Actor(s): DragonOK, Samurai Panda
There is no description at this point.
rule win_former_first_rat_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.former_first_rat." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.former_first_rat" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8d45ec 50 51 8d4df0 e8???????? 8b45e8 } // n = 6, score = 200 // 8d45ec | lea eax, [ebp - 0x14] // 50 | push eax // 51 | push ecx // 8d4df0 | lea ecx, [ebp - 0x10] // e8???????? | // 8b45e8 | mov eax, dword ptr [ebp - 0x18] $sequence_1 = { 83c002 8d4c3920 89bda8fbffff 8985acfbffff 3b4b04 7e5a 8bc1 } // n = 7, score = 200 // 83c002 | add eax, 2 // 8d4c3920 | lea ecx, [ecx + edi + 0x20] // 89bda8fbffff | mov dword ptr [ebp - 0x458], edi // 8985acfbffff | mov dword ptr [ebp - 0x454], eax // 3b4b04 | cmp ecx, dword ptr [ebx + 4] // 7e5a | jle 0x5c // 8bc1 | mov eax, ecx $sequence_2 = { 0f94c0 a3???????? 6808020000 6a00 68???????? e8???????? 83c40c } // n = 7, score = 200 // 0f94c0 | sete al // a3???????? | // 6808020000 | push 0x208 // 6a00 | push 0 // 68???????? | // e8???????? | // 83c40c | add esp, 0xc $sequence_3 = { e8???????? 68???????? bb01000000 8db504ffffff e8???????? } // n = 5, score = 200 // e8???????? | // 68???????? | // bb01000000 | mov ebx, 1 // 8db504ffffff | lea esi, [ebp - 0xfc] // e8???????? | $sequence_4 = { 8b950cffffff 83c404 52 e8???????? 8b4dfc } // n = 5, score = 200 // 8b950cffffff | mov edx, dword ptr [ebp - 0xf4] // 83c404 | add esp, 4 // 52 | push edx // e8???????? | // 8b4dfc | mov ecx, dword ptr [ebp - 4] $sequence_5 = { e8???????? 83c410 807e0432 0f850bffffff } // n = 4, score = 200 // e8???????? | // 83c410 | add esp, 0x10 // 807e0432 | cmp byte ptr [esi + 4], 0x32 // 0f850bffffff | jne 0xffffff11 $sequence_6 = { 75f8 49 668917 75ec } // n = 4, score = 200 // 75f8 | jne 0xfffffffa // 49 | dec ecx // 668917 | mov word ptr [edi], dx // 75ec | jne 0xffffffee $sequence_7 = { 52 56 56 6a30 56 33c0 56 } // n = 7, score = 200 // 52 | push edx // 56 | push esi // 56 | push esi // 6a30 | push 0x30 // 56 | push esi // 33c0 | xor eax, eax // 56 | push esi $sequence_8 = { 03c1 89442468 413bc5 7250 } // n = 4, score = 100 // 03c1 | inc ecx // 89442468 | movzx ecx, dl // 413bc5 | inc edx // 7250 | xor dl, byte ptr [ecx + eax] $sequence_9 = { 03c2 83e003 3bc2 7516 418bc2 } // n = 5, score = 100 // 03c2 | mov byte ptr [ebx], dl // 83e003 | inc edx // 3bc2 | xor byte ptr [ecx + eax], dl // 7516 | inc edx // 418bc2 | mov cl, byte ptr [ecx + eax] $sequence_10 = { 017130 83793005 7407 33c0 } // n = 4, score = 100 // 017130 | add dword ptr [ecx + 0x30], esi // 83793005 | cmp dword ptr [ecx + 0x30], 5 // 7407 | je 9 // 33c0 | xor eax, eax $sequence_11 = { 02c8 488d05f0f60100 02c9 4002ce } // n = 4, score = 100 // 02c8 | mov eax, dword ptr [ecx + 0x10] // 488d05f0f60100 | cmp dword ptr [eax + 0x94], 0 // 02c9 | add cl, al // 4002ce | dec eax $sequence_12 = { 03cd 8908 f6437804 7417 } // n = 4, score = 100 // 03cd | jne 0x1d // 8908 | inc ecx // f6437804 | mov eax, edx // 7417 | add eax, edx $sequence_13 = { 03cf 8908 488b4340 48833800 } // n = 4, score = 100 // 03cf | inc ecx // 8908 | xor byte ptr [ebx + edi], dl // 488b4340 | add ecx, edx // 48833800 | movzx ecx, cl $sequence_14 = { 03ca 0fb6c9 428a1401 4130143b } // n = 4, score = 100 // 03ca | mov dword ptr [esp + 0x68], eax // 0fb6c9 | inc ecx // 428a1401 | cmp eax, ebp // 4130143b | jb 0x55 $sequence_15 = { 02ca 4402d1 410fb6ca 42321401 } // n = 4, score = 100 // 02ca | dec eax // 4402d1 | cmp edi, eax // 410fb6ca | add cl, al // 42321401 | dec eax condition: 7 of them and filesize < 626688 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY