Actor(s): Turla Group
A keylogger used by Turla.
rule win_ksl0t_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.ksl0t." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ksl0t" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { c684248e02000039 8884248f020000 c684249002000001 c68424910200003c c684249202000038 88842493020000 888c2494020000 } // n = 7, score = 200 // c684248e02000039 | mov byte ptr [esp + 0x28e], 0x39 // 8884248f020000 | mov byte ptr [esp + 0x28f], al // c684249002000001 | mov byte ptr [esp + 0x290], 1 // c68424910200003c | mov byte ptr [esp + 0x291], 0x3c // c684249202000038 | mov byte ptr [esp + 0x292], 0x38 // 88842493020000 | mov byte ptr [esp + 0x293], al // 888c2494020000 | mov byte ptr [esp + 0x294], cl $sequence_1 = { 4881c29e000000 41b808000000 488d0d19e60000 ff15???????? e9???????? 488d1547c30000 4881c2ae000000 } // n = 7, score = 200 // 4881c29e000000 | dec eax // 41b808000000 | add edx, 0x9e // 488d0d19e60000 | inc ecx // ff15???????? | // e9???????? | // 488d1547c30000 | mov eax, 8 // 4881c2ae000000 | dec eax $sequence_2 = { ffd7 8d942440020000 52 55 89869c000000 } // n = 5, score = 200 // ffd7 | call edi // 8d942440020000 | lea edx, [esp + 0x240] // 52 | push edx // 55 | push ebp // 89869c000000 | mov dword ptr [esi + 0x9c], eax $sequence_3 = { 52 53 89463c ffd7 894640 } // n = 5, score = 200 // 52 | push edx // 53 | push ebx // 89463c | mov dword ptr [esi + 0x3c], eax // ffd7 | call edi // 894640 | mov dword ptr [esi + 0x40], eax $sequence_4 = { 448b8424a8140000 488d1566d30000 488d8c24a0080000 ff15???????? } // n = 4, score = 200 // 448b8424a8140000 | dec esp // 488d1566d30000 | mov ebx, eax // 488d8c24a0080000 | dec esp // ff15???????? | $sequence_5 = { 488d05d3910000 483bf8 740e 833f00 7509 488bcf } // n = 6, score = 200 // 488d05d3910000 | lea ecx, [0xe619] // 483bf8 | dec eax // 740e | lea edx, [0xc347] // 833f00 | dec eax // 7509 | add edx, 0xae // 488bcf | dec eax $sequence_6 = { 488b842420040000 4c895808 488d942438030000 488b8c24e0010000 ff942418040000 4c8bd8 } // n = 6, score = 200 // 488b842420040000 | jne 0x10 // 4c895808 | dec eax // 488d942438030000 | mov ecx, edi // 488b8c24e0010000 | mov byte ptr [esp + 0x285], 0x21 // ff942418040000 | mov byte ptr [esp + 0x286], 0x55 // 4c8bd8 | mov byte ptr [esp + 0x1f8], 0x38 $sequence_7 = { c684243b01000039 c684243c01000039 c684243d01000066 c684243e01000067 } // n = 4, score = 200 // c684243b01000039 | mov byte ptr [esp + 0x13b], 0x39 // c684243c01000039 | mov byte ptr [esp + 0x13c], 0x39 // c684243d01000066 | mov byte ptr [esp + 0x13d], 0x66 // c684243e01000067 | mov byte ptr [esp + 0x13e], 0x67 $sequence_8 = { c684248502000021 c684248602000055 c68424f801000038 c68424f901000034 c68424fa01000039 } // n = 5, score = 200 // c684248502000021 | lea eax, [0x91d3] // c684248602000055 | dec eax // c68424f801000038 | cmp edi, eax // c68424f901000034 | je 0x10 // c68424fa01000039 | cmp dword ptr [edi], 0 $sequence_9 = { c684240302000038 88842404020000 c684240502000002 888c2406020000 } // n = 4, score = 200 // c684240302000038 | mov byte ptr [esp + 0x203], 0x38 // 88842404020000 | mov byte ptr [esp + 0x204], al // c684240502000002 | mov byte ptr [esp + 0x205], 2 // 888c2406020000 | mov byte ptr [esp + 0x206], cl $sequence_10 = { 4c899838010000 488d942480020000 488b8c24e0000000 ff942418040000 } // n = 4, score = 200 // 4c899838010000 | mov byte ptr [esp + 0x1f9], 0x34 // 488d942480020000 | mov byte ptr [esp + 0x1fa], 0x39 // 488b8c24e0000000 | dec eax // ff942418040000 | mov eax, dword ptr [esp + 0x420] $sequence_11 = { e8???????? 33d2 66899500110000 68fe030000 57 } // n = 5, score = 200 // e8???????? | // 33d2 | xor edx, edx // 66899500110000 | mov word ptr [ebp + 0x1100], dx // 68fe030000 | push 0x3fe // 57 | push edi $sequence_12 = { c684248a01000032 8884248b010000 888c248c010000 c68424a401000011 c68424a50100003c } // n = 5, score = 200 // c684248a01000032 | mov byte ptr [esp + 0x18a], 0x32 // 8884248b010000 | mov byte ptr [esp + 0x18b], al // 888c248c010000 | mov byte ptr [esp + 0x18c], cl // c68424a401000011 | mov byte ptr [esp + 0x1a4], 0x11 // c68424a50100003c | mov byte ptr [esp + 0x1a5], 0x3c $sequence_13 = { c68424af01000026 c68424b001000034 c68424b101000032 888424b2010000 } // n = 4, score = 200 // c68424af01000026 | mov byte ptr [esp + 0x1af], 0x26 // c68424b001000034 | mov byte ptr [esp + 0x1b0], 0x34 // c68424b101000032 | mov byte ptr [esp + 0x1b1], 0x32 // 888424b2010000 | mov byte ptr [esp + 0x1b2], al $sequence_14 = { c644246d1d c644246e34 c644246f3b c644247031 c644247139 88442472 } // n = 6, score = 200 // c644246d1d | mov byte ptr [esp + 0x6d], 0x1d // c644246e34 | mov byte ptr [esp + 0x6e], 0x34 // c644246f3b | mov byte ptr [esp + 0x6f], 0x3b // c644247031 | mov byte ptr [esp + 0x70], 0x31 // c644247139 | mov byte ptr [esp + 0x71], 0x39 // 88442472 | mov byte ptr [esp + 0x72], al $sequence_15 = { 898424e4150000 81bc24e4150000a0000000 7439 81bc24e4150000a1000000 7402 eb52 488d15a7c60000 } // n = 7, score = 200 // 898424e4150000 | dec esp // 81bc24e4150000a0000000 | mov dword ptr [eax + 8], ebx // 7439 | dec eax // 81bc24e4150000a1000000 | lea edx, [esp + 0x338] // 7402 | dec eax // eb52 | mov ecx, dword ptr [esp + 0x1e0] // 488d15a7c60000 | call dword ptr [esp + 0x418] condition: 7 of them and filesize < 196608 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY