Actor(s): TA428
There is no description at this point.
rule win_ncctrojan_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.ncctrojan." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ncctrojan" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 750a 68???????? e9???????? 83f802 } // n = 4, score = 500 // 750a | jne 0xc // 68???????? | // e9???????? | // 83f802 | cmp eax, 2 $sequence_1 = { 68???????? e9???????? 83f801 750a 68???????? } // n = 5, score = 500 // 68???????? | // e9???????? | // 83f801 | cmp eax, 1 // 750a | jne 0xc // 68???????? | $sequence_2 = { 83f805 7536 8b85e8feffff 85c0 } // n = 4, score = 500 // 83f805 | cmp eax, 5 // 7536 | jne 0x38 // 8b85e8feffff | mov eax, dword ptr [ebp - 0x118] // 85c0 | test eax, eax $sequence_3 = { 7249 8bce 81e11f000080 7905 49 83c9e0 41 } // n = 7, score = 400 // 7249 | jb 0x4b // 8bce | mov ecx, esi // 81e11f000080 | and ecx, 0x8000001f // 7905 | jns 7 // 49 | dec ecx // 83c9e0 | or ecx, 0xffffffe0 // 41 | inc ecx $sequence_4 = { 8d85d496ffff 6800400000 50 e8???????? 83c41c 8d85d496ffff } // n = 6, score = 400 // 8d85d496ffff | lea eax, [ebp - 0x692c] // 6800400000 | push 0x4000 // 50 | push eax // e8???????? | // 83c41c | add esp, 0x1c // 8d85d496ffff | lea eax, [ebp - 0x692c] $sequence_5 = { 7507 68???????? eb6b 68???????? eb64 83f802 } // n = 6, score = 400 // 7507 | jne 9 // 68???????? | // eb6b | jmp 0x6d // 68???????? | // eb64 | jmp 0x66 // 83f802 | cmp eax, 2 $sequence_6 = { 84c0 75f9 2bca 0f841c010000 8dbd68feffff } // n = 5, score = 400 // 84c0 | test al, al // 75f9 | jne 0xfffffffb // 2bca | sub ecx, edx // 0f841c010000 | je 0x122 // 8dbd68feffff | lea edi, [ebp - 0x198] $sequence_7 = { 33f6 68f4010000 ff15???????? 8d442410 } // n = 4, score = 400 // 33f6 | xor esi, esi // 68f4010000 | push 0x1f4 // ff15???????? | // 8d442410 | lea eax, [esp + 0x10] $sequence_8 = { 85d2 7e10 8ac1 02c9 } // n = 4, score = 300 // 85d2 | test edx, edx // 7e10 | jle 0x12 // 8ac1 | mov al, cl // 02c9 | add cl, cl $sequence_9 = { 6a00 ff75ec ff33 56 } // n = 4, score = 300 // 6a00 | push 0 // ff75ec | push dword ptr [ebp - 0x14] // ff33 | push dword ptr [ebx] // 56 | push esi $sequence_10 = { 68???????? 50 e8???????? 83c418 8d45d0 50 eb05 } // n = 7, score = 300 // 68???????? | // 50 | push eax // e8???????? | // 83c418 | add esp, 0x18 // 8d45d0 | lea eax, [ebp - 0x30] // 50 | push eax // eb05 | jmp 7 $sequence_11 = { 6a7c 50 e8???????? 8bd8 } // n = 4, score = 300 // 6a7c | push 0x7c // 50 | push eax // e8???????? | // 8bd8 | mov ebx, eax $sequence_12 = { 50 8d4d88 e8???????? c645fc02 8d45d8 837dec10 } // n = 6, score = 300 // 50 | push eax // 8d4d88 | lea ecx, [ebp - 0x78] // e8???????? | // c645fc02 | mov byte ptr [ebp - 4], 2 // 8d45d8 | lea eax, [ebp - 0x28] // 837dec10 | cmp dword ptr [ebp - 0x14], 0x10 $sequence_13 = { 85db 0f84b8000000 6a14 59 } // n = 4, score = 300 // 85db | test ebx, ebx // 0f84b8000000 | je 0xbe // 6a14 | push 0x14 // 59 | pop ecx $sequence_14 = { 56 8985c8feffff 8d4d08 6a00 8d8548ffffff 50 e8???????? } // n = 7, score = 300 // 56 | push esi // 8985c8feffff | mov dword ptr [ebp - 0x138], eax // 8d4d08 | lea ecx, [ebp + 8] // 6a00 | push 0 // 8d8548ffffff | lea eax, [ebp - 0xb8] // 50 | push eax // e8???????? | $sequence_15 = { 8b450c 3dffffff7f 7605 e9???????? } // n = 4, score = 300 // 8b450c | mov eax, dword ptr [ebp + 0xc] // 3dffffff7f | cmp eax, 0x7fffffff // 7605 | jbe 7 // e9???????? | condition: 7 of them and filesize < 1160192 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY