Actor(s): Lucky Cat
There is no description at this point.
rule win_lowzero_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.lowzero." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lowzero" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 2bca 49 83fb07 7507 0fb61f } // n = 5, score = 200 // 2bca | sub ecx, edx // 49 | dec ecx // 83fb07 | cmp ebx, 7 // 7507 | jne 9 // 0fb61f | movzx ebx, byte ptr [edi] $sequence_1 = { 56 8bd9 8955f4 33f6 895dfc } // n = 5, score = 200 // 56 | push esi // 8bd9 | mov ebx, ecx // 8955f4 | mov dword ptr [ebp - 0xc], edx // 33f6 | xor esi, esi // 895dfc | mov dword ptr [ebp - 4], ebx $sequence_2 = { 49 83fb07 7507 0fb61f 83c307 47 } // n = 6, score = 200 // 49 | dec ecx // 83fb07 | cmp ebx, 7 // 7507 | jne 9 // 0fb61f | movzx ebx, byte ptr [edi] // 83c307 | add ebx, 7 // 47 | inc edi $sequence_3 = { 46 41 8a01 8806 46 41 } // n = 6, score = 200 // 46 | inc esi // 41 | inc ecx // 8a01 | mov al, byte ptr [ecx] // 8806 | mov byte ptr [esi], al // 46 | inc esi // 41 | inc ecx $sequence_4 = { 8d0417 8945fc 8d9b00000000 0fb617 47 83fa20 0f83e2000000 } // n = 7, score = 200 // 8d0417 | lea eax, [edi + edx] // 8945fc | mov dword ptr [ebp - 4], eax // 8d9b00000000 | lea ebx, [ebx] // 0fb617 | movzx edx, byte ptr [edi] // 47 | inc edi // 83fa20 | cmp edx, 0x20 // 0f83e2000000 | jae 0xe8 $sequence_5 = { 7507 0fb61f 83c307 47 0fb607 47 2bc8 } // n = 7, score = 200 // 7507 | jne 9 // 0fb61f | movzx ebx, byte ptr [edi] // 83c307 | add ebx, 7 // 47 | inc edi // 0fb607 | movzx eax, byte ptr [edi] // 47 | inc edi // 2bc8 | sub ecx, eax $sequence_6 = { e8???????? 83c40c 03f3 eb0b 2bce 8a0431 } // n = 6, score = 200 // e8???????? | // 83c40c | add esp, 0xc // 03f3 | add esi, ebx // eb0b | jmp 0xd // 2bce | sub ecx, esi // 8a0431 | mov al, byte ptr [ecx + esi] $sequence_7 = { 47 2bc8 8d4602 03c3 3b450c } // n = 5, score = 200 // 47 | inc edi // 2bc8 | sub ecx, eax // 8d4602 | lea eax, [esi + 2] // 03c3 | add eax, ebx // 3b450c | cmp eax, dword ptr [ebp + 0xc] $sequence_8 = { 5d c3 8b4b3c 894df8 8d81f8000000 3bd0 } // n = 6, score = 200 // 5d | pop ebp // c3 | ret // 8b4b3c | mov ecx, dword ptr [ebx + 0x3c] // 894df8 | mov dword ptr [ebp - 8], ecx // 8d81f8000000 | lea eax, [ecx + 0xf8] // 3bd0 | cmp edx, eax $sequence_9 = { 83fb07 7507 0fb61f 83c307 47 0fb607 47 } // n = 7, score = 200 // 83fb07 | cmp ebx, 7 // 7507 | jne 9 // 0fb61f | movzx ebx, byte ptr [edi] // 83c307 | add ebx, 7 // 47 | inc edi // 0fb607 | movzx eax, byte ptr [edi] // 47 | inc edi condition: 7 of them and filesize < 433152 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY