SYMBOLCOMMON_NAMEaka. SYNONYMS
win.httpbrowser (Back to overview)

HttpBrowser

aka: HttpDump

Actor(s): Wekby, EMISSARY PANDA

VTCollection    

There is no description at this point.

References
2020-01-01SecureworksSecureWorks
BRONZE UNION
9002 RAT CHINACHOPPER Enfal Ghost RAT HttpBrowser HyperBro owaauth PlugX Poison Ivy ZXShell APT27
2018-05-18NCC GroupNikolaos Pantazopoulos, Thomas Henry
Emissary Panda – A potential new malicious tool
HttpBrowser
2017-05-31MITREMITRE
APT18
Ghost RAT HttpBrowser APT18
2016-10-17ThreatConnectThreatConnect
A Tale of Two Targets
HttpBrowser APT27
2015-02-27ThreatConnectThreatConnect Research Team
The Anthem Hack: All Roads Lead to China
HttpBrowser
2015-02-06CrowdStrikeCrowdStrike
CrowdStrike Global Threat Intel Report 2014
BlackPOS CryptoLocker Derusbi Elise Enfal EvilGrab Gameover P2P HttpBrowser Medusa Mirage Naikon NetTraveler pirpi PlugX Poison Ivy Sakula RAT Sinowal sykipot taidoor
Yara Rules
[TLP:WHITE] win_httpbrowser_auto (20230808 | Detects win.httpbrowser.)
rule win_httpbrowser_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.httpbrowser."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.httpbrowser"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 50 ff7508 6a00 53 ffd6 8b45fc 33c9 }
            // n = 7, score = 200
            //   50                   | push                eax
            //   ff7508               | push                dword ptr [ebp + 8]
            //   6a00                 | push                0
            //   53                   | push                ebx
            //   ffd6                 | call                esi
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   33c9                 | xor                 ecx, ecx

        $sequence_1 = { 50 895de0 ff5604 8945f0 85db 0f8489010000 }
            // n = 6, score = 200
            //   50                   | push                eax
            //   895de0               | mov                 dword ptr [ebp - 0x20], ebx
            //   ff5604               | call                dword ptr [esi + 4]
            //   8945f0               | mov                 dword ptr [ebp - 0x10], eax
            //   85db                 | test                ebx, ebx
            //   0f8489010000         | je                  0x18f

        $sequence_2 = { 33c5 8945fc 53 56 57 8d859cfeffff 33ff }
            // n = 7, score = 200
            //   33c5                 | xor                 eax, ebp
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   53                   | push                ebx
            //   56                   | push                esi
            //   57                   | push                edi
            //   8d859cfeffff         | lea                 eax, [ebp - 0x164]
            //   33ff                 | xor                 edi, edi

        $sequence_3 = { 8d85f0fdffff 50 8d85d0f5ffff 50 ff15???????? }
            // n = 5, score = 200
            //   8d85f0fdffff         | lea                 eax, [ebp - 0x210]
            //   50                   | push                eax
            //   8d85d0f5ffff         | lea                 eax, [ebp - 0xa30]
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_4 = { 56 6a03 6800000040 8d85f4fdffff 50 ff15???????? }
            // n = 6, score = 200
            //   56                   | push                esi
            //   6a03                 | push                3
            //   6800000040           | push                0x40000000
            //   8d85f4fdffff         | lea                 eax, [ebp - 0x20c]
            //   50                   | push                eax
            //   ff15????????         |                     

        $sequence_5 = { e8???????? 83c40c 33c0 56 668985c8f3ffff 8d85caf3ffff }
            // n = 6, score = 200
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   33c0                 | xor                 eax, eax
            //   56                   | push                esi
            //   668985c8f3ffff       | mov                 word ptr [ebp - 0xc38], ax
            //   8d85caf3ffff         | lea                 eax, [ebp - 0xc36]

        $sequence_6 = { 83c438 ff15???????? 8d85f4fdffff 50 53 57 }
            // n = 6, score = 200
            //   83c438               | add                 esp, 0x38
            //   ff15????????         |                     
            //   8d85f4fdffff         | lea                 eax, [ebp - 0x20c]
            //   50                   | push                eax
            //   53                   | push                ebx
            //   57                   | push                edi

        $sequence_7 = { ffb5f4edffff 8d85fcfdffff ffb5f8edffff 68???????? 50 }
            // n = 5, score = 200
            //   ffb5f4edffff         | push                dword ptr [ebp - 0x120c]
            //   8d85fcfdffff         | lea                 eax, [ebp - 0x204]
            //   ffb5f8edffff         | push                dword ptr [ebp - 0x1208]
            //   68????????           |                     
            //   50                   | push                eax

        $sequence_8 = { e8???????? 68c20ddf13 56 a3???????? e8???????? 83c438 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   68c20ddf13           | push                0x13df0dc2
            //   56                   | push                esi
            //   a3????????           |                     
            //   e8????????           |                     
            //   83c438               | add                 esp, 0x38

        $sequence_9 = { 6a00 6810040000 ff15???????? 8bf0 57 6a0e 56 }
            // n = 7, score = 100
            //   6a00                 | push                0
            //   6810040000           | push                0x410
            //   ff15????????         |                     
            //   8bf0                 | mov                 esi, eax
            //   57                   | push                edi
            //   6a0e                 | push                0xe
            //   56                   | push                esi

        $sequence_10 = { 83c414 c745ec00000000 68???????? 50 9c b80a000000 51 }
            // n = 7, score = 100
            //   83c414               | add                 esp, 0x14
            //   c745ec00000000       | mov                 dword ptr [ebp - 0x14], 0
            //   68????????           |                     
            //   50                   | push                eax
            //   9c                   | pushfd              
            //   b80a000000           | mov                 eax, 0xa
            //   51                   | push                ecx

        $sequence_11 = { b905000000 8db524ffffff 8dbda4feffff 8945e4 }
            // n = 4, score = 100
            //   b905000000           | mov                 ecx, 5
            //   8db524ffffff         | lea                 esi, [ebp - 0xdc]
            //   8dbda4feffff         | lea                 edi, [ebp - 0x15c]
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax

        $sequence_12 = { 33c0 8dbd26ffffff 66899524ffffff f3ab 8955e8 8955f8 8955fc }
            // n = 7, score = 100
            //   33c0                 | xor                 eax, eax
            //   8dbd26ffffff         | lea                 edi, [ebp - 0xda]
            //   66899524ffffff       | mov                 word ptr [ebp - 0xdc], dx
            //   f3ab                 | rep stosd           dword ptr es:[edi], eax
            //   8955e8               | mov                 dword ptr [ebp - 0x18], edx
            //   8955f8               | mov                 dword ptr [ebp - 8], edx
            //   8955fc               | mov                 dword ptr [ebp - 4], edx

        $sequence_13 = { 40 0068ae 224000 50 b822010000 }
            // n = 5, score = 100
            //   40                   | inc                 eax
            //   0068ae               | add                 byte ptr [eax - 0x52], ch
            //   224000               | and                 al, byte ptr [eax]
            //   50                   | push                eax
            //   b822010000           | mov                 eax, 0x122

        $sequence_14 = { 8895a0c5ffff f3ab aa b91f000000 33c0 8dbd4affffff 66899548ffffff }
            // n = 7, score = 100
            //   8895a0c5ffff         | mov                 byte ptr [ebp - 0x3a60], dl
            //   f3ab                 | rep stosd           dword ptr es:[edi], eax
            //   aa                   | stosb               byte ptr es:[edi], al
            //   b91f000000           | mov                 ecx, 0x1f
            //   33c0                 | xor                 eax, eax
            //   8dbd4affffff         | lea                 edi, [ebp - 0xb6]
            //   66899548ffffff       | mov                 word ptr [ebp - 0xb8], dx

        $sequence_15 = { 8b15???????? 8945d8 a1???????? 894ddc 668b0d???????? }
            // n = 5, score = 100
            //   8b15????????         |                     
            //   8945d8               | mov                 dword ptr [ebp - 0x28], eax
            //   a1????????           |                     
            //   894ddc               | mov                 dword ptr [ebp - 0x24], ecx
            //   668b0d????????       |                     

    condition:
        7 of them and filesize < 188416
}
Download all Yara Rules