Actor(s): Kimsuky
There is no description at this point.
rule win_mechanical_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.mechanical." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mechanical" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 03c7 3bca 72ed 5f } // n = 4, score = 200 // 03c7 | add eax, edi // 3bca | cmp ecx, edx // 72ed | jb 0xffffffef // 5f | pop edi $sequence_1 = { 033485c0e54200 8b45e4 8b00 8906 } // n = 4, score = 200 // 033485c0e54200 | add esi, dword ptr [eax*4 + 0x42e5c0] // 8b45e4 | mov eax, dword ptr [ebp - 0x1c] // 8b00 | mov eax, dword ptr [eax] // 8906 | mov dword ptr [esi], eax $sequence_2 = { 448b442464 4533c9 4c8d15eb3afeff 41bb00020000 4c898c2498000000 eb1d 488bb424a8000000 } // n = 7, score = 200 // 448b442464 | inc esp // 4533c9 | mov byte ptr [esp + 0x38c0], ah // 4c8d15eb3afeff | xor edx, edx // 41bb00020000 | inc ecx // 4c898c2498000000 | mov eax, 0x103 // eb1d | inc esp // 488bb424a8000000 | mov byte ptr [esp + 0x1280], ah $sequence_3 = { 03c1 1bc9 0bc1 59 e9???????? e8???????? ff742404 } // n = 7, score = 200 // 03c1 | add eax, ecx // 1bc9 | sbb ecx, ecx // 0bc1 | or eax, ecx // 59 | pop ecx // e9???????? | // e8???????? | // ff742404 | push dword ptr [esp + 4] $sequence_4 = { 8b442430 488d8c24c1380000 33d2 41b803010000 4488a424c0380000 488905???????? } // n = 6, score = 200 // 8b442430 | lea ebx, [0x20d7d] // 488d8c24c1380000 | dec ecx // 33d2 | mov ecx, esp // 41b803010000 | dec ecx // 4488a424c0380000 | mov edx, ebx // 488905???????? | $sequence_5 = { 0401 3cbe 8844240b 76e2 } // n = 4, score = 200 // 0401 | add al, 1 // 3cbe | cmp al, 0xbe // 8844240b | mov byte ptr [esp + 0xb], al // 76e2 | jbe 0xffffffe4 $sequence_6 = { 03ce c6840c3801000000 8d8424a05c0000 33f6 } // n = 4, score = 200 // 03ce | add ecx, esi // c6840c3801000000 | mov byte ptr [esp + ecx + 0x138], 0 // 8d8424a05c0000 | lea eax, [esp + 0x5ca0] // 33f6 | xor esi, esi $sequence_7 = { 4533c0 33d2 33c9 4889742420 e8???????? 4c8d0557980000 } // n = 6, score = 200 // 4533c0 | dec eax // 33d2 | lea ecx, [esp + 0x38c1] // 33c9 | xor edx, edx // 4889742420 | inc ecx // e8???????? | // 4c8d0557980000 | mov eax, 0x103 $sequence_8 = { e8???????? 488d8c24fb060000 33d2 41b8e5640000 } // n = 4, score = 200 // e8???????? | // 488d8c24fb060000 | dec eax // 33d2 | mov dword ptr [esp + 0x20], esi // 41b8e5640000 | dec esp $sequence_9 = { 00686c 42 0023 d18a0688078a } // n = 4, score = 200 // 00686c | add byte ptr [eax + 0x6c], ch // 42 | inc edx // 0023 | add byte ptr [ebx], ah // d18a0688078a | ror dword ptr [edx - 0x75f877fa], 1 $sequence_10 = { 030495c0e54200 eb05 b8???????? f6400420 } // n = 4, score = 200 // 030495c0e54200 | add eax, dword ptr [edx*4 + 0x42e5c0] // eb05 | jmp 7 // b8???????? | // f6400420 | test byte ptr [eax + 4], 0x20 $sequence_11 = { 4983c101 4d85c0 75eb 4183f922 0f85b8000000 488bc8 0fb601 } // n = 7, score = 200 // 4983c101 | dec ecx // 4d85c0 | add ecx, 1 // 75eb | dec ebp // 4183f922 | test eax, eax // 0f85b8000000 | jne 0xffffffed // 488bc8 | inc ecx // 0fb601 | cmp ecx, 0x22 $sequence_12 = { 033485c0e54200 c745e401000000 33db 395e08 } // n = 4, score = 200 // 033485c0e54200 | add esi, dword ptr [eax*4 + 0x42e5c0] // c745e401000000 | mov dword ptr [ebp - 0x1c], 1 // 33db | xor ebx, ebx // 395e08 | cmp dword ptr [esi + 8], ebx $sequence_13 = { 33d2 41b803010000 4488a42480120000 488905???????? e8???????? 4c8d1d73310200 } // n = 6, score = 200 // 33d2 | movzx eax, byte ptr [edx] // 41b803010000 | dec eax // 4488a42480120000 | add edx, 1 // 488905???????? | // e8???????? | // 4c8d1d73310200 | mov eax, dword ptr [esp + 0x30] $sequence_14 = { eb17 c6025e eb12 c6022f eb0d c6023f } // n = 6, score = 200 // eb17 | dec esp // c6025e | lea ebx, [0x23173] // eb12 | inc ebp // c6022f | xor eax, eax // eb0d | xor edx, edx // c6023f | xor ecx, ecx $sequence_15 = { 4c8d1d7d0d0200 498bcc 498bd3 0fb602 4883c201 } // n = 5, score = 200 // 4c8d1d7d0d0200 | jne 0xbe // 498bcc | dec eax // 498bd3 | mov ecx, eax // 0fb602 | movzx eax, byte ptr [ecx] // 4883c201 | dec esp condition: 7 of them and filesize < 434176 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY