A loader used to deliver IcedID, fetching a fake image from which payloads are extracted.
rule win_photoloader_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-04-08" version = "1" description = "Detects win.photoloader." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photoloader" malpedia_rule_date = "20220405" malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a" malpedia_version = "20220411" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 4c8d9c2440010000 4898 498b7318 4803c3 } // n = 4, score = 300 // 4c8d9c2440010000 | dec eax // 4898 | lea edx, dword ptr [ebp + 0x60] // 498b7318 | inc esp // 4803c3 | mov dword ptr [ebp + 0x60], esi $sequence_1 = { e8???????? 488d5560 44897560 488d4c2440 488bd8 ff15???????? } // n = 6, score = 300 // e8???????? | // 488d5560 | dec eax // 44897560 | inc edx // 488d4c2440 | dec ecx // 488bd8 | sub eax, 1 // ff15???????? | $sequence_2 = { 488d542448 33c9 ffd5 83f86f } // n = 4, score = 300 // 488d542448 | dec eax // 33c9 | sub esi, edx // ffd5 | mov cl, byte ptr [edx] // 83f86f | mov byte ptr [esi + edx], cl $sequence_3 = { 488bc8 ff15???????? 4885f6 0f8463ffffff } // n = 4, score = 300 // 488bc8 | dec eax // ff15???????? | // 4885f6 | lea ecx, dword ptr [esp + 0x40] // 0f8463ffffff | dec eax $sequence_4 = { 488bc8 ff15???????? 488bf8 4885c0 0f84b8000000 448bcb } // n = 6, score = 300 // 488bc8 | dec eax // ff15???????? | // 488bf8 | lea edx, dword ptr [esp + 0x48] // 4885c0 | xor ecx, ecx // 0f84b8000000 | call ebp // 448bcb | cmp eax, 0x6f $sequence_5 = { 4d85c0 7411 482bf2 8a0a 880c16 48ffc2 4983e801 } // n = 7, score = 300 // 4d85c0 | jne 0xb // 7411 | cmp byte ptr [ebx + 0x1c1], 0x2e // 482bf2 | je 0x39 // 8a0a | mov ecx, dword ptr [ebx + 0x194] // 880c16 | dec ebp // 48ffc2 | test eax, eax // 4983e801 | je 0x13 $sequence_6 = { 03c6 894758 b801000000 488b5c2430 488b742438 4883c420 } // n = 6, score = 300 // 03c6 | add eax, esi // 894758 | mov dword ptr [edi + 0x58], eax // b801000000 | mov eax, 1 // 488b5c2430 | dec eax // 488b742438 | mov ebx, dword ptr [esp + 0x30] // 4883c420 | dec eax $sequence_7 = { 488bdf 80bbc001000030 7509 80bbc10100002e 742e 8b8b94010000 } // n = 6, score = 300 // 488bdf | mov esi, dword ptr [esp + 0x38] // 80bbc001000030 | dec eax // 7509 | add esp, 0x20 // 80bbc10100002e | dec eax // 742e | mov ebx, edi // 8b8b94010000 | cmp byte ptr [ebx + 0x1c0], 0x30 $sequence_8 = { 8a441c14 02c2 0fb6c0 8a440414 } // n = 4, score = 200 // 8a441c14 | mov al, byte ptr [esp + ebx + 0x14] // 02c2 | add al, dl // 0fb6c0 | movzx eax, al // 8a440414 | mov al, byte ptr [esp + eax + 0x14] $sequence_9 = { 7466 03f7 803e2f 7506 807e012f 74e5 807e043a } // n = 7, score = 200 // 7466 | je 0x68 // 03f7 | add esi, edi // 803e2f | cmp byte ptr [esi], 0x2f // 7506 | jne 8 // 807e012f | cmp byte ptr [esi + 1], 0x2f // 74e5 | je 0xffffffe7 // 807e043a | cmp byte ptr [esi + 4], 0x3a $sequence_10 = { 0fb6d1 02c2 0fb6c0 89442410 } // n = 4, score = 200 // 0fb6d1 | movzx edx, cl // 02c2 | add al, dl // 0fb6c0 | movzx eax, al // 89442410 | mov dword ptr [esp + 0x10], eax $sequence_11 = { 8d5202 0fb702 8be8 6685c0 } // n = 4, score = 200 // 8d5202 | lea edx, dword ptr [edx + 2] // 0fb702 | movzx eax, word ptr [edx] // 8be8 | mov ebp, eax // 6685c0 | test ax, ax $sequence_12 = { 8b35???????? 6801200000 6a08 ff15???????? 50 ff15???????? } // n = 6, score = 200 // 8b35???????? | // 6801200000 | push 0x2001 // 6a08 | push 8 // ff15???????? | // 50 | push eax // ff15???????? | $sequence_13 = { 81c420010000 c3 33c0 40 ebf0 } // n = 5, score = 200 // 81c420010000 | add esp, 0x120 // c3 | ret // 33c0 | xor eax, eax // 40 | inc eax // ebf0 | jmp 0xfffffff2 $sequence_14 = { b8bb010000 895de4 668945e8 83c40c 8b4508 c745ec01000000 } // n = 6, score = 200 // b8bb010000 | mov eax, 0x1bb // 895de4 | mov dword ptr [ebp - 0x1c], ebx // 668945e8 | mov word ptr [ebp - 0x18], ax // 83c40c | add esp, 0xc // 8b4508 | mov eax, dword ptr [ebp + 8] // c745ec01000000 | mov dword ptr [ebp - 0x14], 1 $sequence_15 = { 5d eb02 33c0 5e 5b 81c404010000 } // n = 6, score = 200 // 5d | pop ebp // eb02 | jmp 4 // 33c0 | xor eax, eax // 5e | pop esi // 5b | pop ebx // 81c404010000 | add esp, 0x104 condition: 7 of them and filesize < 81920 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY