Actor(s): DarkHotel
There is no description at this point.
rule win_jaku_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.jaku." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.jaku" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { eb10 8b451c c745f013000000 8945e0 8945dc } // n = 5, score = 1500 // eb10 | jmp 0x12 // 8b451c | mov eax, dword ptr [ebp + 0x1c] // c745f013000000 | mov dword ptr [ebp - 0x10], 0x13 // 8945e0 | mov dword ptr [ebp - 0x20], eax // 8945dc | mov dword ptr [ebp - 0x24], eax $sequence_1 = { 85ff 7e30 53 bb???????? 53 e8???????? 3bf8 } // n = 7, score = 1500 // 85ff | test edi, edi // 7e30 | jle 0x32 // 53 | push ebx // bb???????? | // 53 | push ebx // e8???????? | // 3bf8 | cmp edi, eax $sequence_2 = { 5b 8bd3 3bc3 8955ec 7613 } // n = 5, score = 1500 // 5b | pop ebx // 8bd3 | mov edx, ebx // 3bc3 | cmp eax, ebx // 8955ec | mov dword ptr [ebp - 0x14], edx // 7613 | jbe 0x15 $sequence_3 = { 0f843c010000 8b45fc ff4df8 8bcf 0fb600 d3e0 03d8 } // n = 7, score = 1500 // 0f843c010000 | je 0x142 // 8b45fc | mov eax, dword ptr [ebp - 4] // ff4df8 | dec dword ptr [ebp - 8] // 8bcf | mov ecx, edi // 0fb600 | movzx eax, byte ptr [eax] // d3e0 | shl eax, cl // 03d8 | add ebx, eax $sequence_4 = { 83ff01 895dd4 8955d0 8955f4 8d4aff 894dcc 750c } // n = 7, score = 1500 // 83ff01 | cmp edi, 1 // 895dd4 | mov dword ptr [ebp - 0x2c], ebx // 8955d0 | mov dword ptr [ebp - 0x30], edx // 8955f4 | mov dword ptr [ebp - 0xc], edx // 8d4aff | lea ecx, [edx - 1] // 894dcc | mov dword ptr [ebp - 0x34], ecx // 750c | jne 0xe $sequence_5 = { 7603 8945f0 837df000 7461 8b4e20 85c9 } // n = 6, score = 1500 // 7603 | jbe 5 // 8945f0 | mov dword ptr [ebp - 0x10], eax // 837df000 | cmp dword ptr [ebp - 0x10], 0 // 7461 | je 0x63 // 8b4e20 | mov ecx, dword ptr [esi + 0x20] // 85c9 | test ecx, ecx $sequence_6 = { 8b4e38 23fa 0fb64c1102 8b5640 33c1 234654 8b4e44 } // n = 7, score = 1500 // 8b4e38 | mov ecx, dword ptr [esi + 0x38] // 23fa | and edi, edx // 0fb64c1102 | movzx ecx, byte ptr [ecx + edx + 2] // 8b5640 | mov edx, dword ptr [esi + 0x40] // 33c1 | xor eax, ecx // 234654 | and eax, dword ptr [esi + 0x54] // 8b4e44 | mov ecx, dword ptr [esi + 0x44] $sequence_7 = { 83ff10 7324 837df800 0f84600f0000 8b45fc ff4df8 8bcf } // n = 7, score = 1500 // 83ff10 | cmp edi, 0x10 // 7324 | jae 0x26 // 837df800 | cmp dword ptr [ebp - 8], 0 // 0f84600f0000 | je 0xf66 // 8b45fc | mov eax, dword ptr [ebp - 4] // ff4df8 | dec dword ptr [ebp - 8] // 8bcf | mov ecx, edi $sequence_8 = { 68???????? ff15???????? c3 b8???????? e8???????? 83ec2c } // n = 6, score = 800 // 68???????? | // ff15???????? | // c3 | ret // b8???????? | // e8???????? | // 83ec2c | sub esp, 0x2c $sequence_9 = { ff742408 e8???????? c20800 8bc1 } // n = 4, score = 600 // ff742408 | push dword ptr [esp + 8] // e8???????? | // c20800 | ret 8 // 8bc1 | mov eax, ecx $sequence_10 = { 5b c3 55 8bec 833d????????00 53 56 } // n = 7, score = 500 // 5b | pop ebx // c3 | ret // 55 | push ebp // 8bec | mov ebp, esp // 833d????????00 | // 53 | push ebx // 56 | push esi $sequence_11 = { 6a01 03c3 68???????? 50 e8???????? 83c40c 85c0 } // n = 7, score = 500 // 6a01 | push 1 // 03c3 | add eax, ebx // 68???????? | // 50 | push eax // e8???????? | // 83c40c | add esp, 0xc // 85c0 | test eax, eax $sequence_12 = { 53 68000000a0 6a03 53 } // n = 4, score = 500 // 53 | push ebx // 68000000a0 | push 0xa0000000 // 6a03 | push 3 // 53 | push ebx $sequence_13 = { 7508 83c8ff e9???????? 8b839f830000 } // n = 4, score = 500 // 7508 | jne 0xa // 83c8ff | or eax, 0xffffffff // e9???????? | // 8b839f830000 | mov eax, dword ptr [ebx + 0x839f] $sequence_14 = { 7507 b800308000 eb02 33c0 } // n = 4, score = 500 // 7507 | jne 9 // b800308000 | mov eax, 0x803000 // eb02 | jmp 4 // 33c0 | xor eax, eax $sequence_15 = { 55 56 57 6880020000 } // n = 4, score = 500 // 55 | push ebp // 56 | push esi // 57 | push edi // 6880020000 | push 0x280 $sequence_16 = { 75dd 57 e8???????? 59 } // n = 4, score = 500 // 75dd | jne 0xffffffdf // 57 | push edi // e8???????? | // 59 | pop ecx $sequence_17 = { 50 e8???????? 59 8b4e2c } // n = 4, score = 400 // 50 | push eax // e8???????? | // 59 | pop ecx // 8b4e2c | mov ecx, dword ptr [esi + 0x2c] $sequence_18 = { 85ff 8bef 0f84f9020000 8b5c243c 8b4504 } // n = 5, score = 400 // 85ff | test edi, edi // 8bef | mov ebp, edi // 0f84f9020000 | je 0x2ff // 8b5c243c | mov ebx, dword ptr [esp + 0x3c] // 8b4504 | mov eax, dword ptr [ebp + 4] $sequence_19 = { e8???????? 59 eb57 53 } // n = 4, score = 400 // e8???????? | // 59 | pop ecx // eb57 | jmp 0x59 // 53 | push ebx $sequence_20 = { 016c242c 8b44242c 5f 5e 5d } // n = 5, score = 400 // 016c242c | add dword ptr [esp + 0x2c], ebp // 8b44242c | mov eax, dword ptr [esp + 0x2c] // 5f | pop edi // 5e | pop esi // 5d | pop ebp $sequence_21 = { 0245fd 3245fe 8a4dff d2c8 } // n = 4, score = 400 // 0245fd | add al, byte ptr [ebp - 3] // 3245fe | xor al, byte ptr [ebp - 2] // 8a4dff | mov cl, byte ptr [ebp - 1] // d2c8 | ror al, cl $sequence_22 = { 02c1 8845e9 8a45ee 80e30f } // n = 4, score = 300 // 02c1 | add al, cl // 8845e9 | mov byte ptr [ebp - 0x17], al // 8a45ee | mov al, byte ptr [ebp - 0x12] // 80e30f | and bl, 0xf $sequence_23 = { 017dfc 3bb188000000 75a4 5f } // n = 4, score = 300 // 017dfc | add dword ptr [ebp - 4], edi // 3bb188000000 | cmp esi, dword ptr [ecx + 0x88] // 75a4 | jne 0xffffffa6 // 5f | pop edi $sequence_24 = { 02c1 8845ea 8a45ee 243f } // n = 4, score = 300 // 02c1 | add al, cl // 8845ea | mov byte ptr [ebp - 0x16], al // 8a45ee | mov al, byte ptr [ebp - 0x12] // 243f | and al, 0x3f $sequence_25 = { 0175fc 8b75f8 46 8975f8 3b75f4 } // n = 5, score = 300 // 0175fc | add dword ptr [ebp - 4], esi // 8b75f8 | mov esi, dword ptr [ebp - 8] // 46 | inc esi // 8975f8 | mov dword ptr [ebp - 8], esi // 3b75f4 | cmp esi, dword ptr [ebp - 0xc] $sequence_26 = { 6a00 8d1437 52 e8???????? 83c40c 8d8d74feffff } // n = 6, score = 200 // 6a00 | push 0 // 8d1437 | lea edx, [edi + esi] // 52 | push edx // e8???????? | // 83c40c | add esp, 0xc // 8d8d74feffff | lea ecx, [ebp - 0x18c] $sequence_27 = { 6a00 53 e8???????? 0fbe532e } // n = 4, score = 200 // 6a00 | push 0 // 53 | push ebx // e8???????? | // 0fbe532e | movsx edx, byte ptr [ebx + 0x2e] $sequence_28 = { 6a00 53 57 8b07 ff502c } // n = 5, score = 200 // 6a00 | push 0 // 53 | push ebx // 57 | push edi // 8b07 | mov eax, dword ptr [edi] // ff502c | call dword ptr [eax + 0x2c] condition: 7 of them and filesize < 2220032 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY