Pandora ransomware was obtained by vx-underground at 2022-03-14.
rule win_pandora_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.pandora." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pandora" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 0fb6c8 41c1e108 420fb68411401b0600 4433c8 41c1e108 418bc6 c1e808 } // n = 7, score = 100 // 0fb6c8 | lea eax, [ebp - 0x29] // 41c1e108 | dec eax // 420fb68411401b0600 | lea eax, [ebp - 0x29] // 4433c8 | dec ebp // 41c1e108 | mov ecx, esi // 418bc6 | dec eax // c1e808 | mov ecx, dword ptr [ebp + 0x67] $sequence_1 = { 440bd0 410fb6410d 41c1e208 440bd0 410fb6410c 41c1e208 440bd0 } // n = 7, score = 100 // 440bd0 | test eax, eax // 410fb6410d | jne 0xa9e // 41c1e208 | pop esi // 440bd0 | dec eax // 410fb6410c | sub esp, 0x28 // 41c1e208 | dec eax // 440bd0 | lea edi, [esi + 0x78000] $sequence_2 = { bf94ffffff 8bc7 85c0 0f883c010000 488bcb 482bce 4883f901 } // n = 7, score = 100 // bf94ffffff | mov dword ptr [edi + eax*4], edx // 8bc7 | dec eax // 85c0 | lea ecx, [ecx + 0x10] // 0f883c010000 | mov edx, dword ptr [ecx] // 488bcb | inc ecx // 482bce | mov eax, edi // 4883f901 | dec eax $sequence_3 = { 498db578100600 0f11442430 4903f1 4c8d542444 498bfb 0f1f00 443836 } // n = 7, score = 100 // 498db578100600 | inc esp // 0f11442430 | add ebx, eax // 4903f1 | add ebx, edi // 4c8d542444 | inc ecx // 498bfb | rol eax, 9 // 0f1f00 | inc esp // 443836 | add eax, edi $sequence_4 = { 7ccf 418bd2 4c8d05c5c20500 41b90a000000 8bc2 418910 2480 } // n = 7, score = 100 // 7ccf | dec eax // 418bd2 | sub esp, 0x48 // 4c8d05c5c20500 | test byte ptr [ecx + 0xa4], 0x10 // 41b90a000000 | dec ebp // 8bc2 | mov esp, ecx // 418910 | inc eax // 2480 | push ebx $sequence_5 = { 488d1df3fa0200 eb07 488d1dd2fa0200 4883a4249800000000 4084f6 740b b903000000 } // n = 7, score = 100 // 488d1df3fa0200 | dec esp // eb07 | mov dword ptr [eax], esi // 488d1dd2fa0200 | dec ebp // 4883a4249800000000 | test esi, esi // 4084f6 | jne 0x2009 // 740b | xor eax, eax // b903000000 | ret $sequence_6 = { 4863c2 418911 4d8d4904 44890484 0fb6c2 02c0 0fb6c8 } // n = 7, score = 100 // 4863c2 | js 0x14ab // 418911 | nop dword ptr [eax + eax] // 4d8d4904 | dec esp // 44890484 | mov eax, edi // 0fb6c2 | dec eax // 02c0 | lea edx, [ebp - 0x19] // 0fb6c8 | dec eax $sequence_7 = { 4133cb 41c1c802 03c3 8b5c2438 03c8 4403d1 8bca } // n = 7, score = 100 // 4133cb | test ebx, ebx // 41c1c802 | jne 0x1c9e // 03c3 | dec eax // 8b5c2438 | lea ecx, [ebp - 0x31] // 03c8 | mov ebx, eax // 4403d1 | test eax, eax // 8bca | jne 0x1a76 $sequence_8 = { 41b801000000 498d542458 498d4c2458 e8???????? 8bd8 85c0 0f85d9010000 } // n = 7, score = 100 // 41b801000000 | dec esp // 498d542458 | mov dword ptr [eax - 0x20], esi // 498d4c2458 | dec esp // e8???????? | // 8bd8 | mov esi, ecx // 85c0 | dec esp // 0f85d9010000 | mov dword ptr [eax - 0x28], edi $sequence_9 = { 488d2d90150300 488d4d30 4533c0 baa00f0000 e8???????? 488b05???????? } // n = 6, score = 100 // 488d2d90150300 | mov ebx, eax // 488d4d30 | jne 0x44e // 4533c0 | dec eax // baa00f0000 | lea ecx, [edi + 8] // e8???????? | // 488b05???????? | condition: 7 of them and filesize < 1032192 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY