Actor(s): MuddyWater
There is no description at this point.
rule win_moriagent_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.moriagent." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.moriagent" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { b802000000 eb05 b801000000 33ff } // n = 4, score = 200 // b802000000 | mov eax, 2 // eb05 | jmp 7 // b801000000 | mov eax, 1 // 33ff | xor edi, edi $sequence_1 = { c5fb102d???????? c4e2c9abe9 f2410f1004c1 488d15127c0300 f20f1014c2 c5eb58d5 } // n = 6, score = 100 // c5fb102d???????? | // c4e2c9abe9 | vfmsub213sd xmm5, xmm6, xmm1 // f2410f1004c1 | inc ecx // 488d15127c0300 | movups xmm0, xmmword ptr [ecx + eax*8] // f20f1014c2 | dec eax // c5eb58d5 | lea edx, [0x37c12] $sequence_2 = { c5fbe6e7 4c8d15b7a10400 4c8d1db0a30400 c5fae6cc } // n = 4, score = 100 // c5fbe6e7 | lea ecx, [0x49528] // 4c8d15b7a10400 | vmovsd xmm3, qword ptr [ecx + eax*8] // 4c8d1db0a30400 | vfmadd213sd xmm0, xmm3, xmm3 // c5fae6cc | vmulsd xmm0, xmm0, xmm3 $sequence_3 = { c60000 83f905 751e 4c8d45c8 } // n = 4, score = 100 // c60000 | dec eax // 83f905 | sub edx, dword ptr [esp + 0xb8] // 751e | dec eax // 4c8d45c8 | mov eax, dword ptr [esp + 0xe0] $sequence_4 = { c60000 488d95a0000000 488d4d98 e8???????? } // n = 4, score = 100 // c60000 | dec eax // 488d95a0000000 | mov edx, dword ptr [esp + 0xc0] // 488d4d98 | dec eax // e8???????? | $sequence_5 = { e8???????? 03c7 8985d8eeffff 3bb550efffff 7432 } // n = 5, score = 100 // e8???????? | // 03c7 | lea edx, [esp + 0x48] // 8985d8eeffff | mov byte ptr [eax], 0 // 3bb550efffff | cmp ecx, 5 // 7432 | jne 0x26 $sequence_6 = { c60000 b811000000 443bf8 440f47f8 } // n = 4, score = 100 // c60000 | lea edx, [ebp + 0xa0] // b811000000 | dec eax // 443bf8 | lea ecx, [ebp - 0x68] // 440f47f8 | mov byte ptr [eax], 0 $sequence_7 = { 83c404 8912 895204 895208 } // n = 4, score = 100 // 83c404 | mov eax, 0x11 // 8912 | inc esp // 895204 | cmp edi, eax // 895208 | inc esp $sequence_8 = { 8945e8 68???????? 68???????? c745fc00000000 ff15???????? 50 } // n = 6, score = 100 // 8945e8 | mov ecx, ebx // 68???????? | // 68???????? | // c745fc00000000 | mov byte ptr [eax], 0 // ff15???????? | // 50 | cmp ecx, 5 $sequence_9 = { c60000 488b9424c0000000 482b9424b8000000 488b8424e0000000 } // n = 4, score = 100 // c60000 | dec esp // 488b9424c0000000 | lea edx, [0x4a1b7] // 482b9424b8000000 | dec esp // 488b8424e0000000 | lea ebx, [0x4a3b0] $sequence_10 = { 8b45c8 3bf8 7468 8b4f14 83f910 } // n = 5, score = 100 // 8b45c8 | dec esp // 3bf8 | lea eax, [ebp - 0x38] // 7468 | dec eax // 8b4f14 | lea edx, [esp + 0x48] // 83f910 | dec eax $sequence_11 = { c645fc01 33c0 8b55d4 8bca c7459000000000 c7459407000000 66894580 } // n = 7, score = 100 // c645fc01 | lea eax, [ebp - 0x38] // 33c0 | mov byte ptr [eax], 0 // 8b55d4 | cmp ecx, 5 // 8bca | jne 0x26 // c7459000000000 | dec esp // c7459407000000 | lea eax, [ebp - 0x38] // 66894580 | dec eax $sequence_12 = { 83f81f 7759 51 56 e8???????? 83c408 8b35???????? } // n = 7, score = 100 // 83f81f | dec eax // 7759 | lea edx, [esp + 0x48] // 51 | dec eax // 56 | mov ecx, ebx // e8???????? | // 83c408 | mov byte ptr [eax], 0 // 8b35???????? | $sequence_13 = { e8???????? 8d4d88 e8???????? 83c418 c745fc00000000 } // n = 5, score = 100 // e8???????? | // 8d4d88 | jne 0x23 // e8???????? | // 83c418 | dec esp // c745fc00000000 | lea eax, [ebp - 0x38] $sequence_14 = { c5fb59c3 48c7c03f000000 23c1 488d0d28950400 } // n = 4, score = 100 // c5fb59c3 | dec eax // 48c7c03f000000 | lea edx, [0x37c12] // 23c1 | movsd xmm2, qword ptr [edx + eax*8] // 488d0d28950400 | vaddsd xmm2, xmm2, xmm5 condition: 7 of them and filesize < 1347904 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY