There is no description at this point.
rule win_kpot_stealer_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.kpot_stealer." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 83f92f 7414 83f95c 740a 83f962 7560 c60008 } // n = 7, score = 500 // 83f92f | cmp ecx, 0x2f // 7414 | je 0x16 // 83f95c | cmp ecx, 0x5c // 740a | je 0xc // 83f962 | cmp ecx, 0x62 // 7560 | jne 0x62 // c60008 | mov byte ptr [eax], 8 $sequence_1 = { 59 59 0fbec8 8d841df0feffff 8a10 8d8c0df0feffff 8a19 } // n = 7, score = 500 // 59 | pop ecx // 59 | pop ecx // 0fbec8 | movsx ecx, al // 8d841df0feffff | lea eax, [ebp + ebx - 0x110] // 8a10 | mov dl, byte ptr [eax] // 8d8c0df0feffff | lea ecx, [ebp + ecx - 0x110] // 8a19 | mov bl, byte ptr [ecx] $sequence_2 = { eb03 0175fc 33f6 3975fc } // n = 4, score = 500 // eb03 | jmp 5 // 0175fc | add dword ptr [ebp - 4], esi // 33f6 | xor esi, esi // 3975fc | cmp dword ptr [ebp - 4], esi $sequence_3 = { 0bc1 0fb64f03 ff750c c1e118 0bc1 0fb64f04 c1e208 } // n = 7, score = 500 // 0bc1 | or eax, ecx // 0fb64f03 | movzx ecx, byte ptr [edi + 3] // ff750c | push dword ptr [ebp + 0xc] // c1e118 | shl ecx, 0x18 // 0bc1 | or eax, ecx // 0fb64f04 | movzx ecx, byte ptr [edi + 4] // c1e208 | shl edx, 8 $sequence_4 = { 8b4508 8bd7 b301 e8???????? 893e ff75fc } // n = 6, score = 500 // 8b4508 | mov eax, dword ptr [ebp + 8] // 8bd7 | mov edx, edi // b301 | mov bl, 1 // e8???????? | // 893e | mov dword ptr [esi], edi // ff75fc | push dword ptr [ebp - 4] $sequence_5 = { 8ac3 e8???????? 84c0 7505 8b55f0 eb6b } // n = 6, score = 500 // 8ac3 | mov al, bl // e8???????? | // 84c0 | test al, al // 7505 | jne 7 // 8b55f0 | mov edx, dword ptr [ebp - 0x10] // eb6b | jmp 0x6d $sequence_6 = { 895df0 85f6 7904 8bf7 eb01 4f } // n = 6, score = 500 // 895df0 | mov dword ptr [ebp - 0x10], ebx // 85f6 | test esi, esi // 7904 | jns 6 // 8bf7 | mov esi, edi // eb01 | jmp 3 // 4f | dec edi $sequence_7 = { 33c1 23c6 8bf0 33d7 } // n = 4, score = 500 // 33c1 | xor eax, ecx // 23c6 | and eax, esi // 8bf0 | mov esi, eax // 33d7 | xor edx, edi $sequence_8 = { ff00 8b08 803922 741e 8a11 84d2 } // n = 6, score = 500 // ff00 | inc dword ptr [eax] // 8b08 | mov ecx, dword ptr [eax] // 803922 | cmp byte ptr [ecx], 0x22 // 741e | je 0x20 // 8a11 | mov dl, byte ptr [ecx] // 84d2 | test dl, dl $sequence_9 = { 8bc1 c1e810 884306 8b45f4 } // n = 4, score = 500 // 8bc1 | mov eax, ecx // c1e810 | shr eax, 0x10 // 884306 | mov byte ptr [ebx + 6], al // 8b45f4 | mov eax, dword ptr [ebp - 0xc] condition: 7 of them and filesize < 219136 }
rule win_kpot_stealer_w0 { meta: description = "Kpot" type = "Stealer" author = "Fumik0_" date = "30/08/2018" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kpot_stealer" malpedia_version = "20190106" malpedia_license = "CC BY-NC-SA 4.0" malpedia_sharing = "TLP:WHITE" strings: $mz = { 4d 5a } // Variant 1 $v1_s1 = "GET %s HTTP/1.1" wide ascii $v1_s2 = "Host: %s" wide ascii $v1_s3 = "%02d-%02d-%02d %d:%02d:%02d" wide ascii $v1_s4 = "%S/base64.php?_f=%S" wide ascii $v1_s5 = "IP: %S" wide ascii $v1_s6 = "MachineGuid: %s" wide ascii $v1_s7 = "CPU: %S (%d cores)" wide ascii $v1_s8 = "RAM: %S MB" wide ascii $v1_s9 = "Screen: %dx%d" wide ascii $v1_s10 = "PC: %s" wide ascii $v1_s11 = "User: %s" wide ascii $v1_s12 = "LT: %S (UTC+%d:%d)" wide ascii $v1_s13 = "GPU:" wide ascii $v1_s14 = "regbot.php" wide ascii $v1_s15 = "ip.php" wide ascii // Variant 2 $v2_s1 = "GET %s HTTP/1.1" wide ascii $v2_s2 = "%s/%s.php" wide ascii $v2_s3 = "%s/gate.php" wide ascii $v2_s4 = "RAM: %s MB" wide ascii $v2_s5 = "IP: %s" wide ascii $v2_s6 = "CPU: %s (%d cores)" wide ascii $v2_s7 = "RAM: %s MB" wide ascii $v2_s8 = "Screen: %dx%d" wide ascii $v2_s9 = "LT: %s (UTC+%d:%d)" wide ascii $v2_s10 = "GPU:" wide ascii $v2_s11 = "screen.png" wide ascii condition: ($mz at 0) and ( (all of ($v1_*)) or (all of ($v2_*)) ) }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY