Actor(s): IXESHE
There is no description at this point.
rule win_etumbot_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.etumbot." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8818 8811 8a00 02c2 0fb6c0 8a8405fcfeffff } // n = 6, score = 400 // 8818 | mov byte ptr [eax], bl // 8811 | mov byte ptr [ecx], dl // 8a00 | mov al, byte ptr [eax] // 02c2 | add al, dl // 0fb6c0 | movzx eax, al // 8a8405fcfeffff | mov al, byte ptr [ebp + eax - 0x104] $sequence_1 = { 02c2 0fb6c0 8a8405fcfeffff 320437 8806 46 } // n = 6, score = 400 // 02c2 | add al, dl // 0fb6c0 | movzx eax, al // 8a8405fcfeffff | mov al, byte ptr [ebp + eax - 0x104] // 320437 | xor al, byte ptr [edi + esi] // 8806 | mov byte ptr [esi], al // 46 | inc esi $sequence_2 = { 56 57 0fbe38 33f6 33db } // n = 5, score = 300 // 56 | push esi // 57 | push edi // 0fbe38 | movsx edi, byte ptr [eax] // 33f6 | xor esi, esi // 33db | xor ebx, ebx $sequence_3 = { ff15???????? ffd7 2bc3 3bc6 } // n = 4, score = 300 // ff15???????? | // ffd7 | call edi // 2bc3 | sub eax, ebx // 3bc6 | cmp eax, esi $sequence_4 = { c745c47272656e c745c874566572 c745cc73696f6e c745d05c5c496e c745d47465726e c745d865742053 } // n = 6, score = 300 // c745c47272656e | mov dword ptr [ebp - 0x3c], 0x6e657272 // c745c874566572 | mov dword ptr [ebp - 0x38], 0x72655674 // c745cc73696f6e | mov dword ptr [ebp - 0x34], 0x6e6f6973 // c745d05c5c496e | mov dword ptr [ebp - 0x30], 0x6e495c5c // c745d47465726e | mov dword ptr [ebp - 0x2c], 0x6e726574 // c745d865742053 | mov dword ptr [ebp - 0x28], 0x53207465 $sequence_5 = { 23c1 42 4e 75df 5f } // n = 5, score = 300 // 23c1 | and eax, ecx // 42 | inc edx // 4e | dec esi // 75df | jne 0xffffffe1 // 5f | pop edi $sequence_6 = { 81e1000000f0 7407 8bf9 c1ef18 } // n = 4, score = 300 // 81e1000000f0 | and ecx, 0xf0000000 // 7407 | je 9 // 8bf9 | mov edi, ecx // c1ef18 | shr edi, 0x18 $sequence_7 = { c745b063726f73 c745b46f66745c c745b85c57696e c745bc646f7773 c745c05c5c4375 } // n = 5, score = 300 // c745b063726f73 | mov dword ptr [ebp - 0x50], 0x736f7263 // c745b46f66745c | mov dword ptr [ebp - 0x4c], 0x5c74666f // c745b85c57696e | mov dword ptr [ebp - 0x48], 0x6e69575c // c745bc646f7773 | mov dword ptr [ebp - 0x44], 0x73776f64 // c745c05c5c4375 | mov dword ptr [ebp - 0x40], 0x75435c5c $sequence_8 = { 8bf1 0fbe0a c1e004 03c1 8bc8 81e1000000f0 7407 } // n = 7, score = 300 // 8bf1 | mov esi, ecx // 0fbe0a | movsx ecx, byte ptr [edx] // c1e004 | shl eax, 4 // 03c1 | add eax, ecx // 8bc8 | mov ecx, eax // 81e1000000f0 | and ecx, 0xf0000000 // 7407 | je 9 $sequence_9 = { c1ef18 33c7 f7d1 23c1 42 } // n = 5, score = 300 // c1ef18 | shr edi, 0x18 // 33c7 | xor eax, edi // f7d1 | not ecx // 23c1 | and eax, ecx // 42 | inc edx $sequence_10 = { 8bec 53 56 57 8b3d???????? ffd7 8b7508 } // n = 7, score = 300 // 8bec | mov ebp, esp // 53 | push ebx // 56 | push esi // 57 | push edi // 8b3d???????? | // ffd7 | call edi // 8b7508 | mov esi, dword ptr [ebp + 8] $sequence_11 = { c745d47465726e c745d865742053 c745dc65747469 c745e06e677300 } // n = 4, score = 300 // c745d47465726e | mov dword ptr [ebp - 0x2c], 0x6e726574 // c745d865742053 | mov dword ptr [ebp - 0x28], 0x53207465 // c745dc65747469 | mov dword ptr [ebp - 0x24], 0x69747465 // c745e06e677300 | mov dword ptr [ebp - 0x20], 0x73676e $sequence_12 = { 8d45f4 6820a10700 50 68???????? 68???????? } // n = 5, score = 300 // 8d45f4 | lea eax, [ebp - 0xc] // 6820a10700 | push 0x7a120 // 50 | push eax // 68???????? | // 68???????? | $sequence_13 = { c745bc646f7773 c745c05c5c4375 c745c47272656e c745c874566572 } // n = 4, score = 300 // c745bc646f7773 | mov dword ptr [ebp - 0x44], 0x73776f64 // c745c05c5c4375 | mov dword ptr [ebp - 0x40], 0x75435c5c // c745c47272656e | mov dword ptr [ebp - 0x3c], 0x6e657272 // c745c874566572 | mov dword ptr [ebp - 0x38], 0x72655674 $sequence_14 = { c645f477 c645f569 c645f66e c645f769 c645f86e } // n = 5, score = 200 // c645f477 | mov byte ptr [ebp - 0xc], 0x77 // c645f569 | mov byte ptr [ebp - 0xb], 0x69 // c645f66e | mov byte ptr [ebp - 0xa], 0x6e // c645f769 | mov byte ptr [ebp - 9], 0x69 // c645f86e | mov byte ptr [ebp - 8], 0x6e $sequence_15 = { aa 6a40 33c0 59 8dbdedfdffff 889decfdffff 895ddc } // n = 7, score = 200 // aa | stosb byte ptr es:[edi], al // 6a40 | push 0x40 // 33c0 | xor eax, eax // 59 | pop ecx // 8dbdedfdffff | lea edi, [ebp - 0x213] // 889decfdffff | mov byte ptr [ebp - 0x214], bl // 895ddc | mov dword ptr [ebp - 0x24], ebx $sequence_16 = { c645c54d c645c653 c645c749 c645c845 } // n = 4, score = 200 // c645c54d | mov byte ptr [ebp - 0x3b], 0x4d // c645c653 | mov byte ptr [ebp - 0x3a], 0x53 // c645c749 | mov byte ptr [ebp - 0x39], 0x49 // c645c845 | mov byte ptr [ebp - 0x38], 0x45 $sequence_17 = { c644243778 c644243879 c644243953 c644243a65 885c243b } // n = 5, score = 200 // c644243778 | mov byte ptr [esp + 0x37], 0x78 // c644243879 | mov byte ptr [esp + 0x38], 0x79 // c644243953 | mov byte ptr [esp + 0x39], 0x53 // c644243a65 | mov byte ptr [esp + 0x3a], 0x65 // 885c243b | mov byte ptr [esp + 0x3b], bl $sequence_18 = { c645d673 c645d720 c645d84e c645d954 } // n = 4, score = 200 // c645d673 | mov byte ptr [ebp - 0x2a], 0x73 // c645d720 | mov byte ptr [ebp - 0x29], 0x20 // c645d84e | mov byte ptr [ebp - 0x28], 0x4e // c645d954 | mov byte ptr [ebp - 0x27], 0x54 $sequence_19 = { 034dec 8a11 8810 8b45f0 83c001 } // n = 5, score = 200 // 034dec | add ecx, dword ptr [ebp - 0x14] // 8a11 | mov dl, byte ptr [ecx] // 8810 | mov byte ptr [eax], dl // 8b45f0 | mov eax, dword ptr [ebp - 0x10] // 83c001 | add eax, 1 $sequence_20 = { 83c104 3b4d14 7608 83c8ff } // n = 4, score = 200 // 83c104 | add ecx, 4 // 3b4d14 | cmp ecx, dword ptr [ebp + 0x14] // 7608 | jbe 0xa // 83c8ff | or eax, 0xffffffff $sequence_21 = { 8d4a01 83c404 8bd1 c1e902 } // n = 4, score = 200 // 8d4a01 | lea ecx, [edx + 1] // 83c404 | add esp, 4 // 8bd1 | mov edx, ecx // c1e902 | shr ecx, 2 $sequence_22 = { 8d45f0 50 8bce e8???????? 33c0 } // n = 5, score = 200 // 8d45f0 | lea eax, [ebp - 0x10] // 50 | push eax // 8bce | mov ecx, esi // e8???????? | // 33c0 | xor eax, eax $sequence_23 = { 55 8bec 51 51 8d4df8 56 } // n = 6, score = 200 // 55 | push ebp // 8bec | mov ebp, esp // 51 | push ecx // 51 | push ecx // 8d4df8 | lea ecx, [ebp - 8] // 56 | push esi $sequence_24 = { c645fa74 c645fb2e c645fc64 c645fd6c c645fe6c } // n = 5, score = 200 // c645fa74 | mov byte ptr [ebp - 6], 0x74 // c645fb2e | mov byte ptr [ebp - 5], 0x2e // c645fc64 | mov byte ptr [ebp - 4], 0x64 // c645fd6c | mov byte ptr [ebp - 3], 0x6c // c645fe6c | mov byte ptr [ebp - 2], 0x6c $sequence_25 = { 85ed 741a 3b74245c 0f838c010000 8d442410 } // n = 5, score = 200 // 85ed | test ebp, ebp // 741a | je 0x1c // 3b74245c | cmp esi, dword ptr [esp + 0x5c] // 0f838c010000 | jae 0x192 // 8d442410 | lea eax, [esp + 0x10] $sequence_26 = { c645c16c c645c265 c645c33b c645c420 } // n = 4, score = 200 // c645c16c | mov byte ptr [ebp - 0x3f], 0x6c // c645c265 | mov byte ptr [ebp - 0x3e], 0x65 // c645c33b | mov byte ptr [ebp - 0x3d], 0x3b // c645c420 | mov byte ptr [ebp - 0x3c], 0x20 $sequence_27 = { 8d540964 52 e8???????? 83c404 } // n = 4, score = 200 // 8d540964 | lea edx, [ecx + ecx + 0x64] // 52 | push edx // e8???????? | // 83c404 | add esp, 4 $sequence_28 = { c645d057 c645d169 c645d26e c645d364 } // n = 4, score = 200 // c645d057 | mov byte ptr [ebp - 0x30], 0x57 // c645d169 | mov byte ptr [ebp - 0x2f], 0x69 // c645d26e | mov byte ptr [ebp - 0x2e], 0x6e // c645d364 | mov byte ptr [ebp - 0x2d], 0x64 $sequence_29 = { 034df0 8b5508 0355ec 8a02 } // n = 4, score = 200 // 034df0 | add ecx, dword ptr [ebp - 0x10] // 8b5508 | mov edx, dword ptr [ebp + 8] // 0355ec | add edx, dword ptr [ebp - 0x14] // 8a02 | mov al, byte ptr [edx] $sequence_30 = { c645a86e c645a974 c645aa72 c645ab6f c645ac6c c645ad3a } // n = 6, score = 200 // c645a86e | mov byte ptr [ebp - 0x58], 0x6e // c645a974 | mov byte ptr [ebp - 0x57], 0x74 // c645aa72 | mov byte ptr [ebp - 0x56], 0x72 // c645ab6f | mov byte ptr [ebp - 0x55], 0x6f // c645ac6c | mov byte ptr [ebp - 0x54], 0x6c // c645ad3a | mov byte ptr [ebp - 0x53], 0x3a $sequence_31 = { 8b45f4 0345f0 8b4d08 034dec 8a11 } // n = 5, score = 200 // 8b45f4 | mov eax, dword ptr [ebp - 0xc] // 0345f0 | add eax, dword ptr [ebp - 0x10] // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 034dec | add ecx, dword ptr [ebp - 0x14] // 8a11 | mov dl, byte ptr [ecx] $sequence_32 = { 80e10f c0e102 c0eb06 02cb } // n = 4, score = 200 // 80e10f | and cl, 0xf // c0e102 | shl cl, 2 // c0eb06 | shr bl, 6 // 02cb | add cl, bl $sequence_33 = { c645be74 c645bf69 c645c062 c645c16c } // n = 4, score = 200 // c645be74 | mov byte ptr [ebp - 0x42], 0x74 // c645bf69 | mov byte ptr [ebp - 0x41], 0x69 // c645c062 | mov byte ptr [ebp - 0x40], 0x62 // c645c16c | mov byte ptr [ebp - 0x3f], 0x6c $sequence_34 = { c645c33b c645c420 c645c54d c645c653 } // n = 4, score = 200 // c645c33b | mov byte ptr [ebp - 0x3d], 0x3b // c645c420 | mov byte ptr [ebp - 0x3c], 0x20 // c645c54d | mov byte ptr [ebp - 0x3b], 0x4d // c645c653 | mov byte ptr [ebp - 0x3a], 0x53 $sequence_35 = { 8a9405ecfdffff 889000cd4000 eb1c f6c202 7410 8088????????20 8a9405ecfcffff } // n = 7, score = 200 // 8a9405ecfdffff | mov dl, byte ptr [ebp + eax - 0x214] // 889000cd4000 | mov byte ptr [eax + 0x40cd00], dl // eb1c | jmp 0x1e // f6c202 | test dl, 2 // 7410 | je 0x12 // 8088????????20 | // 8a9405ecfcffff | mov dl, byte ptr [ebp + eax - 0x314] $sequence_36 = { 83c204 3b5514 7608 83c8ff } // n = 4, score = 200 // 83c204 | add edx, 4 // 3b5514 | cmp edx, dword ptr [ebp + 0x14] // 7608 | jbe 0xa // 83c8ff | or eax, 0xffffffff $sequence_37 = { 6a00 68???????? 6a00 6a00 6a00 51 68???????? } // n = 7, score = 200 // 6a00 | push 0 // 68???????? | // 6a00 | push 0 // 6a00 | push 0 // 6a00 | push 0 // 51 | push ecx // 68???????? | $sequence_38 = { 8b4d08 83c101 894d08 8b550c 83ea03 } // n = 5, score = 200 // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 83c101 | add ecx, 1 // 894d08 | mov dword ptr [ebp + 8], ecx // 8b550c | mov edx, dword ptr [ebp + 0xc] // 83ea03 | sub edx, 3 $sequence_39 = { 8b8dbcefffff 51 8b9554e6ffff 8b420c ffd0 8b8d9ceaffff 51 } // n = 7, score = 100 // 8b8dbcefffff | mov ecx, dword ptr [ebp - 0x1044] // 51 | push ecx // 8b9554e6ffff | mov edx, dword ptr [ebp - 0x19ac] // 8b420c | mov eax, dword ptr [edx + 0xc] // ffd0 | call eax // 8b8d9ceaffff | mov ecx, dword ptr [ebp - 0x1564] // 51 | push ecx condition: 7 of them and filesize < 450560 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY