Malware which seems to have no function other than to disrupt computer systems related to the 2018 Winter Olympic event.
rule win_olympic_destroyer_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-10-14" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.5.0" tool_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.olympic_destroyer" malpedia_rule_date = "20201014" malpedia_hash = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9" malpedia_version = "20201014" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 56 33c0 89542414 57 } // n = 4, score = 200 // 56 | push esi // 33c0 | xor eax, eax // 89542414 | mov dword ptr [esp + 0x14], edx // 57 | push edi $sequence_1 = { c9 c3 55 8bec 83ec28 56 6800000080 } // n = 7, score = 100 // c9 | leave // c3 | ret // 55 | push ebp // 8bec | mov ebp, esp // 83ec28 | sub esp, 0x28 // 56 | push esi // 6800000080 | push 0x80000000 $sequence_2 = { ff74242c ff36 8b4004 ff30 } // n = 4, score = 100 // ff74242c | push dword ptr [esp + 0x2c] // ff36 | push dword ptr [esi] // 8b4004 | mov eax, dword ptr [eax + 4] // ff30 | push dword ptr [eax] $sequence_3 = { c70424???????? e8???????? bb???????? c70424???????? e8???????? bb???????? } // n = 6, score = 100 // c70424???????? | // e8???????? | // bb???????? | // c70424???????? | // e8???????? | // bb???????? | $sequence_4 = { 33ff 8bcf 8bc7 894de4 399800d25500 0f84ea000000 41 } // n = 7, score = 100 // 33ff | xor edi, edi // 8bcf | mov ecx, edi // 8bc7 | mov eax, edi // 894de4 | mov dword ptr [ebp - 0x1c], ecx // 399800d25500 | cmp dword ptr [eax + 0x55d200], ebx // 0f84ea000000 | je 0xf0 // 41 | inc ecx $sequence_5 = { 8b4d0c 894f04 8b460c 8b9688000000 395030 7f19 } // n = 6, score = 100 // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] // 894f04 | mov dword ptr [edi + 4], ecx // 8b460c | mov eax, dword ptr [esi + 0xc] // 8b9688000000 | mov edx, dword ptr [esi + 0x88] // 395030 | cmp dword ptr [eax + 0x30], edx // 7f19 | jg 0x1b $sequence_6 = { c3 8b04c5f4655500 5d c3 } // n = 4, score = 100 // c3 | ret // 8b04c5f4655500 | mov eax, dword ptr [eax*8 + 0x5565f4] // 5d | pop ebp // c3 | ret $sequence_7 = { 8d4c2428 89442410 e8???????? 83c404 85c0 } // n = 5, score = 100 // 8d4c2428 | lea ecx, [esp + 0x28] // 89442410 | mov dword ptr [esp + 0x10], eax // e8???????? | // 83c404 | add esp, 4 // 85c0 | test eax, eax $sequence_8 = { 51 6a00 ff7508 2bfa 8d0450 } // n = 5, score = 100 // 51 | push ecx // 6a00 | push 0 // ff7508 | push dword ptr [ebp + 8] // 2bfa | sub edi, edx // 8d0450 | lea eax, [eax + edx*2] $sequence_9 = { 7d0c 3bce 7678 eb06 } // n = 4, score = 100 // 7d0c | jge 0xe // 3bce | cmp ecx, esi // 7678 | jbe 0x7a // eb06 | jmp 8 $sequence_10 = { 7304 33c0 eb11 3d39380000 } // n = 4, score = 100 // 7304 | jae 6 // 33c0 | xor eax, eax // eb11 | jmp 0x13 // 3d39380000 | cmp eax, 0x3839 $sequence_11 = { ff15???????? 57 ff15???????? 8b4dfc 5f 33cd 5e } // n = 7, score = 100 // ff15???????? | // 57 | push edi // ff15???????? | // 8b4dfc | mov ecx, dword ptr [ebp - 4] // 5f | pop edi // 33cd | xor ecx, ebp // 5e | pop esi $sequence_12 = { ff15???????? ffb588f9ffff 898590f9ffff 50 } // n = 4, score = 100 // ff15???????? | // ffb588f9ffff | push dword ptr [ebp - 0x678] // 898590f9ffff | mov dword ptr [ebp - 0x670], eax // 50 | push eax $sequence_13 = { 8b5d08 56 33f6 3bb03c010000 7d55 8b8054010000 8b14b0 } // n = 7, score = 100 // 8b5d08 | mov ebx, dword ptr [ebp + 8] // 56 | push esi // 33f6 | xor esi, esi // 3bb03c010000 | cmp esi, dword ptr [eax + 0x13c] // 7d55 | jge 0x57 // 8b8054010000 | mov eax, dword ptr [eax + 0x154] // 8b14b0 | mov edx, dword ptr [eax + esi*4] $sequence_14 = { ff15???????? ff75ec ff15???????? ff45e4 8b45e4 8345e824 3b45f4 } // n = 7, score = 100 // ff15???????? | // ff75ec | push dword ptr [ebp - 0x14] // ff15???????? | // ff45e4 | inc dword ptr [ebp - 0x1c] // 8b45e4 | mov eax, dword ptr [ebp - 0x1c] // 8345e824 | add dword ptr [ebp - 0x18], 0x24 // 3b45f4 | cmp eax, dword ptr [ebp - 0xc] $sequence_15 = { 89956cffffff 89558c e9???????? 50 c60000 8b8574ffffff } // n = 6, score = 100 // 89956cffffff | mov dword ptr [ebp - 0x94], edx // 89558c | mov dword ptr [ebp - 0x74], edx // e9???????? | // 50 | push eax // c60000 | mov byte ptr [eax], 0 // 8b8574ffffff | mov eax, dword ptr [ebp - 0x8c] $sequence_16 = { 85d2 7435 8b4a20 8b4224 } // n = 4, score = 100 // 85d2 | test edx, edx // 7435 | je 0x37 // 8b4a20 | mov ecx, dword ptr [edx + 0x20] // 8b4224 | mov eax, dword ptr [edx + 0x24] $sequence_17 = { 85f6 7509 8bcf e8???????? 8bf0 8b4f7c } // n = 6, score = 100 // 85f6 | test esi, esi // 7509 | jne 0xb // 8bcf | mov ecx, edi // e8???????? | // 8bf0 | mov esi, eax // 8b4f7c | mov ecx, dword ptr [edi + 0x7c] $sequence_18 = { 55 8bec 8b550c 83ec20 33c9 8bc1 3914c5c8a55500 } // n = 7, score = 100 // 55 | push ebp // 8bec | mov ebp, esp // 8b550c | mov edx, dword ptr [ebp + 0xc] // 83ec20 | sub esp, 0x20 // 33c9 | xor ecx, ecx // 8bc1 | mov eax, ecx // 3914c5c8a55500 | cmp dword ptr [eax*8 + 0x55a5c8], edx $sequence_19 = { 85db 7e2a 8d5724 8b45f8 8b32 833cb000 8b45fc } // n = 7, score = 100 // 85db | test ebx, ebx // 7e2a | jle 0x2c // 8d5724 | lea edx, [edi + 0x24] // 8b45f8 | mov eax, dword ptr [ebp - 8] // 8b32 | mov esi, dword ptr [edx] // 833cb000 | cmp dword ptr [eax + esi*4], 0 // 8b45fc | mov eax, dword ptr [ebp - 4] $sequence_20 = { ffb590f9ffff e8???????? eb5f 33c9 51 } // n = 5, score = 100 // ffb590f9ffff | push dword ptr [ebp - 0x670] // e8???????? | // eb5f | jmp 0x61 // 33c9 | xor ecx, ecx // 51 | push ecx $sequence_21 = { 8945ec 3bc6 746f 8d4df8 51 } // n = 5, score = 100 // 8945ec | mov dword ptr [ebp - 0x14], eax // 3bc6 | cmp eax, esi // 746f | je 0x71 // 8d4df8 | lea ecx, [ebp - 8] // 51 | push ecx $sequence_22 = { 3bc8 7c5a 8b55dc b901000000 c745b800000000 0fb77212 0fb77a10 } // n = 7, score = 100 // 3bc8 | cmp ecx, eax // 7c5a | jl 0x5c // 8b55dc | mov edx, dword ptr [ebp - 0x24] // b901000000 | mov ecx, 1 // c745b800000000 | mov dword ptr [ebp - 0x48], 0 // 0fb77212 | movzx esi, word ptr [edx + 0x12] // 0fb77a10 | movzx edi, word ptr [edx + 0x10] condition: 7 of them and filesize < 1392640 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY