A loader used to deliver IcedID, fetching a fake image from which payloads are extracted.
rule win_photoloader_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.photoloader." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.photoloader" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 48c1e310 0f31 48c1e220 480bc2 0fb7c8 480bd9 8bcb } // n = 7, score = 700 // 48c1e310 | dec eax // 0f31 | shl ebx, 0x10 // 48c1e220 | rdtsc // 480bc2 | dec eax // 0fb7c8 | shl edx, 0x20 // 480bd9 | dec eax // 8bcb | or eax, edx $sequence_1 = { 488bd6 488d0c5f e8???????? 4803d8 488d0c5f e8???????? 488bc7 } // n = 7, score = 700 // 488bd6 | dec eax // 488d0c5f | or ebx, ecx // e8???????? | // 4803d8 | mov ecx, ebx // 488d0c5f | and ecx, 0xf // e8???????? | // 488bc7 | dec eax $sequence_2 = { 0fb7c8 480bd9 8bcb 83e10f ff15???????? 4883ef01 75dc } // n = 7, score = 700 // 0fb7c8 | or ebx, ecx // 480bd9 | dec eax // 8bcb | shl edx, 0x20 // 83e10f | dec eax // ff15???????? | // 4883ef01 | or eax, edx // 75dc | movzx ecx, ax $sequence_3 = { 4803d8 488d0c5f e8???????? 4803d8 488bd6 488d0c5f e8???????? } // n = 7, score = 700 // 4803d8 | lea ecx, [edi + ebx*2] // 488d0c5f | dec eax // e8???????? | // 4803d8 | or eax, edx // 488bd6 | movzx ecx, ax // 488d0c5f | dec eax // e8???????? | $sequence_4 = { b800000004 4c8d9c2480030000 498b5b10 498b7318 498b7b20 } // n = 5, score = 600 // b800000004 | mov ecx, ebx // 4c8d9c2480030000 | and ecx, 0xf // 498b5b10 | dec eax // 498b7318 | shl ebx, 0x10 // 498b7b20 | rdtsc $sequence_5 = { 498bd6 884301 488d466a 4889830e030000 48c783160300005c020000 } // n = 5, score = 600 // 498bd6 | mov eax, ebx // 884301 | dec eax // 488d466a | or eax, edx // 4889830e030000 | movzx ecx, ax // 48c783160300005c020000 | dec eax $sequence_6 = { 488da878fdffff 4881ec80030000 448b7102 4c8d4c2460 488db1c6020000 e8???????? } // n = 6, score = 500 // 488da878fdffff | dec eax // 4881ec80030000 | or eax, edx // 448b7102 | movzx ecx, ax // 4c8d4c2460 | dec eax // 488db1c6020000 | or ebx, ecx // e8???????? | $sequence_7 = { 33db 8d7b04 48c1e310 0f31 } // n = 4, score = 500 // 33db | or eax, edx // 8d7b04 | movzx ecx, ax // 48c1e310 | dec eax // 0f31 | or ebx, ecx $sequence_8 = { 33d2 488bc8 ff15???????? b800000004 4c8d9c2480030000 } // n = 5, score = 500 // 33d2 | or ebx, ecx // 488bc8 | rdtsc // ff15???????? | // b800000004 | dec eax // 4c8d9c2480030000 | shl edx, 0x20 $sequence_9 = { f30f7f85d8050000 c785e805000065727300 c785f000000057696e68 c785f40000007474702e c785f8000000646c6c00 e8???????? 660f6f05???????? } // n = 7, score = 400 // f30f7f85d8050000 | dec esp // c785e805000065727300 | lea ebx, [esp + 0x380] // c785f000000057696e68 | dec eax // c785f40000007474702e | mov ecx, eax // c785f8000000646c6c00 | mov eax, 0x4000000 // e8???????? | // 660f6f05???????? | $sequence_10 = { c7858000000057696e68 c785840000007474702e c78588000000646c6c00 e8???????? } // n = 4, score = 400 // c7858000000057696e68 | mov ecx, eax // c785840000007474702e | mov eax, 0x4000000 // c78588000000646c6c00 | dec esp // e8???????? | $sequence_11 = { f30f7f8540070000 c7851001000057696e68 c785140100007474702e c78518010000646c6c00 e8???????? 660f6f05???????? } // n = 6, score = 400 // f30f7f8540070000 | dec esp // c7851001000057696e68 | lea ebx, [esp + 0x380] // c785140100007474702e | dec ecx // c78518010000646c6c00 | mov ebx, dword ptr [ebx + 0x10] // e8???????? | // 660f6f05???????? | $sequence_12 = { 4883ec28 eb0b b9e8030000 ff15???????? 833d????????00 74ec 33c9 } // n = 7, score = 400 // 4883ec28 | add ebx, eax // eb0b | dec eax // b9e8030000 | mov edx, esi // ff15???????? | // 833d????????00 | // 74ec | dec eax // 33c9 | shl edx, 0x20 $sequence_13 = { 6685c9 75d8 3bd5 7594 } // n = 4, score = 400 // 6685c9 | mov ecx, eax // 75d8 | mov eax, 0x4000000 // 3bd5 | dec esp // 7594 | lea ebx, [esp + 0x380] $sequence_14 = { 66c785940700007000 c785a00100006b65726e c785a4010000656c3332 c785a80100002e646c6c } // n = 4, score = 400 // 66c785940700007000 | dec ecx // c785a00100006b65726e | mov esi, dword ptr [ebx + 0x18] // c785a4010000656c3332 | dec ecx // c785a80100002e646c6c | mov edi, dword ptr [ebx + 0x20] $sequence_15 = { c745e4416c6c6f 66c745e86300 c785b00300004b65726e c785b4030000656c3332 } // n = 4, score = 400 // c745e4416c6c6f | dec esp // 66c745e86300 | mov eax, ebx // c785b00300004b65726e | xor edx, edx // c785b4030000656c3332 | dec eax $sequence_16 = { c7457057696e48 c745747474704f c7457870656e00 c7858000000057696e68 c785840000007474702e } // n = 5, score = 400 // c7457057696e48 | mov ecx, eax // c745747474704f | mov eax, 0x4000000 // c7457870656e00 | dec esp // c7858000000057696e68 | lea ebx, [esp + 0x380] // c785840000007474702e | dec eax $sequence_17 = { c3 4883ec38 83fa01 751f 488364242800 } // n = 5, score = 400 // c3 | dec eax // 4883ec38 | add ebx, eax // 83fa01 | dec eax // 751f | mov edx, esi // 488364242800 | dec eax $sequence_18 = { 0f4dc8 69ff01010000 0fbec1 03f8 c1e010 33f8 } // n = 6, score = 400 // 0f4dc8 | dec ecx // 69ff01010000 | mov ebx, dword ptr [ebx + 0x10] // 0fbec1 | dec esp // 03f8 | mov eax, ebx // c1e010 | xor edx, edx // 33f8 | dec eax $sequence_19 = { 48ffc1 4983e801 75ec b801000000 eba6 488bc4 48895808 } // n = 7, score = 300 // 48ffc1 | dec eax // 4983e801 | or eax, edx // 75ec | movzx ecx, ax // b801000000 | lea edi, [ebx + 4] // eba6 | dec eax // 488bc4 | shl ebx, 0x10 // 48895808 | rdtsc $sequence_20 = { 8a440414 88441c14 8b442410 884c0414 8a441c14 02c2 0fb6c0 } // n = 7, score = 200 // 8a440414 | dec eax // 88441c14 | add ebx, ecx // 8b442410 | dec eax // 884c0414 | lea ecx, [edi + ebx*2] // 8a441c14 | dec eax // 02c2 | add ebx, eax // 0fb6c0 | dec eax $sequence_21 = { 8bf8 83ffff 7504 33c0 eb7f 53 } // n = 6, score = 200 // 8bf8 | lea ecx, [edi + ebx*2] // 83ffff | dec eax // 7504 | sub esp, 0x28 // 33c0 | jmp 0xd // eb7f | mov ecx, 0x3e8 // 53 | je 0xfffffff5 $sequence_22 = { 8bd7 8d0c5d00000000 50 03cd e8???????? 59 } // n = 6, score = 200 // 8bd7 | dec eax // 8d0c5d00000000 | lea ecx, [edi + ebx*2] // 50 | dec eax // 03cd | add ebx, ecx // e8???????? | // 59 | dec eax $sequence_23 = { 55 56 33c0 8d6c240c 57 } // n = 5, score = 200 // 55 | add ebx, ecx // 56 | dec eax // 33c0 | lea ecx, [edi + ebx*2] // 8d6c240c | dec eax // 57 | add ebx, eax $sequence_24 = { 8903 8d44242c 50 6804010000 } // n = 4, score = 200 // 8903 | jmp 0xd // 8d44242c | mov ecx, 0x3e8 // 50 | dec eax // 6804010000 | arpl ax, cx $sequence_25 = { 51 ffd6 ff74243c 03f8 55 68???????? 8d047b } // n = 7, score = 200 // 51 | dec eax // ffd6 | lea ecx, [edi + ebx*2] // ff74243c | dec eax // 03f8 | add ebx, eax // 55 | dec eax // 68???????? | // 8d047b | add ebx, ecx $sequence_26 = { 0fa2 894500 33c0 895d04 40 894d08 89550c } // n = 7, score = 200 // 0fa2 | dec eax // 894500 | sub esp, 0x28 // 33c0 | jmp 0xd // 895d04 | mov ecx, 0x3e8 // 40 | dec eax // 894d08 | arpl ax, cx // 89550c | dec eax $sequence_27 = { 897c241c e8???????? 83c40c 89742438 68???????? 68???????? } // n = 6, score = 200 // 897c241c | lea ecx, [edi + ebx*2] // e8???????? | // 83c40c | dec eax // 89742438 | add ebx, eax // 68???????? | // 68???????? | $sequence_28 = { b801000000 eba6 48895c2408 48896c2410 } // n = 4, score = 200 // b801000000 | dec eax // eba6 | lea eax, [esi + 0x6a] // 48895c2408 | dec eax // 48896c2410 | mov dword ptr [ebx + 0x30e], eax $sequence_29 = { 7508 c744244078000000 4c8d442440 488bce 488d15f35e0000 e8???????? 488d9570010000 } // n = 7, score = 100 // 7508 | dec eax // c744244078000000 | shl edx, 0x20 // 4c8d442440 | dec eax // 488bce | or eax, edx // 488d15f35e0000 | lea edi, [ebx + 4] // e8???????? | // 488d9570010000 | dec eax $sequence_30 = { 85c0 7507 488d1517550000 ff15???????? } // n = 4, score = 100 // 85c0 | dec eax // 7507 | shl ebx, 0x10 // 488d1517550000 | rdtsc // ff15???????? | $sequence_31 = { e8???????? 4885c0 488d1569510000 488bf8 480f45d0 } // n = 5, score = 100 // e8???????? | // 4885c0 | shl edx, 0x20 // 488d1569510000 | xor ebx, ebx // 488bf8 | lea edi, [ebx + 4] // 480f45d0 | dec eax $sequence_32 = { 4803d8 488d153c5f0000 4c8bc7 488d0c5e e8???????? } // n = 5, score = 100 // 4803d8 | movzx ecx, ax // 488d153c5f0000 | dec eax // 4c8bc7 | or ebx, ecx // 488d0c5e | lea edi, [ebx + 4] // e8???????? | $sequence_33 = { 488d0c5e 4c8d057d5e0000 488d15fe5d0000 ff15???????? 4863c8 4803d9 } // n = 6, score = 100 // 488d0c5e | lea edi, [ebx + 4] // 4c8d057d5e0000 | dec eax // 488d15fe5d0000 | shl ebx, 0x10 // ff15???????? | // 4863c8 | rdtsc // 4803d9 | dec eax $sequence_34 = { f7d8 488d0c5f 4c8d05c4590000 488bd6 451bc9 4183e120 } // n = 6, score = 100 // f7d8 | dec eax // 488d0c5f | shl edx, 0x20 // 4c8d05c4590000 | dec eax // 488bd6 | or eax, edx // 451bc9 | movzx ecx, ax // 4183e120 | xor ebx, ebx condition: 7 of them and filesize < 98304 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY