            //   8d5801               | sub                 esp, 0x210
            //   f6c30f               | test                al, al
            //   7406                 | mov                 ebp, esp
            //   83e3f0               | mov                 al, byte ptr [ecx]
            //   83c310               | lea                 edx, [ebp - 0x210]

        $sequence_11 = { 6685c0 75de 3b55fc 740f 8b3f }
            // n = 5, score = 2700
            //   6685c0               | push                ebx
            //   75de                 | push                esi
            //   3b55fc               | push                edi
            //   740f                 | cmp                 cx, 0x19
            //   8b3f                 | ja                  5

        $sequence_12 = { 6683f919 7703 83c020 69d23f000100 83c602 03d0 }
            // n = 6, score = 2700
            //   6683f919             | test                al, al
            //   7703                 | je                  0x25
            //   83c020               | push                ebp
            //   69d23f000100         | mov                 ebp, esp
            //   83c602               | push                ecx
            //   03d0                 | mov                 eax, dword ptr fs:[0x30]

        $sequence_13 = { c1e807 46 83f87f 77f7 }
            // n = 4, score = 2600
            //   c1e807               | push                ecx
            //   46                   | push                0
            //   83f87f               | push                1
            //   77f7                 | lea                 edx, [ebp - 8]

        $sequence_14 = { 0fb6c0 c1e108 03c8 c1e108 }
            // n = 4, score = 2300
            //   0fb6c0               | movzx               eax, al
            //   c1e108               | shl                 ecx, 8
            //   03c8                 | add                 ecx, eax
            //   c1e108               | shl                 ecx, 8

        $sequence_15 = { 03c8 c1e108 c1e906 8bc1 c1e906 83e03f }
            // n = 6, score = 2300
            //   03c8                 | add                 ecx, eax
            //   c1e108               | shl                 ecx, 8
            //   c1e906               | shr                 ecx, 6
            //   8bc1                 | mov                 eax, ecx
            //   c1e906               | shr                 ecx, 6
            //   83e03f               | and                 eax, 0x3f

        $sequence_16 = { 8bec ff7508 6a00 51 }
            // n = 4, score = 1600
            //   8bec                 | lea                 ecx, [ebp - 4]
            //   ff7508               | push                ecx
            //   6a00                 | push                0
            //   51                   | push                1

        $sequence_17 = { 83f87f 760d 8d642400 c1e807 }
            // n = 4, score = 1600
            //   83f87f               | ja                  0xfffffffd
            //   760d                 | shr                 eax, 7
            //   8d642400             | inc                 ecx
            //   c1e807               | cmp                 eax, 0x7f

        $sequence_18 = { c745fc04000000 50 8d45f8 81ca00000020 }
            // n = 4, score = 1500
            //   c745fc04000000       | push                0
            //   50                   | push                ecx
            //   8d45f8               | push                ebp
            //   81ca00000020         | mov                 ebp, esp

        $sequence_19 = { 8d45f8 81ca00000020 50 52 }
            // n = 4, score = 1500
            //   8d45f8               | je                  0x19
            //   81ca00000020         | lea                 ecx, [ebp - 4]
            //   50                   | mov                 ebp, esp
            //   52                   | push                dword ptr [ebp + 8]

        $sequence_20 = { 83f87f 7609 c1e807 41 83f87f 77f7 }
            // n = 6, score = 1500
            //   83f87f               | ja                  6
            //   7609                 | shr                 eax, 7
            //   c1e807               | inc                 edx
            //   41                   | cmp                 eax, 0x7f
            //   83f87f               | ja                  0xfffffffc
            //   77f7                 | cmp                 eax, 0x7f

        $sequence_21 = { 2bc6 83c003 c1e802 3bf1 }
            // n = 4, score = 1400
            //   2bc6                 | push                ecx
            //   83c003               | push                eax
            //   c1e802               | lea                 eax, [ebp - 8]
            //   3bf1                 | or                  edx, 0x20000000

        $sequence_22 = { 8b5d08 b8afa96e5e 56 57 }
            // n = 4, score = 1400
            //   8b5d08               | test                bl, 0xf
            //   b8afa96e5e           | je                  0xe
            //   56                   | and                 ebx, 0xfffffff0
            //   57                   | xor                 eax, eax

        $sequence_23 = { 33c0 5f 668906 5e 5b 8be5 }
            // n = 6, score = 1300
            //   33c0                 | cmp                 esi, ecx
            //   5f                   | cmova               eax, edi
            //   668906               | mov                 eax, ecx
            //   5e                   | sub                 eax, esi
            //   5b                   | add                 eax, 3
            //   8be5                 | shr                 eax, 2

        $sequence_24 = { 7907 83c107 3bf7 72e8 }
            // n = 4, score = 1300
            //   7907                 | cmp                 eax, 0x7f
            //   83c107               | shr                 eax, 7
            //   3bf7                 | inc                 ebx
            //   72e8                 | cmp                 eax, 0x7f

        $sequence_25 = { 83ec14 53 8b5d08 b8afa96e5e }
            // n = 4, score = 1300
            //   83ec14               | mov                 ebx, dword ptr [ebp + 8]
            //   53                   | mov                 eax, 0x5e6ea9af
            //   8b5d08               | push                esi
            //   b8afa96e5e           | sub                 esp, 0x14

        $sequence_26 = { 0fb64a01 51 0fb64a02 51 }
            // n = 4, score = 1200
            //   0fb64a01             | pop                 ebx
            //   51                   | mov                 esp, ebp
            //   0fb64a02             | mov                 word ptr [esi], ax
            //   51                   | pop                 esi

        $sequence_27 = { 3c5a 7e03 c60158 41 }
            // n = 4, score = 1200
            //   3c5a                 | movzx               ecx, byte ptr [edx + 2]
            //   7e03                 | push                ecx
            //   c60158               | push                ecx
            //   41                   | movzx               ecx, byte ptr [edx + 1]

        $sequence_28 = { 83ec48 53 56 57 6a44 }
            // n = 5, score = 1100
            //   83ec48               | cmp                 dword ptr [esi], eax
            //   53                   | pop                 edi
            //   56                   | setne               al
            //   57                   | pop                 esi
            //   6a44                 | mov                 esp, ebp

        $sequence_29 = { 8bec 83ec08 56 57 8bf1 33ff }
            // n = 6, score = 1100
            //   8bec                 | mov                 ebx, dword ptr [ebp + 8]
            //   83ec08               | mov                 eax, 0x5e6ea9af
            //   56                   | push                esi
            //   57                   | push                edi
            //   8bf1                 | sub                 esp, 0x48
            //   33ff                 | push                ebx

        $sequence_30 = { 52 52 52 52 68???????? 52 }
            // n = 6, score = 1100
            //   52                   | jbe                 0xe
            //   52                   | shr                 eax, 7
            //   52                   | inc                 ecx
            //   52                   | mov                 ecx, 1
            //   68????????           |                     
            //   52                   | cmp                 eax, 0x7f

        $sequence_31 = { 750e 6683780650 7507 668378083a }
            // n = 4, score = 1000
            //   750e                 | jne                 0x10
            //   6683780650           | cmp                 word ptr [eax + 6], 0x50
            //   7507                 | jne                 9
            //   668378083a           | cmp                 word ptr [eax + 8], 0x3a

        $sequence_32 = { 66833853 751c 668378024d 7515 }
            // n = 4, score = 1000
            //   66833853             | cmp                 word ptr [eax], 0x53
            //   751c                 | jne                 0x1e
            //   668378024d           | cmp                 word ptr [eax + 2], 0x4d
            //   7515                 | jne                 0x17

        $sequence_33 = { 668378024d 7515 6683780454 750e 6683780650 }
            // n = 5, score = 1000
            //   668378024d           | cmp                 word ptr [eax + 2], 0x4d
            //   7515                 | jne                 0x17
            //   6683780454           | cmp                 word ptr [eax + 4], 0x54
            //   750e                 | jne                 0x10
            //   6683780650           | cmp                 word ptr [eax + 6], 0x50

        $sequence_34 = { 83f87f 760c c1e807 42 83f87f 77f7 }
            // n = 6, score = 800
            //   83f87f               | push                edx
            //   760c                 | push                edx
            //   c1e807               | push                edx
            //   42                   | push                edx
            //   83f87f               | push                edx
            //   77f7                 | push                edx

        $sequence_35 = { 6a00 6aff 50 51 ff15???????? }
            // n = 5, score = 800
            //   6a00                 | jbe                 0x20
            //   6aff                 | shr                 eax, 7
            //   50                   | inc                 edx
            //   51                   | cmp                 eax, 0x7f
            //   ff15????????         |                     

        $sequence_36 = { 50 6a00 6a01 6a00 ff15???????? a3???????? }
            // n = 6, score = 800
            //   50                   | cmp                 eax, 0x7f
            //   6a00                 | jbe                 0x1a
            //   6a01                 | shr                 eax, 7
            //   6a00                 | inc                 edx
            //   ff15????????         |                     
            //   a3????????           |                     

        $sequence_37 = { 53 56 8bf1 bb00c34c84 }
            // n = 4, score = 700
            //   53                   | push                edi
            //   56                   | mov                 esi, ecx
            //   8bf1                 | xor                 edi, edi
            //   bb00c34c84           | mov                 eax, dword ptr [esi + 0x6c]

        $sequence_38 = { 57 56 ff7508 53 6a00 }
            // n = 5, score = 700
            //   57                   | sub                 esp, 0x14
            //   56                   | push                ebx
            //   ff7508               | mov                 ebx, dword ptr [ebp + 8]
            //   53                   | mov                 eax, 0x5e6ea9af
            //   6a00                 | sub                 esp, 0x14

        $sequence_39 = { 55 8bec 56 8b750c b856555555 }
            // n = 5, score = 600
            //   55                   | pop                 edi
            //   8bec                 | pop                 esi
            //   56                   | pop                 ebx
            //   8b750c               | mov                 esp, ebp
            //   b856555555           | pop                 ebp

        $sequence_40 = { 6a00 ff75fc 6800040000 6a00 6a00 }
            // n = 5, score = 600
            //   6a00                 | push                dword ptr [ebp + 8]
            //   ff75fc               | push                ebx
            //   6800040000           | push                0
            //   6a00                 | push                0xfde9
            //   6a00                 | push                0

        $sequence_41 = { 8bf1 bb00c34c84 57 33ff }
            // n = 4, score = 600
            //   8bf1                 | push                0
            //   bb00c34c84           | push                dword ptr [ebp + 8]
            //   57                   | push                ebx
            //   33ff                 | push                0

        $sequence_42 = { 83ec10 53 6a00 8d45fc }
            // n = 4, score = 600
            //   83ec10               | push                edi
            //   53                   | xor                 edi, edi
            //   6a00                 | push                0
            //   8d45fc               | push                3

        $sequence_43 = { 6a00 6a03 6a00 6a00 ff7508 }
            // n = 5, score = 600
            //   6a00                 | push                ebp
            //   6a03                 | mov                 ebp, esp
            //   6a00                 | push                esi
            //   6a00                 | mov                 esi, dword ptr [ebp + 0xc]
            //   ff7508               | mov                 eax, 0x55555556

        $sequence_44 = { 83ec08 56 68400000f0 6a18 33f6 56 }
            // n = 6, score = 600
            //   83ec08               | push                0
            //   56                   | push                dword ptr [ebp - 4]
            //   68400000f0           | push                0x400
            //   6a18                 | push                0
            //   33f6                 | push                0
            //   56                   | push                dword ptr [ebp - 4]

        $sequence_45 = { ff7514 6aff ff750c 57 }
            // n = 4, score = 600
            //   ff7514               | push                edi
            //   6aff                 | push                dword ptr [ebp - 8]
            //   ff750c               | push                ebx
            //   57                   | push                3

        $sequence_46 = { 56 56 57 ff75f8 53 }
            // n = 5, score = 600
            //   56                   | push                0
            //   56                   | push                0
            //   57                   | push                eax
            //   ff75f8               | push                0
            //   53                   | push                dword ptr [ebp - 4]

        $sequence_47 = { 50 56 6800800000 6a6a }
            // n = 4, score = 600
            //   50                   | push                esi
            //   56                   | push                0xf0000040
            //   6800800000           | push                0x18
            //   6a6a                 | xor                 esi, esi

        $sequence_48 = { 8b4d14 8b5510 8b750c 8b7d08 83fe00 8945f0 }
            // n = 6, score = 500
            //   8b4d14               | push                esi
            //   8b5510               | push                edi
            //   8b750c               | mov                 esi, ecx
            //   8b7d08               | xor                 edi, edi
            //   83fe00               | mov                 eax, dword ptr [ebp + 0x10]
            //   8945f0               | mov                 ecx, dword ptr [ebp + 0xc]

        $sequence_49 = { 31c0 8b4de0 8b513c 01d1 }
            // n = 4, score = 500
            //   31c0                 | cmp                 esi, 0
            //   8b4de0               | mov                 dword ptr [ebp - 0x10], eax
            //   8b513c               | push                edx
            //   01d1                 | add                 eax, ecx

        $sequence_50 = { 52 01c8 01d0 50 e8???????? }
            // n = 5, score = 500
            //   52                   | mov                 edx, dword ptr [ebp + 8]
            //   01c8                 | mov                 esi, 0xfffffffb
            //   01d0                 | mov                 byte ptr [eax], 0xe8
            //   50                   | sub                 esi, edx
            //   e8????????           |                     

        $sequence_51 = { 8b4130 83b8a400000006 0f92c2 80e201 0fb6c2 }
            // n = 5, score = 500
            //   8b4130               | add                 esi, ecx
            //   83b8a400000006       | mov                 ecx, dword ptr [ebp + 0x14]
            //   0f92c2               | mov                 edx, dword ptr [ebp + 0x10]
            //   80e201               | mov                 esi, dword ptr [ebp + 0xc]
            //   0fb6c2               | mov                 edi, dword ptr [ebp + 8]

        $sequence_52 = { 8b4510 8b4d0c 8b5508 befbffffff c600e8 29d6 01ce }
            // n = 7, score = 500
            //   8b4510               | push                esi
            //   8b4d0c               | push                edi
            //   8b5508               | mov                 esi, ecx
            //   befbffffff           | xor                 edi, edi
            //   c600e8               | push                ebp
            //   29d6                 | mov                 ebp, esp
            //   01ce                 | sub                 esp, 8

        $sequence_53 = { 889828020000 88982d030000 c7401801000000 88581c 88981c010000 }
            // n = 5, score = 400
            //   889828020000         | dec                 eax
            //   88982d030000         | sub                 esp, 0x248
            //   c7401801000000       | je                  0x14
            //   88581c               | dec                 eax
            //   88981c010000         | mov                 edx, eax

        $sequence_54 = { 80fa7b 7c08 80fa7e 7f08 }
            // n = 4, score = 400
            //   80fa7b               | mov                 byte ptr [eax + 0x228], bl
            //   7c08                 | mov                 byte ptr [eax + 0x32d], bl
            //   80fa7e               | mov                 dword ptr [eax + 0x18], 1
            //   7f08                 | mov                 byte ptr [eax + 0x1c], bl

        $sequence_55 = { 7424 899824020000 889828020000 88982d030000 }
            // n = 4, score = 400
            //   7424                 | mov                 byte ptr [eax + 0x1c], bl
            //   899824020000         | mov                 byte ptr [eax + 0x11c], bl
            //   889828020000         | je                  0x26
            //   88982d030000         | mov                 dword ptr [eax + 0x224], ebx

        $sequence_56 = { 4881ec48020000 e8???????? e8???????? e8???????? e8???????? ff15???????? }
            // n = 6, score = 300
            //   4881ec48020000       | ja                  5
            //   e8????????           |                     
            //   e8????????           |                     
            //   e8????????           |                     
            //   e8????????           |                     
            //   ff15????????         |                     

        $sequence_57 = { 410fb600 84c0 75e9 898c2450020000 }
            // n = 4, score = 300
            //   410fb600             | cmp                 word ptr [eax + 4], 0x54
            //   84c0                 | jne                 0x2c
            //   75e9                 | cmp                 word ptr [eax + 2], 0x4d
            //   898c2450020000       | jne                 0x1c

        $sequence_58 = { 4c8b4a10 448b4208 33d2 ff5028 85c0 7855 }
            // n = 6, score = 300
            //   4c8b4a10             | cmp                 word ptr [eax + 6], 0x50
            //   448b4208             | jne                 0x15
            //   33d2                 | cmp                 word ptr [eax + 8], 0x3a
            //   ff5028               | jne                 0x1e
            //   85c0                 | cmp                 word ptr [eax + 2], 0x4d
            //   7855                 | jne                 0x1e

        $sequence_59 = { 7703 83c020 0fb74a02 4883c202 }
            // n = 4, score = 300
            //   7703                 | dec                 ebp
            //   83c020               | add                 esp, esi
            //   0fb74a02             | dec                 ebp
            //   4883c202             | add                 ebp, esi

        $sequence_60 = { 448b6f1c 4d03ce 4d03e6 4d03ee }
            // n = 4, score = 300
            //   448b6f1c             | inc                 esp
            //   4d03ce               | mov                 ebp, dword ptr [edi + 0x1c]
            //   4d03e6               | dec                 ebp
            //   4d03ee               | add                 ecx, esi

        $sequence_61 = { 668945f0 8d45e0 50 e8???????? }
            // n = 4, score = 300
            //   668945f0             | mov                 byte ptr [eax + 0x11c], bl
            //   8d45e0               | je                  0x26
            //   50                   | mov                 dword ptr [eax + 0x224], ebx
            //   e8????????           |                     

        $sequence_62 = { 8b7020 8b7840 89c3 83c33c }
            // n = 4, score = 300
            //   8b7020               | ret                 
            //   8b7840               | inc                 esp
            //   89c3                 | mov                 dword ptr [esp + 0x18], eax
            //   83c33c               | dec                 eax

        $sequence_63 = { 31f6 89720c 897208 897204 }
            // n = 4, score = 200
            //   31f6                 | mov                 ecx, dword ptr [esp + 0x60]
            //   89720c               | inc                 ecx
            //   897208               | sub                 edx, ecx
            //   897204               | inc                 esp

        $sequence_64 = { 53 e8???????? 59 59 eb71 39bbe0010000 7569 }
            // n = 7, score = 200
            //   53                   | push                eax
            //   e8????????           |                     
            //   59                   | mov                 dword ptr [ebp - 0x1494], 0x449f4c
            //   59                   | add                 esp, 0xc
            //   eb71                 | mov                 byte ptr [edi + 0x67], 1
            //   39bbe0010000         | push                dword ptr [eax + 0x24]
            //   7569                 | call                dword ptr [ecx + 0x24]

        $sequence_65 = { 31c9 89e2 31f6 89720c }
            // n = 4, score = 200
            //   31c9                 | cwde                
            //   89e2                 | cmp                 byte ptr [esp + eax + 0x1f], 0x5c
            //   31f6                 | je                  0x18
            //   89720c               | dec                 eax

        $sequence_66 = { 59 ff7514 8d440002 50 }
            // n = 4, score = 200
            //   59                   | push                ebx
            //   ff7514               | push                esi
            //   8d440002             | mov                 esi, eax
            //   50                   | pop                 ebx

        $sequence_67 = { 4c8b8380000000 418bd5 498bcf 41ff13 488b8b88000000 }
            // n = 5, score = 200
            //   4c8b8380000000       | mov                 dword ptr [eax + 0x18], 1
            //   418bd5               | mov                 byte ptr [eax + 0x1c], bl
            //   498bcf               | je                  0x26
            //   41ff13               | mov                 dword ptr [eax + 0x224], ebx
            //   488b8b88000000       | mov                 byte ptr [eax + 0x228], bl

        $sequence_68 = { e8???????? 59 8d85e8efffff 50 }
            // n = 4, score = 200
            //   e8????????           |                     
            //   59                   | movsx               eax, al
            //   8d85e8efffff         | dec                 ecx
            //   50                   | inc                 eax

        $sequence_69 = { 68???????? ff36 894620 ffd7 68???????? }
            // n = 5, score = 200
            //   68????????           |                     
            //   ff36                 | mov                 byte ptr [eax + 0x228], bl
            //   894620               | mov                 byte ptr [eax + 0x32d], bl
            //   ffd7                 | cmp                 dl, 0x7b
            //   68????????           |                     

        $sequence_70 = { 8bec 83ec28 53 56 8bf0 e8???????? }
            // n = 6, score = 200
            //   8bec                 | jl                  0xd
            //   83ec28               | cmp                 dl, 0x7e
            //   53                   | jg                  0xd
            //   56                   | mov                 word ptr [ebp - 0x10], ax
            //   8bf0                 | lea                 eax, [ebp - 0x20]
            //   e8????????           |                     

        $sequence_71 = { 488bc8 ff15???????? 488bc8 ff15???????? e9???????? 803d????????00 }
            // n = 6, score = 200
            //   488bc8               | dec                 ecx
            //   ff15????????         |                     
            //   488bc8               | mov                 ecx, edi
            //   ff15????????         |                     
            //   e9????????           |                     
            //   803d????????00       |                     

        $sequence_72 = { e8???????? 85c0 0f84ea020000 6a00 6a00 eb14 8b7dfc }
            // n = 7, score = 200
            //   e8????????           |                     
            //   85c0                 | lea                 eax, [ebp - 0x1018]
            //   0f84ea020000         | push                eax
            //   6a00                 | mov                 ebx, edx
            //   6a00                 | shr                 ebx, 0xa
            //   eb14                 | and                 ebx, eax
            //   8b7dfc               | xor                 edi, dword ptr [ebx*4 + 0x449930]

        $sequence_73 = { 59 8b45fc 81b8c000000051274400 7506 8b98c4000000 }
            // n = 5, score = 200
            //   59                   | mov                 dword ptr [esp + 0x1c], eax
            //   8b45fc               | mov                 eax, dword ptr [esp + 0xc]
            //   81b8c000000051274400     | mov    eax, dword ptr [eax + 0xc]
            //   7506                 | mov                 eax, dword ptr [eax]
            //   8b98c4000000         | pop                 ecx

        $sequence_74 = { 6a00 50 c7856cebffff4c9f4400 e8???????? 83c40c }
            // n = 5, score = 200
            //   6a00                 | push                dword ptr [ebx + 8]
            //   50                   | lea                 edi, [esp + 0x48]
            //   c7856cebffff4c9f4400     | push    esi
            //   e8????????           |                     
            //   83c40c               | push                dword ptr [ebp + 0x10]

        $sequence_75 = { 488b5c2450 4883c440 5f c3 4489442418 }
            // n = 5, score = 200
            //   488b5c2450           | mov                 byte ptr [eax + 0x32d], bl
            //   4883c440             | mov                 dword ptr [eax + 0x18], 1
            //   5f                   | mov                 byte ptr [eax + 0x32d], bl
            //   c3                   | mov                 dword ptr [eax + 0x18], 1
            //   4489442418           | mov                 byte ptr [eax + 0x1c], bl

        $sequence_76 = { 488d15217f0000 488d0dcac50000 e8???????? 488b15???????? 8d4b04 }
            // n = 5, score = 200
            //   488d15217f0000       | inc                 ecx
            //   488d0dcac50000       | call                dword ptr [ebx]
            //   e8????????           |                     
            //   488b15????????       |                     
            //   8d4b04               | dec                 eax

        $sequence_77 = { 4898 807c041f5c 7411 488d158a140100 488d4c2420 e8???????? }
            // n = 6, score = 200
            //   4898                 | mov                 byte ptr [eax + 0x11c], bl
            //   807c041f5c           | dec                 esp
            //   7411                 | mov                 eax, dword ptr [ebx + 0x80]
            //   488d158a140100       | inc                 ecx
            //   488d4c2420           | mov                 edx, ebp
            //   e8????????           |                     

        $sequence_78 = { 5b 7615 80b405fcfdffff5c 80b405fcfeffff36 40 3bc7 }
            // n = 6, score = 200
            //   5b                   | push                eax
            //   7615                 | push                dword ptr [esi]
            //   80b405fcfdffff5c     | mov                 dword ptr [esi + 0x20], eax
            //   80b405fcfeffff36     | call                edi
            //   40                   | mov                 ebp, esp
            //   3bc7                 | sub                 esp, 0x28

        $sequence_79 = { e8???????? ff7308 8d7c2448 56 e8???????? ff7510 }
            // n = 6, score = 200
            //   e8????????           |                     
            //   ff7308               | pop                 ecx
            //   8d7c2448             | mov                 eax, dword ptr [ebp - 4]
            //   56                   | cmp                 dword ptr [eax + 0xc0], 0x442751
            //   e8????????           |                     
            //   ff7510               | jne                 0x12

        $sequence_80 = { e8???????? e9???????? 6683a57cf7ffff00 56 }
            // n = 4, score = 200
            //   e8????????           |                     
            //   e9????????           |                     
            //   6683a57cf7ffff00     | mov                 esi, dword ptr [ecx + 0x24]
            //   56                   | push                0

        $sequence_81 = { 8bda c1eb0a 23d8 333c9d30994400 }
            // n = 4, score = 200
            //   8bda                 | dec                 eax
            //   c1eb0a               | add                 edx, 2
            //   23d8                 | mov                 word ptr [edx - 2], ax
            //   333c9d30994400       | mov                 edi, dword ptr [ebp + 0x10]

        $sequence_82 = { 8b4d10 8b550c 8b4508 51 52 50 8d4df8 }
            // n = 7, score = 100
            //   8b4d10               | add                 edx, edx
            //   8b550c               | add                 edx, edx
            //   8b4508               | add                 edx, edx
            //   51                   | sub                 eax, edx
            //   52                   | sub                 eax, ecx
            //   50                   | cmp                 dx, di
            //   8d4df8               | jne                 0xb

        $sequence_83 = { 899c24b8000000 8b5f68 899c24bc000000 8b5f64 899c24c0000000 89b424c4000000 893c24 }
            // n = 7, score = 100
            //   899c24b8000000       | xor                 ecx, ecx
            //   8b5f68               | mov                 edx, esp
            //   899c24bc000000       | xor                 esi, esi
            //   8b5f64               | mov                 dword ptr [edx + 0xc], esi
            //   899c24c0000000       | xor                 ecx, ecx
            //   89b424c4000000       | mov                 edx, esp
            //   893c24               | xor                 esi, esi

        $sequence_84 = { f20f5cd0 f20f10442470 8b54246c 89442468 f20f11542460 f20f11442458 }
            // n = 6, score = 100
            //   f20f5cd0             | mov                 dword ptr [edx + 0xc], esi
            //   f20f10442470         | mov                 dword ptr [edx + 8], esi
            //   8b54246c             | mov                 dword ptr [edx + 4], esi
            //   89442468             | mov                 dword ptr [esp + 0xb8], ebx
            //   f20f11542460         | mov                 ebx, dword ptr [edi + 0x68]
            //   f20f11442458         | mov                 dword ptr [esp + 0xbc], ebx

        $sequence_85 = { 663bd7 7506 8b783c 897df8 bf64860000 663bd7 }
            // n = 6, score = 100
            //   663bd7               | mov                 edx, 8
            //   7506                 | dec                 esp
            //   8b783c               | lea                 ecx, [esp + 0x60]
            //   897df8               | dec                 eax
            //   bf64860000           | lea                 edx, [eax + eax*4]
            //   663bd7               | mov                 eax, dword ptr [ecx + 0x14]

        $sequence_86 = { 56 57 68???????? c74508ffffffff e8???????? }
            // n = 5, score = 100
            //   56                   | push                ecx
            //   57                   | push                0
            //   68????????           |                     
            //   c74508ffffffff       | push                0
            //   e8????????           |                     

        $sequence_87 = { 8b4c247c 660f6ed1 660febd1 f20f5cd0 f20f10442470 8b54246c }
            // n = 6, score = 100
            //   8b4c247c             | mov                 edx, esp
            //   660f6ed1             | xor                 esi, esi
            //   660febd1             | mov                 dword ptr [edx + 0xc], esi
            //   f20f5cd0             | mov                 dword ptr [edx + 8], esi
            //   f20f10442470         | xor                 esi, esi
            //   8b54246c             | mov                 dword ptr [edx + 0xc], esi

        $sequence_88 = { 33db 41 8bf8 48 8bf2 4c 8bd1 }
            // n = 7, score = 100
            //   33db                 | mov                 eax, dword ptr [ebp - 4]
            //   41                   | test                eax, eax
            //   8bf8                 | je                  0x19
            //   48                   | lea                 ecx, [ebp - 4]
            //   8bf2                 | push                esi
            //   4c                   | push                edi
            //   8bd1                 | mov                 dword ptr [ebp + 8], 0xffffffff

        $sequence_89 = { 8bec 83ec08 56 8d45f8 50 e8???????? }
            // n = 6, score = 100
            //   8bec                 | push                8
            //   83ec08               | push                4
            //   56                   | push                esi
            //   8d45f8               | test                eax, eax
            //   50                   | xor                 ebx, ebx
            //   e8????????           |                     

        $sequence_90 = { 3de6030000 7550 ba08000000 4c 8d4c2460 48 }
            // n = 6, score = 100
            //   3de6030000           | inc                 ecx
            //   7550                 | mov                 edi, eax
            //   ba08000000           | dec                 eax
            //   4c                   | mov                 esi, edx
            //   8d4c2460             | dec                 esp
            //   48                   | mov                 edx, ecx

        $sequence_91 = { 8d9424ac000000 31f6 8b7c2464 8b1f 8bac2484000000 }
            // n = 5, score = 100
            //   8d9424ac000000       | mov                 dword ptr [edx + 8], esi
            //   31f6                 | mov                 dword ptr [edx + 4], esi
            //   8b7c2464             | xor                 ecx, ecx
            //   8b1f                 | mov                 edx, esp
            //   8bac2484000000       | xor                 esi, esi

        $sequence_92 = { c7424800d00000 8b7c2418 c787cc00000000000000 c787c800000000000000 89442410 89c8 83c434 }
            // n = 7, score = 100
            //   c7424800d00000       | mov                 dword ptr [edx + 0xc], esi
            //   8b7c2418             | mov                 dword ptr [edx + 8], esi
            //   c787cc00000000000000     | mov    edx, esp
            //   c787c800000000000000     | xor    esi, esi
            //   89442410             | mov                 dword ptr [edx + 0xc], esi
            //   89c8                 | mov                 dword ptr [edx + 8], esi
            //   83c434               | mov                 dword ptr [edx + 4], esi

        $sequence_93 = { 6a08 6a04 56 ff15???????? 85c0 }
            // n = 5, score = 100
            //   6a08                 | push                1
            //   6a04                 | lea                 edx, [ebp - 8]
            //   56                   | mov                 ecx, eax
            //   ff15????????         |                     
            //   85c0                 | add                 esp, 0xc

        $sequence_94 = { 8d1480 8b4114 03d2 03d2 03d2 2bc2 2bc1 }
            // n = 7, score = 100
            //   8d1480               | mov                 ebp, esp
            //   8b4114               | sub                 esp, 8
            //   03d2                 | push                esi
            //   03d2                 | lea                 eax, [ebp - 8]
            //   03d2                 | push                eax
            //   2bc2                 | cmp                 eax, 0x3e6
            //   2bc1                 | jne                 0x57

    condition:
        7 of them and filesize < 2859008
}
Download all Yara Rules