Actor(s): IXESHE
There is no description at this point.
rule win_etumbot_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.etumbot." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8a8405fcfeffff 320437 8806 46 } // n = 4, score = 400 // 8a8405fcfeffff | mov al, byte ptr [ebp + eax - 0x104] // 320437 | xor al, byte ptr [edi + esi] // 8806 | mov byte ptr [esi], al // 46 | inc esi $sequence_1 = { 8818 8811 8a00 02c2 0fb6c0 8a8405fcfeffff 320437 } // n = 7, score = 400 // 8818 | mov byte ptr [eax], bl // 8811 | mov byte ptr [ecx], dl // 8a00 | mov al, byte ptr [eax] // 02c2 | add al, dl // 0fb6c0 | movzx eax, al // 8a8405fcfeffff | mov al, byte ptr [ebp + eax - 0x104] // 320437 | xor al, byte ptr [edi + esi] $sequence_2 = { 57 0fbe38 33f6 33db } // n = 4, score = 300 // 57 | push edi // 0fbe38 | movsx edi, byte ptr [eax] // 33f6 | xor esi, esi // 33db | xor ebx, ebx $sequence_3 = { c745b46f66745c c745b85c57696e c745bc646f7773 c745c05c5c4375 c745c47272656e c745c874566572 } // n = 6, score = 300 // c745b46f66745c | mov dword ptr [ebp - 0x4c], 0x5c74666f // c745b85c57696e | mov dword ptr [ebp - 0x48], 0x6e69575c // c745bc646f7773 | mov dword ptr [ebp - 0x44], 0x73776f64 // c745c05c5c4375 | mov dword ptr [ebp - 0x40], 0x75435c5c // c745c47272656e | mov dword ptr [ebp - 0x3c], 0x6e657272 // c745c874566572 | mov dword ptr [ebp - 0x38], 0x72655674 $sequence_4 = { 81e1000000f0 7407 8bf9 c1ef18 } // n = 4, score = 300 // 81e1000000f0 | and ecx, 0xf0000000 // 7407 | je 9 // 8bf9 | mov edi, ecx // c1ef18 | shr edi, 0x18 $sequence_5 = { 33c7 f7d1 23c1 42 4e 75df 5f } // n = 7, score = 300 // 33c7 | xor eax, edi // f7d1 | not ecx // 23c1 | and eax, ecx // 42 | inc edx // 4e | dec esi // 75df | jne 0xffffffe1 // 5f | pop edi $sequence_6 = { c745ac5c5c4d69 c745b063726f73 c745b46f66745c c745b85c57696e } // n = 4, score = 300 // c745ac5c5c4d69 | mov dword ptr [ebp - 0x54], 0x694d5c5c // c745b063726f73 | mov dword ptr [ebp - 0x50], 0x736f7263 // c745b46f66745c | mov dword ptr [ebp - 0x4c], 0x5c74666f // c745b85c57696e | mov dword ptr [ebp - 0x48], 0x6e69575c $sequence_7 = { c745c05c5c4375 c745c47272656e c745c874566572 c745cc73696f6e c745d05c5c496e c745d47465726e c745d865742053 } // n = 7, score = 300 // c745c05c5c4375 | mov dword ptr [ebp - 0x40], 0x75435c5c // c745c47272656e | mov dword ptr [ebp - 0x3c], 0x6e657272 // c745c874566572 | mov dword ptr [ebp - 0x38], 0x72655674 // c745cc73696f6e | mov dword ptr [ebp - 0x34], 0x6e6f6973 // c745d05c5c496e | mov dword ptr [ebp - 0x30], 0x6e495c5c // c745d47465726e | mov dword ptr [ebp - 0x2c], 0x6e726574 // c745d865742053 | mov dword ptr [ebp - 0x28], 0x53207465 $sequence_8 = { 8bf1 0fbe0a c1e004 03c1 8bc8 81e1000000f0 7407 } // n = 7, score = 300 // 8bf1 | mov esi, ecx // 0fbe0a | movsx ecx, byte ptr [edx] // c1e004 | shl eax, 4 // 03c1 | add eax, ecx // 8bc8 | mov ecx, eax // 81e1000000f0 | and ecx, 0xf0000000 // 7407 | je 9 $sequence_9 = { 8d45f4 6820a10700 50 68???????? } // n = 4, score = 300 // 8d45f4 | lea eax, [ebp - 0xc] // 6820a10700 | push 0x7a120 // 50 | push eax // 68???????? | $sequence_10 = { 57 8b3d???????? ffd7 8b7508 8bd8 } // n = 5, score = 300 // 57 | push edi // 8b3d???????? | // ffd7 | call edi // 8b7508 | mov esi, dword ptr [ebp + 8] // 8bd8 | mov ebx, eax $sequence_11 = { ffd7 2bc3 3bc6 72ed 5f 5e } // n = 6, score = 300 // ffd7 | call edi // 2bc3 | sub eax, ebx // 3bc6 | cmp eax, esi // 72ed | jb 0xffffffef // 5f | pop edi // 5e | pop esi $sequence_12 = { c745d47465726e c745d865742053 c745dc65747469 c745e06e677300 } // n = 4, score = 300 // c745d47465726e | mov dword ptr [ebp - 0x2c], 0x6e726574 // c745d865742053 | mov dword ptr [ebp - 0x28], 0x53207465 // c745dc65747469 | mov dword ptr [ebp - 0x24], 0x69747465 // c745e06e677300 | mov dword ptr [ebp - 0x20], 0x73676e $sequence_13 = { 8bf9 c1ef18 33c7 f7d1 } // n = 4, score = 300 // 8bf9 | mov edi, ecx // c1ef18 | shr edi, 0x18 // 33c7 | xor eax, edi // f7d1 | not ecx $sequence_14 = { c6042800 5f 8bc5 5e } // n = 4, score = 200 // c6042800 | mov byte ptr [eax + ebp], 0 // 5f | pop edi // 8bc5 | mov eax, ebp // 5e | pop esi $sequence_15 = { c645c265 c645c33b c645c420 c645c54d } // n = 4, score = 200 // c645c265 | mov byte ptr [ebp - 0x3e], 0x65 // c645c33b | mov byte ptr [ebp - 0x3d], 0x3b // c645c420 | mov byte ptr [ebp - 0x3c], 0x20 // c645c54d | mov byte ptr [ebp - 0x3b], 0x4d $sequence_16 = { 8d4c2430 6a00 51 6801000080 } // n = 4, score = 200 // 8d4c2430 | lea ecx, [esp + 0x30] // 6a00 | push 0 // 51 | push ecx // 6801000080 | push 0x80000001 $sequence_17 = { 83c101 894d08 8b550c 83ea03 } // n = 4, score = 200 // 83c101 | add ecx, 1 // 894d08 | mov dword ptr [ebp + 8], ecx // 8b550c | mov edx, dword ptr [ebp + 0xc] // 83ea03 | sub edx, 3 $sequence_18 = { c645d057 c645d153 c645d241 c645d353 } // n = 4, score = 200 // c645d057 | mov byte ptr [ebp - 0x30], 0x57 // c645d153 | mov byte ptr [ebp - 0x2f], 0x53 // c645d241 | mov byte ptr [ebp - 0x2e], 0x41 // c645d353 | mov byte ptr [ebp - 0x2d], 0x53 $sequence_19 = { 8b45f4 0345f0 8b4d08 034dec } // n = 4, score = 200 // 8b45f4 | mov eax, dword ptr [ebp - 0xc] // 0345f0 | add eax, dword ptr [ebp - 0x10] // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 034dec | add ecx, dword ptr [ebp - 0x14] $sequence_20 = { 8b4d08 034dec 8a11 8810 8b45f0 83c001 } // n = 6, score = 200 // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 034dec | add ecx, dword ptr [ebp - 0x14] // 8a11 | mov dl, byte ptr [ecx] // 8810 | mov byte ptr [eax], dl // 8b45f0 | mov eax, dword ptr [ebp - 0x10] // 83c001 | add eax, 1 $sequence_21 = { 8d86fc100000 50 57 ff75c4 8bce } // n = 5, score = 200 // 8d86fc100000 | lea eax, [esi + 0x10fc] // 50 | push eax // 57 | push edi // ff75c4 | push dword ptr [ebp - 0x3c] // 8bce | mov ecx, esi $sequence_22 = { c645be74 c645bf69 c645c062 c645c16c } // n = 4, score = 200 // c645be74 | mov byte ptr [ebp - 0x42], 0x74 // c645bf69 | mov byte ptr [ebp - 0x41], 0x69 // c645c062 | mov byte ptr [ebp - 0x40], 0x62 // c645c16c | mov byte ptr [ebp - 0x3f], 0x6c $sequence_23 = { 53 83c9ff 57 8b7d10 8d4201 2bca 0fb610 } // n = 7, score = 200 // 53 | push ebx // 83c9ff | or ecx, 0xffffffff // 57 | push edi // 8b7d10 | mov edi, dword ptr [ebp + 0x10] // 8d4201 | lea eax, [edx + 1] // 2bca | sub ecx, edx // 0fb610 | movzx edx, byte ptr [eax] $sequence_24 = { 83c104 3b4d14 7608 83c8ff } // n = 4, score = 200 // 83c104 | add ecx, 4 // 3b4d14 | cmp ecx, dword ptr [ebp + 0x14] // 7608 | jbe 0xa // 83c8ff | or eax, 0xffffffff $sequence_25 = { 6a00 68???????? 6a00 6a00 6a00 51 } // n = 6, score = 200 // 6a00 | push 0 // 68???????? | // 6a00 | push 0 // 6a00 | push 0 // 6a00 | push 0 // 51 | push ecx $sequence_26 = { 8d540964 52 e8???????? 83c404 } // n = 4, score = 200 // 8d540964 | lea edx, [ecx + ecx + 0x64] // 52 | push edx // e8???????? | // 83c404 | add esp, 4 $sequence_27 = { c645d057 c645d169 c645d26e c645d364 } // n = 4, score = 200 // c645d057 | mov byte ptr [ebp - 0x30], 0x57 // c645d169 | mov byte ptr [ebp - 0x2f], 0x69 // c645d26e | mov byte ptr [ebp - 0x2e], 0x6e // c645d364 | mov byte ptr [ebp - 0x2d], 0x64 $sequence_28 = { 034df0 8b5508 0355ec 8a02 } // n = 4, score = 200 // 034df0 | add ecx, dword ptr [ebp - 0x10] // 8b5508 | mov edx, dword ptr [ebp + 8] // 0355ec | add edx, dword ptr [ebp - 0x14] // 8a02 | mov al, byte ptr [edx] $sequence_29 = { c645d673 c645d720 c645d84e c645d954 c645da20 } // n = 5, score = 200 // c645d673 | mov byte ptr [ebp - 0x2a], 0x73 // c645d720 | mov byte ptr [ebp - 0x29], 0x20 // c645d84e | mov byte ptr [ebp - 0x28], 0x4e // c645d954 | mov byte ptr [ebp - 0x27], 0x54 // c645da20 | mov byte ptr [ebp - 0x26], 0x20 $sequence_30 = { 80e10f c0e102 c0eb06 02cb } // n = 4, score = 200 // 80e10f | and cl, 0xf // c0e102 | shl cl, 2 // c0eb06 | shr bl, 6 // 02cb | add cl, bl $sequence_31 = { c645c420 c645c54d c645c653 c645c749 c645c845 c645c920 } // n = 6, score = 200 // c645c420 | mov byte ptr [ebp - 0x3c], 0x20 // c645c54d | mov byte ptr [ebp - 0x3b], 0x4d // c645c653 | mov byte ptr [ebp - 0x3a], 0x53 // c645c749 | mov byte ptr [ebp - 0x39], 0x49 // c645c845 | mov byte ptr [ebp - 0x38], 0x45 // c645c920 | mov byte ptr [ebp - 0x37], 0x20 $sequence_32 = { 8d4a01 83c404 8bd1 c1e902 f3ab 8bca 83e103 } // n = 7, score = 200 // 8d4a01 | lea ecx, [edx + 1] // 83c404 | add esp, 4 // 8bd1 | mov edx, ecx // c1e902 | shr ecx, 2 // f3ab | rep stosd dword ptr es:[edi], eax // 8bca | mov ecx, edx // 83e103 | and ecx, 3 $sequence_33 = { 50 e8???????? 83c418 8d45bc 53 } // n = 5, score = 200 // 50 | push eax // e8???????? | // 83c418 | add esp, 0x18 // 8d45bc | lea eax, [ebp - 0x44] // 53 | push ebx $sequence_34 = { aa c645ec50 c645ed72 c645ee6f c645ef78 c645f079 } // n = 6, score = 200 // aa | stosb byte ptr es:[edi], al // c645ec50 | mov byte ptr [ebp - 0x14], 0x50 // c645ed72 | mov byte ptr [ebp - 0x13], 0x72 // c645ee6f | mov byte ptr [ebp - 0x12], 0x6f // c645ef78 | mov byte ptr [ebp - 0x11], 0x78 // c645f079 | mov byte ptr [ebp - 0x10], 0x79 $sequence_35 = { ff75b8 ff15???????? ff75c0 e8???????? 59 } // n = 5, score = 200 // ff75b8 | push dword ptr [ebp - 0x48] // ff15???????? | // ff75c0 | push dword ptr [ebp - 0x40] // e8???????? | // 59 | pop ecx $sequence_36 = { 83c204 3b5514 7608 83c8ff } // n = 4, score = 200 // 83c204 | add edx, 4 // 3b5514 | cmp edx, dword ptr [ebp + 0x14] // 7608 | jbe 0xa // 83c8ff | or eax, 0xffffffff $sequence_37 = { c645cd31 c645ce3b c645cf20 c645d057 } // n = 4, score = 200 // c645cd31 | mov byte ptr [ebp - 0x33], 0x31 // c645ce3b | mov byte ptr [ebp - 0x32], 0x3b // c645cf20 | mov byte ptr [ebp - 0x31], 0x20 // c645d057 | mov byte ptr [ebp - 0x30], 0x57 $sequence_38 = { c645f477 c645f569 c645f66e c645f769 c645f86e } // n = 5, score = 200 // c645f477 | mov byte ptr [ebp - 0xc], 0x77 // c645f569 | mov byte ptr [ebp - 0xb], 0x69 // c645f66e | mov byte ptr [ebp - 0xa], 0x6e // c645f769 | mov byte ptr [ebp - 9], 0x69 // c645f86e | mov byte ptr [ebp - 8], 0x6e $sequence_39 = { c6857beaffff47 c6857ceaffff56 c6857deaffff25 c6857eeaffff64 c6857feaffff2e c68580eaffff6a c68581eaffff73 } // n = 7, score = 100 // c6857beaffff47 | mov byte ptr [ebp - 0x1585], 0x47 // c6857ceaffff56 | mov byte ptr [ebp - 0x1584], 0x56 // c6857deaffff25 | mov byte ptr [ebp - 0x1583], 0x25 // c6857eeaffff64 | mov byte ptr [ebp - 0x1582], 0x64 // c6857feaffff2e | mov byte ptr [ebp - 0x1581], 0x2e // c68580eaffff6a | mov byte ptr [ebp - 0x1580], 0x6a // c68581eaffff73 | mov byte ptr [ebp - 0x157f], 0x73 condition: 7 of them and filesize < 450560 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY