SYMBOLCOMMON_NAMEaka. SYNONYMS
win.icondown (Back to overview)

IconDown

Actor(s): BlackTech


There is no description at this point.

References
2019-11-21JPCERT/CC田中 信太郎(Shintaro Tanaka)
@online{tanaka:20191121:icondown:cb082bf, author = {田中 信太郎(Shintaro Tanaka)}, title = {{IconDown – Downloader Used by BlackTech}}, date = {2019-11-21}, organization = {JPCERT/CC}, url = {https://blogs.jpcert.or.jp/en/2019/11/icondown-downloader-used-by-blacktech.html}, language = {English}, urldate = {2020-01-08} } IconDown – Downloader Used by BlackTech
IconDown
Yara Rules
[TLP:WHITE] win_icondown_auto (20201023 | autogenerated rule brought to you by yara-signator)
rule win_icondown_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.icondown"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d4e50 f7d0 a801 51 57 746a e8???????? }
            // n = 7, score = 200
            //   8d4e50               | lea                 ecx, [esi + 0x50]
            //   f7d0                 | not                 eax
            //   a801                 | test                al, 1
            //   51                   | push                ecx
            //   57                   | push                edi
            //   746a                 | je                  0x6c
            //   e8????????           |                     

        $sequence_1 = { 8d44246c 55 50 e8???????? 83c40c 8bc3 5f }
            // n = 7, score = 200
            //   8d44246c             | lea                 eax, [esp + 0x6c]
            //   55                   | push                ebp
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   8bc3                 | mov                 eax, ebx
            //   5f                   | pop                 edi

        $sequence_2 = { 89742404 e8???????? 8d8eb8000000 c744241000000000 e8???????? 8d8ec0000000 c644241001 }
            // n = 7, score = 200
            //   89742404             | mov                 dword ptr [esp + 4], esi
            //   e8????????           |                     
            //   8d8eb8000000         | lea                 ecx, [esi + 0xb8]
            //   c744241000000000     | mov                 dword ptr [esp + 0x10], 0
            //   e8????????           |                     
            //   8d8ec0000000         | lea                 ecx, [esi + 0xc0]
            //   c644241001           | mov                 byte ptr [esp + 0x10], 1

        $sequence_3 = { 03d0 b81f85eb51 03d3 8bda 33d2 8a5103 }
            // n = 6, score = 200
            //   03d0                 | add                 edx, eax
            //   b81f85eb51           | mov                 eax, 0x51eb851f
            //   03d3                 | add                 edx, ebx
            //   8bda                 | mov                 ebx, edx
            //   33d2                 | xor                 edx, edx
            //   8a5103               | mov                 dl, byte ptr [ecx + 3]

        $sequence_4 = { 6a00 c70700000000 8b868c000000 680b130000 }
            // n = 4, score = 200
            //   6a00                 | push                0
            //   c70700000000         | mov                 dword ptr [edi], 0
            //   8b868c000000         | mov                 eax, dword ptr [esi + 0x8c]
            //   680b130000           | push                0x130b

        $sequence_5 = { c644246073 c64424616c c644246275 c644246369 }
            // n = 4, score = 200
            //   c644246073           | mov                 byte ptr [esp + 0x60], 0x73
            //   c64424616c           | mov                 byte ptr [esp + 0x61], 0x6c
            //   c644246275           | mov                 byte ptr [esp + 0x62], 0x75
            //   c644246369           | mov                 byte ptr [esp + 0x63], 0x69

        $sequence_6 = { 66894674 66894676 66894678 6689467a e8???????? 8d8e80000000 e8???????? }
            // n = 7, score = 200
            //   66894674             | mov                 word ptr [esi + 0x74], ax
            //   66894676             | mov                 word ptr [esi + 0x76], ax
            //   66894678             | mov                 word ptr [esi + 0x78], ax
            //   6689467a             | mov                 word ptr [esi + 0x7a], ax
            //   e8????????           |                     
            //   8d8e80000000         | lea                 ecx, [esi + 0x80]
            //   e8????????           |                     

        $sequence_7 = { 8bce c644241c19 f7d9 1bc9 23cd c701???????? e8???????? }
            // n = 7, score = 200
            //   8bce                 | mov                 ecx, esi
            //   c644241c19           | mov                 byte ptr [esp + 0x1c], 0x19
            //   f7d9                 | neg                 ecx
            //   1bc9                 | sbb                 ecx, ecx
            //   23cd                 | and                 ecx, ebp
            //   c701????????         |                     
            //   e8????????           |                     

        $sequence_8 = { 8b0d???????? 8b4004 33d2 85db }
            // n = 4, score = 200
            //   8b0d????????         |                     
            //   8b4004               | mov                 eax, dword ptr [eax + 4]
            //   33d2                 | xor                 edx, edx
            //   85db                 | test                ebx, ebx

        $sequence_9 = { 83f808 0f8740010000 ff24853f524200 6a03 eb47 6a08 eb43 }
            // n = 7, score = 200
            //   83f808               | cmp                 eax, 8
            //   0f8740010000         | ja                  0x146
            //   ff24853f524200       | jmp                 dword ptr [eax*4 + 0x42523f]
            //   6a03                 | push                3
            //   eb47                 | jmp                 0x49
            //   6a08                 | push                8
            //   eb43                 | jmp                 0x45

    condition:
        7 of them and filesize < 5505024
}
Download all Yara Rules