Actor(s): IXESHE
There is no description at this point.
rule win_etumbot_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.etumbot." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.etumbot" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8811 8a00 02c2 0fb6c0 8a8405fcfeffff 320437 8806 } // n = 7, score = 400 // 8811 | mov byte ptr [ecx], dl // 8a00 | mov al, byte ptr [eax] // 02c2 | add al, dl // 0fb6c0 | movzx eax, al // 8a8405fcfeffff | mov al, byte ptr [ebp + eax - 0x104] // 320437 | xor al, byte ptr [edi + esi] // 8806 | mov byte ptr [esi], al $sequence_1 = { 8bec 53 56 57 8b3d???????? ffd7 } // n = 6, score = 300 // 8bec | mov ebp, esp // 53 | push ebx // 56 | push esi // 57 | push edi // 8b3d???????? | // ffd7 | call edi $sequence_2 = { 7407 8bf9 c1ef18 33c7 f7d1 23c1 } // n = 6, score = 300 // 7407 | je 9 // 8bf9 | mov edi, ecx // c1ef18 | shr edi, 0x18 // 33c7 | xor eax, edi // f7d1 | not ecx // 23c1 | and eax, ecx $sequence_3 = { c745ac5c5c4d69 c745b063726f73 c745b46f66745c c745b85c57696e } // n = 4, score = 300 // c745ac5c5c4d69 | mov dword ptr [ebp - 0x54], 0x694d5c5c // c745b063726f73 | mov dword ptr [ebp - 0x50], 0x736f7263 // c745b46f66745c | mov dword ptr [ebp - 0x4c], 0x5c74666f // c745b85c57696e | mov dword ptr [ebp - 0x48], 0x6e69575c $sequence_4 = { c1e004 03c1 8bc8 81e1000000f0 7407 8bf9 } // n = 6, score = 300 // c1e004 | shl eax, 4 // 03c1 | add eax, ecx // 8bc8 | mov ecx, eax // 81e1000000f0 | and ecx, 0xf0000000 // 7407 | je 9 // 8bf9 | mov edi, ecx $sequence_5 = { 8d45f4 6820a10700 50 68???????? 68???????? } // n = 5, score = 300 // 8d45f4 | lea eax, [ebp - 0xc] // 6820a10700 | push 0x7a120 // 50 | push eax // 68???????? | // 68???????? | $sequence_6 = { c745c05c5c4375 c745c47272656e c745c874566572 c745cc73696f6e c745d05c5c496e } // n = 5, score = 300 // c745c05c5c4375 | mov dword ptr [ebp - 0x40], 0x75435c5c // c745c47272656e | mov dword ptr [ebp - 0x3c], 0x6e657272 // c745c874566572 | mov dword ptr [ebp - 0x38], 0x72655674 // c745cc73696f6e | mov dword ptr [ebp - 0x34], 0x6e6f6973 // c745d05c5c496e | mov dword ptr [ebp - 0x30], 0x6e495c5c $sequence_7 = { 42 4e 75df 5f } // n = 4, score = 300 // 42 | inc edx // 4e | dec esi // 75df | jne 0xffffffe1 // 5f | pop edi $sequence_8 = { ffd7 8b7508 8bd8 69f660ea0000 } // n = 4, score = 300 // ffd7 | call edi // 8b7508 | mov esi, dword ptr [ebp + 8] // 8bd8 | mov ebx, eax // 69f660ea0000 | imul esi, esi, 0xea60 $sequence_9 = { c745b46f66745c c745b85c57696e c745bc646f7773 c745c05c5c4375 } // n = 4, score = 300 // c745b46f66745c | mov dword ptr [ebp - 0x4c], 0x5c74666f // c745b85c57696e | mov dword ptr [ebp - 0x48], 0x6e69575c // c745bc646f7773 | mov dword ptr [ebp - 0x44], 0x73776f64 // c745c05c5c4375 | mov dword ptr [ebp - 0x40], 0x75435c5c $sequence_10 = { 57 0fbe38 33f6 33db } // n = 4, score = 300 // 57 | push edi // 0fbe38 | movsx edi, byte ptr [eax] // 33f6 | xor esi, esi // 33db | xor ebx, ebx $sequence_11 = { c745d47465726e c745d865742053 c745dc65747469 c745e06e677300 } // n = 4, score = 300 // c745d47465726e | mov dword ptr [ebp - 0x2c], 0x6e726574 // c745d865742053 | mov dword ptr [ebp - 0x28], 0x53207465 // c745dc65747469 | mov dword ptr [ebp - 0x24], 0x69747465 // c745e06e677300 | mov dword ptr [ebp - 0x20], 0x73676e $sequence_12 = { f7d1 23c1 42 4e } // n = 4, score = 300 // f7d1 | not ecx // 23c1 | and eax, ecx // 42 | inc edx // 4e | dec esi $sequence_13 = { ffd7 2bc3 3bc6 72ed } // n = 4, score = 300 // ffd7 | call edi // 2bc3 | sub eax, ebx // 3bc6 | cmp eax, esi // 72ed | jb 0xffffffef $sequence_14 = { c645bf69 c645c062 c645c16c c645c265 } // n = 4, score = 200 // c645bf69 | mov byte ptr [ebp - 0x41], 0x69 // c645c062 | mov byte ptr [ebp - 0x40], 0x62 // c645c16c | mov byte ptr [ebp - 0x3f], 0x6c // c645c265 | mov byte ptr [ebp - 0x3e], 0x65 $sequence_15 = { 80e10f c0e102 c0eb06 02cb } // n = 4, score = 200 // 80e10f | and cl, 0xf // c0e102 | shl cl, 2 // c0eb06 | shr bl, 6 // 02cb | add cl, bl $sequence_16 = { c645c16c c645c265 c645c33b c645c420 } // n = 4, score = 200 // c645c16c | mov byte ptr [ebp - 0x3f], 0x6c // c645c265 | mov byte ptr [ebp - 0x3e], 0x65 // c645c33b | mov byte ptr [ebp - 0x3d], 0x3b // c645c420 | mov byte ptr [ebp - 0x3c], 0x20 $sequence_17 = { 56 8bf1 8b08 83f903 } // n = 4, score = 200 // 56 | push esi // 8bf1 | mov esi, ecx // 8b08 | mov ecx, dword ptr [eax] // 83f903 | cmp ecx, 3 $sequence_18 = { c645c54d c645c653 c645c749 c645c845 c645c920 } // n = 5, score = 200 // c645c54d | mov byte ptr [ebp - 0x3b], 0x4d // c645c653 | mov byte ptr [ebp - 0x3a], 0x53 // c645c749 | mov byte ptr [ebp - 0x39], 0x49 // c645c845 | mov byte ptr [ebp - 0x38], 0x45 // c645c920 | mov byte ptr [ebp - 0x37], 0x20 $sequence_19 = { 84c9 74b6 5f 5e 8bc2 } // n = 5, score = 200 // 84c9 | test cl, cl // 74b6 | je 0xffffffb8 // 5f | pop edi // 5e | pop esi // 8bc2 | mov eax, edx $sequence_20 = { 33c0 56 89442418 57 89442420 } // n = 5, score = 200 // 33c0 | xor eax, eax // 56 | push esi // 89442418 | mov dword ptr [esp + 0x18], eax // 57 | push edi // 89442420 | mov dword ptr [esp + 0x20], eax $sequence_21 = { 0345f0 8b4d08 034dec 8a11 8810 8b45f0 83c001 } // n = 7, score = 200 // 0345f0 | add eax, dword ptr [ebp - 0x10] // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 034dec | add ecx, dword ptr [ebp - 0x14] // 8a11 | mov dl, byte ptr [ecx] // 8810 | mov byte ptr [eax], dl // 8b45f0 | mov eax, dword ptr [ebp - 0x10] // 83c001 | add eax, 1 $sequence_22 = { 750d 83c01c 8bce 50 e8???????? } // n = 5, score = 200 // 750d | jne 0xf // 83c01c | add eax, 0x1c // 8bce | mov ecx, esi // 50 | push eax // e8???????? | $sequence_23 = { 8d4a01 83c404 8bd1 c1e902 f3ab 8bca 83e103 } // n = 7, score = 200 // 8d4a01 | lea ecx, [edx + 1] // 83c404 | add esp, 4 // 8bd1 | mov edx, ecx // c1e902 | shr ecx, 2 // f3ab | rep stosd dword ptr es:[edi], eax // 8bca | mov ecx, edx // 83e103 | and ecx, 3 $sequence_24 = { 83c204 3b5514 7608 83c8ff } // n = 4, score = 200 // 83c204 | add edx, 4 // 3b5514 | cmp edx, dword ptr [ebp + 0x14] // 7608 | jbe 0xa // 83c8ff | or eax, 0xffffffff $sequence_25 = { 83c104 3b4d14 7608 83c8ff } // n = 4, score = 200 // 83c104 | add ecx, 4 // 3b4d14 | cmp ecx, dword ptr [ebp + 0x14] // 7608 | jbe 0xa // 83c8ff | or eax, 0xffffffff $sequence_26 = { 53 57 e8???????? 8d86b0000000 50 } // n = 5, score = 200 // 53 | push ebx // 57 | push edi // e8???????? | // 8d86b0000000 | lea eax, [esi + 0xb0] // 50 | push eax $sequence_27 = { 034df0 8b5508 0355ec 8a02 } // n = 4, score = 200 // 034df0 | add ecx, dword ptr [ebp - 0x10] // 8b5508 | mov edx, dword ptr [ebp + 8] // 0355ec | add edx, dword ptr [ebp - 0x14] // 8a02 | mov al, byte ptr [edx] $sequence_28 = { 52 e8???????? 83c404 e9???????? 6a05 } // n = 5, score = 200 // 52 | push edx // e8???????? | // 83c404 | add esp, 4 // e9???????? | // 6a05 | push 5 $sequence_29 = { c645d057 c645d169 c645d26e c645d364 } // n = 4, score = 200 // c645d057 | mov byte ptr [ebp - 0x30], 0x57 // c645d169 | mov byte ptr [ebp - 0x2f], 0x69 // c645d26e | mov byte ptr [ebp - 0x2e], 0x6e // c645d364 | mov byte ptr [ebp - 0x2d], 0x64 $sequence_30 = { 6a00 68???????? 6a00 6a00 6a00 51 68???????? } // n = 7, score = 200 // 6a00 | push 0 // 68???????? | // 6a00 | push 0 // 6a00 | push 0 // 6a00 | push 0 // 51 | push ecx // 68???????? | $sequence_31 = { 83fa01 7538 8b4514 8b19 0fb60438 c1e802 } // n = 6, score = 200 // 83fa01 | cmp edx, 1 // 7538 | jne 0x3a // 8b4514 | mov eax, dword ptr [ebp + 0x14] // 8b19 | mov ebx, dword ptr [ecx] // 0fb60438 | movzx eax, byte ptr [eax + edi] // c1e802 | shr eax, 2 $sequence_32 = { 46 eb0f 0fb6d2 f68201ce400004 7403 40 ff01 } // n = 7, score = 200 // 46 | inc esi // eb0f | jmp 0x11 // 0fb6d2 | movzx edx, dl // f68201ce400004 | test byte ptr [edx + 0x40ce01], 4 // 7403 | je 5 // 40 | inc eax // ff01 | inc dword ptr [ecx] $sequence_33 = { 8b4d08 83c101 894d08 8b550c 83ea03 } // n = 5, score = 200 // 8b4d08 | mov ecx, dword ptr [ebp + 8] // 83c101 | add ecx, 1 // 894d08 | mov dword ptr [ebp + 8], ecx // 8b550c | mov edx, dword ptr [ebp + 0xc] // 83ea03 | sub edx, 3 $sequence_34 = { 50 57 8bce e8???????? 8d45f0 8d7e70 } // n = 6, score = 200 // 50 | push eax // 57 | push edi // 8bce | mov ecx, esi // e8???????? | // 8d45f0 | lea eax, [ebp - 0x10] // 8d7e70 | lea edi, [esi + 0x70] $sequence_35 = { c68543fffffff7 c68544ffffff52 c68545ffffff91 c68546ffffff1c c68547fffffff7 c68548ffffff64 c68549ffffffa3 } // n = 7, score = 100 // c68543fffffff7 | mov byte ptr [ebp - 0xbd], 0xf7 // c68544ffffff52 | mov byte ptr [ebp - 0xbc], 0x52 // c68545ffffff91 | mov byte ptr [ebp - 0xbb], 0x91 // c68546ffffff1c | mov byte ptr [ebp - 0xba], 0x1c // c68547fffffff7 | mov byte ptr [ebp - 0xb9], 0xf7 // c68548ffffff64 | mov byte ptr [ebp - 0xb8], 0x64 // c68549ffffffa3 | mov byte ptr [ebp - 0xb7], 0xa3 $sequence_36 = { c685ddfdffffa4 c685defdffffb3 c685dffdffff02 c685e0fdffff30 c685e1fdffffd6 c685e2fdfffffb } // n = 6, score = 100 // c685ddfdffffa4 | mov byte ptr [ebp - 0x223], 0xa4 // c685defdffffb3 | mov byte ptr [ebp - 0x222], 0xb3 // c685dffdffff02 | mov byte ptr [ebp - 0x221], 2 // c685e0fdffff30 | mov byte ptr [ebp - 0x220], 0x30 // c685e1fdffffd6 | mov byte ptr [ebp - 0x21f], 0xd6 // c685e2fdfffffb | mov byte ptr [ebp - 0x21e], 0xfb condition: 7 of them and filesize < 450560 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY