win.pitou (Back to overview)

Pitou


There is no description at this point.

References
https://isc.sans.edu/diary/rss/25068
https://johannesbader.ch/2019/07/the-dga-of-pitou/
https://www.f-secure.com/documents/996508/1030745/pitou_whitepaper.pdf
https://www.tgsoft.it/english/news_archivio_eng.asp?id=884
Yara Rules
[TLP:WHITE] win_pitou_auto (20190620 | autogenerated rule brought to you by yara-signator)
rule win_pitou_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2019-07-05"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator 0.2a"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.pitou"
        malpedia_version = "20190620"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */

    strings:
        $sequence_0 = { 8afb 80e703 c0eb05 80e303 }
            // n = 4, score = 700
            //   8afb                 | mov                 bh, bl
            //   80e703               | and                 bh, 3
            //   c0eb05               | shr                 bl, 5
            //   80e303               | and                 bl, 3

        $sequence_1 = { 0f8????????? 8afb 80e703 c0eb05 80e303 80ff00 }
            // n = 6, score = 700
            //   0f8?????????         |                     
            //   8afb                 | mov                 bh, bl
            //   80e703               | and                 bh, 3
            //   c0eb05               | shr                 bl, 5
            //   80e303               | and                 bl, 3
            //   80ff00               | cmp                 bh, 0

        $sequence_2 = { 22cf f6c340 0f8????????? 3acf 0f8????????? }
            // n = 5, score = 700
            //   22cf                 | and                 cl, bh
            //   f6c340               | test                bl, 0x40
            //   0f8?????????         |                     
            //   3acf                 | cmp                 cl, bh
            //   0f8?????????         |                     

        $sequence_3 = { c0eb05 80e303 80ff00 0f8????????? 80fb00 }
            // n = 5, score = 700
            //   c0eb05               | shr                 bl, 5
            //   80e303               | and                 bl, 3
            //   80ff00               | cmp                 bh, 0
            //   0f8?????????         |                     
            //   80fb00               | cmp                 bl, 0

        $sequence_4 = { 0f8????????? ac 2407 2c05 }
            // n = 4, score = 700
            //   0f8?????????         |                     
            //   ac                   | lodsb               al, byte ptr [esi]
            //   2407                 | and                 al, 7
            //   2c05                 | sub                 al, 5

        $sequence_5 = { 0f8????????? 8afb 80e703 c0eb05 }
            // n = 4, score = 700
            //   0f8?????????         |                     
            //   8afb                 | mov                 bh, bl
            //   80e703               | and                 bh, 3
            //   c0eb05               | shr                 bl, 5

        $sequence_6 = { 8a6201 80f457 8acc 80e103 8aec }
            // n = 5, score = 700
            //   8a6201               | mov                 ah, byte ptr [edx + 1]
            //   80f457               | xor                 ah, 0x57
            //   8acc                 | mov                 cl, ah
            //   80e103               | and                 cl, 3
            //   8aec                 | mov                 ch, ah

        $sequence_7 = { 8ae0 c0e807 0f8????????? 0f8????????? }
            // n = 4, score = 700
            //   8ae0                 | mov                 ah, al
            //   c0e807               | shr                 al, 7
            //   0f8?????????         |                     
            //   0f8?????????         |                     

    condition:
        7 of them
}
Download all Yara Rules