Actor(s): Turla Group
There is no description at this point.
rule win_kazuar_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-05-16" version = "1" description = "Detects win.kazuar." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kazuar" malpedia_rule_date = "20220513" malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26" malpedia_version = "20220516" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 5d 415c c3 4883ec48 } // n = 4, score = 300 // 5d | mov dword ptr [esp + 0x3c], 0 // 415c | dec eax // c3 | mov dword ptr [esp + 0x28], eax // 4883ec48 | mov dword ptr [esp + 0x20], 0 $sequence_1 = { 4883ec28 e8???????? 31d2 4885c0 740e } // n = 5, score = 300 // 4883ec28 | movzx eax, word ptr [eax + edx] // e8???????? | // 31d2 | lea eax, [ebx + eax*4] // 4885c0 | add eax, dword ptr [edi + 0x1c] // 740e | mov edi, dword ptr [eax] $sequence_2 = { 8955e8 31f6 8b4718 8945f0 8b4720 01d8 8945ec } // n = 7, score = 300 // 8955e8 | push ebp // 31f6 | mov ebp, esp // 8b4718 | push edi // 8945f0 | push esi // 8b4720 | push ebx // 01d8 | sub esp, 0xc // 8945ec | test eax, eax $sequence_3 = { 6689442430 4c8d442430 83c002 6689442432 48c744242800000000 } // n = 5, score = 300 // 6689442430 | pop eax // 4c8d442430 | dec eax // 83c002 | add eax, 0x402000 // 6689442432 | dec eax // 48c744242800000000 | add esp, 0x48 $sequence_4 = { 41ffc1 4131c0 4569c097010001 ebdc 4489c0 } // n = 5, score = 300 // 41ffc1 | test eax, eax // 4131c0 | jmp 0x4d1 // 4569c097010001 | mov eax, dword ptr [ebp - 0x24] // ebdc | lea ecx, [ebp - 0x1c] // 4489c0 | mov dword ptr [ebp - 0x1c], 0 $sequence_5 = { 7505 8b4308 eb0c 8b1b } // n = 4, score = 300 // 7505 | dec eax // 8b4308 | mov dword ptr [esp + 0x28], eax // eb0c | dec edi // 8b1b | je 0x20 $sequence_6 = { 53 4883ec20 31db 65488b1c2530000000 } // n = 4, score = 300 // 53 | dec eax // 4883ec20 | mov edx, ebp // 31db | dec ecx // 65488b1c2530000000 | mov ecx, edi $sequence_7 = { 5e 5f 5d 415c c3 4883ec48 } // n = 6, score = 300 // 5e | mov ecx, eax // 5f | dec eax // 5d | inc ebx // 415c | jmp 0xe3 // c3 | xor eax, eax // 4883ec48 | dec eax $sequence_8 = { 4989db 498b4b40 e8???????? 3d88ae6393 7506 } // n = 5, score = 300 // 4989db | mov eax, ebx // 498b4b40 | pop ebx // e8???????? | // 3d88ae6393 | xor eax, ebx // 7506 | imul ebx, eax, 0x1000197 $sequence_9 = { 41ffc1 4131c0 4569c097010001 ebdd } // n = 4, score = 300 // 41ffc1 | cmp eax, dword ptr [ebp - 0x18] // 4131c0 | jne 0x79 // 4569c097010001 | lea edx, [esi + esi] // ebdd | add edx, ebx condition: 7 of them and filesize < 81920 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY