Actor(s): Kimsuki
There is no description at this point.
rule win_mydogs_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.mydogs." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mydogs" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 6808020000 50 e8???????? 83c414 8d9578f5ffff } // n = 5, score = 200 // 6808020000 | push 0x208 // 50 | push eax // e8???????? | // 83c414 | add esp, 0x14 // 8d9578f5ffff | lea edx, [ebp - 0xa88] $sequence_1 = { 660fd681c40f0000 c781940f000000000000 c781b00f000000000000 c781cc0f000000000000 c78118af010000000000 c7811caf010000000000 c78120af010000000000 } // n = 7, score = 200 // 660fd681c40f0000 | movq qword ptr [ecx + 0xfc4], xmm0 // c781940f000000000000 | mov dword ptr [ecx + 0xf94], 0 // c781b00f000000000000 | mov dword ptr [ecx + 0xfb0], 0 // c781cc0f000000000000 | mov dword ptr [ecx + 0xfcc], 0 // c78118af010000000000 | mov dword ptr [ecx + 0x1af18], 0 // c7811caf010000000000 | mov dword ptr [ecx + 0x1af1c], 0 // c78120af010000000000 | mov dword ptr [ecx + 0x1af20], 0 $sequence_2 = { 8bcf e8???????? 0fb64605 88450b 6a01 8d450b 50 } // n = 7, score = 200 // 8bcf | mov ecx, edi // e8???????? | // 0fb64605 | movzx eax, byte ptr [esi + 5] // 88450b | mov byte ptr [ebp + 0xb], al // 6a01 | push 1 // 8d450b | lea eax, [ebp + 0xb] // 50 | push eax $sequence_3 = { 8a08 40 84c9 75f9 2bc2 7462 8d85f4fdffff } // n = 7, score = 200 // 8a08 | mov cl, byte ptr [eax] // 40 | inc eax // 84c9 | test cl, cl // 75f9 | jne 0xfffffffb // 2bc2 | sub eax, edx // 7462 | je 0x64 // 8d85f4fdffff | lea eax, [ebp - 0x20c] $sequence_4 = { 8bce e8???????? 8bc3 c1e810 88451b } // n = 5, score = 200 // 8bce | mov ecx, esi // e8???????? | // 8bc3 | mov eax, ebx // c1e810 | shr eax, 0x10 // 88451b | mov byte ptr [ebp + 0x1b], al $sequence_5 = { 0facd018 8845f4 8a4360 8845f5 884df3 } // n = 5, score = 200 // 0facd018 | shrd eax, edx, 0x18 // 8845f4 | mov byte ptr [ebp - 0xc], al // 8a4360 | mov al, byte ptr [ebx + 0x60] // 8845f5 | mov byte ptr [ebp - 0xb], al // 884df3 | mov byte ptr [ebp - 0xd], cl $sequence_6 = { 7567 56 6a01 8d45f8 6a04 50 e8???????? } // n = 7, score = 200 // 7567 | jne 0x69 // 56 | push esi // 6a01 | push 1 // 8d45f8 | lea eax, [ebp - 8] // 6a04 | push 4 // 50 | push eax // e8???????? | $sequence_7 = { 50 8d85f8feffff 50 e8???????? 83c408 b804000000 } // n = 6, score = 200 // 50 | push eax // 8d85f8feffff | lea eax, [ebp - 0x108] // 50 | push eax // e8???????? | // 83c408 | add esp, 8 // b804000000 | mov eax, 4 $sequence_8 = { 8bd8 83c408 899d80fcffff 85db 0f8418010000 } // n = 5, score = 200 // 8bd8 | mov ebx, eax // 83c408 | add esp, 8 // 899d80fcffff | mov dword ptr [ebp - 0x380], ebx // 85db | test ebx, ebx // 0f8418010000 | je 0x11e $sequence_9 = { 83e4f8 81eccc070000 a1???????? 33c4 898424c8070000 } // n = 5, score = 200 // 83e4f8 | and esp, 0xfffffff8 // 81eccc070000 | sub esp, 0x7cc // a1???????? | // 33c4 | xor eax, esp // 898424c8070000 | mov dword ptr [esp + 0x7c8], eax condition: 7 of them and filesize < 313344 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY