C2 framework.
rule win_nighthawk_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.nighthawk." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nighthawk" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 48c7402000000000 488b442428 488b00 4889442438 488b4c2428 e8???????? 488b442438 } // n = 7, score = 100 // 48c7402000000000 | cmp dword ptr [edi + 8], 0 // 488b442428 | je 0xc8e // 488b00 | dec eax // 4889442438 | cmp dword ptr [edi], 0 // 488b4c2428 | je 0x1564 // e8???????? | // 488b442438 | jne 0xe92 $sequence_1 = { ff15???????? 85c0 0f8508ffffff 498b5508 493b5510 740f 0f1045b0 } // n = 7, score = 100 // ff15???????? | // 85c0 | mov esi, eax // 0f8508ffffff | dec eax // 498b5508 | lea edx, [esp + 0x30] // 493b5510 | dec eax // 740f | lea ecx, [ebp - 0x70] // 0f1045b0 | dec eax $sequence_2 = { e8???????? 488d9520040000 488d8d00050000 e8???????? 90 48395818 7203 } // n = 7, score = 100 // e8???????? | // 488d9520040000 | mov ebx, dword ptr [esi] // 488d8d00050000 | dec eax // e8???????? | // 90 | mov edx, ecx // 48395818 | nop // 7203 | dec eax $sequence_3 = { f30f7f842490000000 4889b424a0000000 4c89ac2480000000 4d397518 720c 498b4500 4889842480000000 } // n = 7, score = 100 // f30f7f842490000000 | lea ecx, [ebp + 0x68] // 4889b424a0000000 | nop // 4c89ac2480000000 | dec eax // 4d397518 | mov edx, eax // 720c | dec eax // 498b4500 | lea ecx, [edi + 0x10] // 4889842480000000 | dec eax $sequence_4 = { 48c744242001000000 4c8d0d48270800 488d4df7 e8???????? 90 4c8d053f270800 488d55f7 } // n = 7, score = 100 // 48c744242001000000 | arpl word ptr [edi + 8], dx // 4c8d0d48270800 | dec eax // 488d4df7 | add edx, dword ptr [ebp + 8] // e8???????? | // 90 | movzx ecx, byte ptr [edx] // 4c8d053f270800 | and ecx, 0xf // 488d55f7 | dec edx $sequence_5 = { eb1b 488bd8 488b08 44386119 750f 488bd9 488b01 } // n = 7, score = 100 // eb1b | dec eax // 488bd8 | mov ebx, dword ptr [esp + 0x50] // 488b08 | dec esp // 44386119 | cmp dword ptr [esp + 0x68], edi // 750f | dec eax // 488bd9 | cmovae ecx, ebx // 488b01 | dec esp $sequence_6 = { 480fafc1 488d1480 48c1e206 4881fa00100000 7218 488b4bf8 4883c227 } // n = 7, score = 100 // 480fafc1 | and ecx, 0xfffffffc // 488d1480 | dec eax // 48c1e206 | cmp eax, ecx // 4881fa00100000 | jge 0x20d // 7218 | dec eax // 488b4bf8 | mov edx, dword ptr [esp + 0x20] // 4883c227 | dec esp $sequence_7 = { e8???????? 90 48897550 48897560 48895d68 458bc6 498bd7 } // n = 7, score = 100 // e8???????? | // 90 | mov dword ptr [ebp + 0x4a8], edi // 48897550 | dec eax // 48897560 | lea ecx, [0x82900] // 48895d68 | dec eax // 458bc6 | mov dword ptr [ebp - 0x50], eax // 498bd7 | dec eax $sequence_8 = { 6689bb88000000 4883bb8000000008 720e 488b4b68 4885c9 7405 e8???????? } // n = 7, score = 100 // 6689bb88000000 | dec eax // 4883bb8000000008 | cmp dword ptr [ebp + 0x68], 8 // 720e | jb 0x1152 // 488b4b68 | dec eax // 4885c9 | mov ecx, dword ptr [ebp + 0x50] // 7405 | dec eax // e8???????? | $sequence_9 = { e8???????? 4588241e 41c6441e0100 4d85ff 7453 e8???????? 498bd7 } // n = 7, score = 100 // e8???????? | // 4588241e | dec eax // 41c6441e0100 | mov dword ptr [ebp - 0x68], 0xf // 4d85ff | inc ebp // 7453 | lea eax, [edi + 0x11] // e8???????? | // 498bd7 | dec eax condition: 7 of them and filesize < 1949696 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY