There is no description at this point.
rule win_hunter_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.hunter." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hunter" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8d4323 03c8 8d83b5000000 038d3cffffff 03c8 8d83ae000000 03ce } // n = 7, score = 100 // 8d4323 | lea eax, [ebx + 0x23] // 03c8 | add ecx, eax // 8d83b5000000 | lea eax, [ebx + 0xb5] // 038d3cffffff | add ecx, dword ptr [ebp - 0xc4] // 03c8 | add ecx, eax // 8d83ae000000 | lea eax, [ebx + 0xae] // 03ce | add ecx, esi $sequence_1 = { 8b5f08 8b440104 8945f0 8b13 8bc8 e8???????? 85c0 } // n = 7, score = 100 // 8b5f08 | mov ebx, dword ptr [edi + 8] // 8b440104 | mov eax, dword ptr [ecx + eax + 4] // 8945f0 | mov dword ptr [ebp - 0x10], eax // 8b13 | mov edx, dword ptr [ebx] // 8bc8 | mov ecx, eax // e8???????? | // 85c0 | test eax, eax $sequence_2 = { 8d4b38 0faf4dbc 898d34fdffff 8b8d1cffffff 0fafce 8d7375 898d8cfeffff } // n = 7, score = 100 // 8d4b38 | lea ecx, [ebx + 0x38] // 0faf4dbc | imul ecx, dword ptr [ebp - 0x44] // 898d34fdffff | mov dword ptr [ebp - 0x2cc], ecx // 8b8d1cffffff | mov ecx, dword ptr [ebp - 0xe4] // 0fafce | imul ecx, esi // 8d7375 | lea esi, [ebx + 0x75] // 898d8cfeffff | mov dword ptr [ebp - 0x174], ecx $sequence_3 = { 8bf9 6b1f14 8b743b0c eb38 0fbf0475080f4700 83f8c2 7433 } // n = 7, score = 100 // 8bf9 | mov edi, ecx // 6b1f14 | imul ebx, dword ptr [edi], 0x14 // 8b743b0c | mov esi, dword ptr [ebx + edi + 0xc] // eb38 | jmp 0x3a // 0fbf0475080f4700 | movsx eax, word ptr [esi*2 + 0x470f08] // 83f8c2 | cmp eax, -0x3e // 7433 | je 0x35 $sequence_4 = { 8b4c2440 6aff e8???????? 59 8b4c2448 33c0 89442424 } // n = 7, score = 100 // 8b4c2440 | mov ecx, dword ptr [esp + 0x40] // 6aff | push -1 // e8???????? | // 59 | pop ecx // 8b4c2448 | mov ecx, dword ptr [esp + 0x48] // 33c0 | xor eax, eax // 89442424 | mov dword ptr [esp + 0x24], eax $sequence_5 = { 53 6a68 5a e8???????? 83c40c b208 8bce } // n = 7, score = 100 // 53 | push ebx // 6a68 | push 0x68 // 5a | pop edx // e8???????? | // 83c40c | add esp, 0xc // b208 | mov dl, 8 // 8bce | mov ecx, esi $sequence_6 = { 8b4630 8b14b8 85d2 7405 e8???????? b980000000 e8???????? } // n = 7, score = 100 // 8b4630 | mov eax, dword ptr [esi + 0x30] // 8b14b8 | mov edx, dword ptr [eax + edi*4] // 85d2 | test edx, edx // 7405 | je 7 // e8???????? | // b980000000 | mov ecx, 0x80 // e8???????? | $sequence_7 = { c3 51 56 57 8bf1 33c0 8b7e1c } // n = 7, score = 100 // c3 | ret // 51 | push ecx // 56 | push esi // 57 | push edi // 8bf1 | mov esi, ecx // 33c0 | xor eax, eax // 8b7e1c | mov edi, dword ptr [esi + 0x1c] $sequence_8 = { 8b4614 89442418 85c0 750c 385c2431 7506 885c2430 } // n = 7, score = 100 // 8b4614 | mov eax, dword ptr [esi + 0x14] // 89442418 | mov dword ptr [esp + 0x18], eax // 85c0 | test eax, eax // 750c | jne 0xe // 385c2431 | cmp byte ptr [esp + 0x31], bl // 7506 | jne 8 // 885c2430 | mov byte ptr [esp + 0x30], bl $sequence_9 = { 8d8d04f8ffff e9???????? 8d8d1cf8ffff e9???????? 8d8de0feffff e9???????? 8d8d34f8ffff } // n = 7, score = 100 // 8d8d04f8ffff | lea ecx, [ebp - 0x7fc] // e9???????? | // 8d8d1cf8ffff | lea ecx, [ebp - 0x7e4] // e9???????? | // 8d8de0feffff | lea ecx, [ebp - 0x120] // e9???????? | // 8d8d34f8ffff | lea ecx, [ebp - 0x7cc] condition: 7 of them and filesize < 1056768 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY