A ransomware first observed in July 2021.
rule win_lockfile_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.lockfile." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lockfile" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 488d4dd0 e8???????? 4180fe43 742e 418d46bb a8f9 7416 } // n = 7, score = 200 // 488d4dd0 | dec eax // e8???????? | // 4180fe43 | cmp eax, 0x1f // 742e | ja 0xfc5 // 418d46bb | dec eax // a8f9 | mov dword ptr [ebp - 0x29], esi // 7416 | dec eax $sequence_1 = { 488d8d70020000 e8???????? 488d8d70020000 e8???????? ff05???????? eb7a 807c245c2e } // n = 7, score = 200 // 488d8d70020000 | dec eax // e8???????? | // 488d8d70020000 | add edx, eax // e8???????? | // ff05???????? | // eb7a | dec eax // 807c245c2e | mov edi, dword ptr [ebp - 0x10] $sequence_2 = { 49f76330 4c8d143b 4c8bca 4c8d0401 498b4348 4c3bc1 } // n = 6, score = 200 // 49f76330 | dec eax // 4c8d143b | dec ecx // 4c8bca | dec eax // 4c8d0401 | lea eax, [esi*8] // 498b4348 | dec esp // 4c3bc1 | mov edi, esi $sequence_3 = { 3420 88442450 8b442440 040d 3477 88442451 8b442440 } // n = 7, score = 200 // 3420 | mov eax, dword ptr [eax + edx*8] // 88442450 | inc esp // 8b442440 | mov dword ptr [eax + ecx*4], edi // 040d | and ecx, 3 // 3477 | inc ecx // 88442451 | mov eax, 5 // 8b442440 | dec eax $sequence_4 = { 498d4701 488b542430 eb1b 4885c9 7413 e8???????? 488bf8 } // n = 7, score = 200 // 498d4701 | dec eax // 488b542430 | cmp edi, esi // eb1b | setb cl // 4885c9 | dec esp // 7413 | cmp ebx, ebx // e8???????? | // 488bf8 | dec eax $sequence_5 = { c645b851 488bcb c645b954 c645ba48 c645bb50 c645bc4b c645bd4e } // n = 7, score = 200 // c645b851 | mov eax, dword ptr [ebx + 0x38] // 488bcb | dec ecx // c645b954 | cmp ecx, eax // c645ba48 | dec eax // c645bb50 | adc edx, 0 // c645bc4b | dec esp // c645bd4e | add esp, edx $sequence_6 = { 4983d700 48f76768 4f8d343c 488bf2 498d0c00 498b4238 493bc8 } // n = 7, score = 200 // 4983d700 | dec ecx // 48f76768 | mov eax, dword ptr [ebx + 0x48] // 4f8d343c | dec ecx // 488bf2 | cmp ecx, eax // 498d0c00 | dec eax // 498b4238 | adc edx, 0 // 493bc8 | dec esp $sequence_7 = { 488d05045f0300 488901 488d056a600300 48894108 80795900 7506 e8???????? } // n = 7, score = 200 // 488d05045f0300 | xor eax, ecx // 488901 | rol ebx, 1 // 488d056a600300 | inc ecx // 48894108 | xor eax, edx // 80795900 | inc ecx // 7506 | rol ebp, 1 // e8???????? | $sequence_8 = { 8d0c1b 4903cf 4c8d8588010000 488d15d0fa0500 e8???????? 0fb68588010000 ffc3 } // n = 7, score = 200 // 8d0c1b | mov ebx, edx // 4903cf | dec esp // 4c8d8588010000 | mov edi, ecx // 488d15d0fa0500 | mov dword ptr [ebp - 0x49], 0 // e8???????? | // 0fb68588010000 | dec eax // ffc3 | mov ecx, dword ptr [ebp + 0x7f] $sequence_9 = { 4156 4881eca8000000 488bbc24f0000000 4533f6 488b9424e8000000 4d8bd1 488958e8 } // n = 7, score = 200 // 4156 | je 0x170e // 4881eca8000000 | mov dword ptr [ebp - 0x70], ecx // 488bbc24f0000000 | dec eax // 4533f6 | mov dword ptr [eax], ecx // 488b9424e8000000 | dec esp // 4d8bd1 | lea eax, [edi - 1] // 488958e8 | dec eax condition: 7 of them and filesize < 1163264 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY