There is no description at this point.
rule win_geminiduke_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.geminiduke." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.geminiduke" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { e8???????? 83c404 50 6801000080 ff15???????? 85c0 7407 } // n = 7, score = 400 // e8???????? | // 83c404 | add esp, 4 // 50 | push eax // 6801000080 | push 0x80000001 // ff15???????? | // 85c0 | test eax, eax // 7407 | je 9 $sequence_1 = { 50 6819000200 6a00 68???????? e8???????? 83c404 50 } // n = 7, score = 400 // 50 | push eax // 6819000200 | push 0x20019 // 6a00 | push 0 // 68???????? | // e8???????? | // 83c404 | add esp, 4 // 50 | push eax $sequence_2 = { 51 57 8b7c2410 8b442414 } // n = 4, score = 400 // 51 | push ecx // 57 | push edi // 8b7c2410 | mov edi, dword ptr [esp + 0x10] // 8b442414 | mov eax, dword ptr [esp + 0x14] $sequence_3 = { 8b7c2410 8b442414 8b4c2418 f3aa 5f } // n = 5, score = 400 // 8b7c2410 | mov edi, dword ptr [esp + 0x10] // 8b442414 | mov eax, dword ptr [esp + 0x14] // 8b4c2418 | mov ecx, dword ptr [esp + 0x18] // f3aa | rep stosb byte ptr es:[edi], al // 5f | pop edi $sequence_4 = { 034590 03c8 894dd0 8b45f8 } // n = 4, score = 300 // 034590 | add eax, dword ptr [ebp - 0x70] // 03c8 | add ecx, eax // 894dd0 | mov dword ptr [ebp - 0x30], ecx // 8b45f8 | mov eax, dword ptr [ebp - 8] $sequence_5 = { 034584 8b8d64ffffff c1e907 8b9564ffffff c1e219 0bca } // n = 6, score = 300 // 034584 | add eax, dword ptr [ebp - 0x7c] // 8b8d64ffffff | mov ecx, dword ptr [ebp - 0x9c] // c1e907 | shr ecx, 7 // 8b9564ffffff | mov edx, dword ptr [ebp - 0x9c] // c1e219 | shl edx, 0x19 // 0bca | or ecx, edx $sequence_6 = { 03459c 03c8 894ddc 8b45fc } // n = 4, score = 300 // 03459c | add eax, dword ptr [ebp - 0x64] // 03c8 | add ecx, eax // 894ddc | mov dword ptr [ebp - 0x24], ecx // 8b45fc | mov eax, dword ptr [ebp - 4] $sequence_7 = { 034590 8b8d70ffffff c1e907 8b9570ffffff } // n = 4, score = 300 // 034590 | add eax, dword ptr [ebp - 0x70] // 8b8d70ffffff | mov ecx, dword ptr [ebp - 0x90] // c1e907 | shr ecx, 7 // 8b9570ffffff | mov edx, dword ptr [ebp - 0x90] $sequence_8 = { 52 33db 8b7c2418 8b74241c 668b5c2420 33d2 33c0 } // n = 7, score = 200 // 52 | push edx // 33db | xor ebx, ebx // 8b7c2418 | mov edi, dword ptr [esp + 0x18] // 8b74241c | mov esi, dword ptr [esp + 0x1c] // 668b5c2420 | mov bx, word ptr [esp + 0x20] // 33d2 | xor edx, edx // 33c0 | xor eax, eax $sequence_9 = { 8ac1 0430 8ad1 80ea0a 80fa05 7705 } // n = 6, score = 200 // 8ac1 | mov al, cl // 0430 | add al, 0x30 // 8ad1 | mov dl, cl // 80ea0a | sub dl, 0xa // 80fa05 | cmp dl, 5 // 7705 | ja 7 $sequence_10 = { 80f919 7703 b001 c3 } // n = 4, score = 200 // 80f919 | cmp cl, 0x19 // 7703 | ja 5 // b001 | mov al, 1 // c3 | ret $sequence_11 = { 81ca00ffffff 42 0fb6c2 8a1c08 } // n = 4, score = 200 // 81ca00ffffff | or edx, 0xffffff00 // 42 | inc edx // 0fb6c2 | movzx eax, dl // 8a1c08 | mov bl, byte ptr [eax + ecx] $sequence_12 = { 33f3 c1ee03 337704 33e8 8b442410 c1ee12 83e601 } // n = 7, score = 200 // 33f3 | xor esi, ebx // c1ee03 | shr esi, 3 // 337704 | xor esi, dword ptr [edi + 4] // 33e8 | xor ebp, eax // 8b442410 | mov eax, dword ptr [esp + 0x10] // c1ee12 | shr esi, 0x12 // 83e601 | and esi, 1 $sequence_13 = { 0fb6f8 57 6a20 56 e8???????? } // n = 5, score = 200 // 0fb6f8 | movzx edi, al // 57 | push edi // 6a20 | push 0x20 // 56 | push esi // e8???????? | condition: 7 of them and filesize < 327680 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY