Actor(s): Greenbug
There is no description at this point.
rule win_ismdoor_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.ismdoor." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismdoor" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 83f8ff 7504 32c0 eb05 c0e804 2401 84c0 } // n = 7, score = 400 // 83f8ff | cmp eax, -1 // 7504 | jne 6 // 32c0 | xor al, al // eb05 | jmp 7 // c0e804 | shr al, 4 // 2401 | and al, 1 // 84c0 | test al, al $sequence_1 = { 90 48897c2428 488d4da0 48894c2420 4c8d4d80 4c8bc3 } // n = 6, score = 300 // 90 | nop // 48897c2428 | dec eax // 488d4da0 | mov dword ptr [esp + 0x28], edi // 48894c2420 | dec eax // 4c8d4d80 | lea ecx, [ebp - 0x60] // 4c8bc3 | dec eax $sequence_2 = { 7405 488b00 ebdd 48894500 } // n = 4, score = 300 // 7405 | mov dword ptr [esp + 0x20], ecx // 488b00 | dec esp // ebdd | lea ecx, [ebp - 0x80] // 48894500 | dec esp $sequence_3 = { 89442420 48c7411807000000 48894110 668901 c744242001000000 } // n = 5, score = 300 // 89442420 | mov eax, ebx // 48c7411807000000 | je 7 // 48894110 | dec eax // 668901 | mov eax, dword ptr [eax] // c744242001000000 | jmp 0xffffffe2 $sequence_4 = { 7613 498d4970 418bc2 41ffc2 } // n = 4, score = 300 // 7613 | dec eax // 498d4970 | mov dword ptr [ebp], eax // 418bc2 | mov dword ptr [esp + 0x20], eax // 41ffc2 | dec eax $sequence_5 = { 41ffc7 0f1f4000 418b16 488d4d38 e8???????? } // n = 5, score = 300 // 41ffc7 | mov dword ptr [ecx + 0x18], 7 // 0f1f4000 | dec eax // 418b16 | mov dword ptr [ecx + 0x10], eax // 488d4d38 | mov word ptr [ecx], ax // e8???????? | $sequence_6 = { 8bd8 33c9 ff15???????? 488bc8 } // n = 4, score = 300 // 8bd8 | inc ecx // 33c9 | mov eax, edx // ff15???????? | // 488bc8 | inc ecx $sequence_7 = { 488bd6 488bcf ff5030 488bc8 } // n = 4, score = 300 // 488bd6 | mov dword ptr [esp + 0x20], 1 // 488bcf | jbe 0x15 // ff5030 | dec ecx // 488bc8 | lea ecx, [ecx + 0x70] $sequence_8 = { 884c0dd8 41 83f910 7cf6 } // n = 4, score = 100 // 884c0dd8 | mov byte ptr [ebp + ecx - 0x28], cl // 41 | inc ecx // 83f910 | cmp ecx, 0x10 // 7cf6 | jl 0xfffffff8 $sequence_9 = { 83f802 7506 c6473c00 eb04 40 } // n = 5, score = 100 // 83f802 | cmp eax, 2 // 7506 | jne 8 // c6473c00 | mov byte ptr [edi + 0x3c], 0 // eb04 | jmp 6 // 40 | inc eax $sequence_10 = { 8b4804 83b9ec97480000 0f94c0 8845e4 c745fc01000000 } // n = 5, score = 100 // 8b4804 | mov ecx, dword ptr [eax + 4] // 83b9ec97480000 | cmp dword ptr [ecx + 0x4897ec], 0 // 0f94c0 | sete al // 8845e4 | mov byte ptr [ebp - 0x1c], al // c745fc01000000 | mov dword ptr [ebp - 4], 1 $sequence_11 = { c745f804000000 57 8a68fe 8d4004 8a48fb 8a78fc } // n = 6, score = 100 // c745f804000000 | mov dword ptr [ebp - 8], 4 // 57 | push edi // 8a68fe | mov ch, byte ptr [eax - 2] // 8d4004 | lea eax, [eax + 4] // 8a48fb | mov cl, byte ptr [eax - 5] // 8a78fc | mov bh, byte ptr [eax - 4] $sequence_12 = { 886dff 81e61f000080 7905 4e 83cee0 46 } // n = 6, score = 100 // 886dff | mov byte ptr [ebp - 1], ch // 81e61f000080 | and esi, 0x8000001f // 7905 | jns 7 // 4e | dec esi // 83cee0 | or esi, 0xffffffe0 // 46 | inc esi $sequence_13 = { e8???????? 83c404 c744246c0f000000 c744246800000000 c644245800 837c243c08 } // n = 6, score = 100 // e8???????? | // 83c404 | add esp, 4 // c744246c0f000000 | mov dword ptr [esp + 0x6c], 0xf // c744246800000000 | mov dword ptr [esp + 0x68], 0 // c644245800 | mov byte ptr [esp + 0x58], 0 // 837c243c08 | cmp dword ptr [esp + 0x3c], 8 $sequence_14 = { 75f2 8b7d10 8b07 3bf0 7421 8b4f04 } // n = 6, score = 100 // 75f2 | jne 0xfffffff4 // 8b7d10 | mov edi, dword ptr [ebp + 0x10] // 8b07 | mov eax, dword ptr [edi] // 3bf0 | cmp esi, eax // 7421 | je 0x23 // 8b4f04 | mov ecx, dword ptr [edi + 4] condition: 7 of them and filesize < 1933312 }
rule win_ismdoor_w0 { meta: author = "Florian Roth" reference = "https://goo.gl/urp4CD" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ismdoor" malpedia_version = "20180301" malpedia_license = "CC BY-NC-SA 4.0" malpedia_sharing = "TLP:WHITE" strings: $x1 = "cmd /u /c WMIC /Node:localhost /Namespace:\\\\root\\SecurityCenter" fullword ascii $x2 = "cmd /a /c net user administrator /domain >>" fullword ascii $x3 = "cmd /a /c netstat -ant >>\"%localappdata%\\Microsoft\\" fullword ascii $o1 = "========================== (Net User) ==========================" ascii fullword condition: 1 of them }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY