Actor(s): BlackTech
PLEAD is a RAT used by the actor BlackTech. FireEye uses the synonyms GOODTIMES for the RAT module and DRAWDOWN for the respective downloader.
rule win_plead_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-05-30" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.4.0" tool_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plead" malpedia_rule_date = "20200529" malpedia_hash = "92c362319514e5a6da26204961446caa3a8b32a8" malpedia_version = "20200529" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using yara-signator. * The code and documentation / approach is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 59 894510 0f878f000000 3bc3 0f8482000000 } // n = 5, score = 900 // 59 | pop ecx // 894510 | mov dword ptr [ebp + 0x10], eax // 0f878f000000 | ja 0x95 // 3bc3 | cmp eax, ebx // 0f8482000000 | je 0x88 $sequence_1 = { 56 e8???????? 40 50 6a01 ff15???????? 83c40c } // n = 7, score = 900 // 56 | push esi // e8???????? | // 40 | inc eax // 50 | push eax // 6a01 | push 1 // ff15???????? | // 83c40c | add esp, 0xc $sequence_2 = { 3bf7 740f ebda 33f6 c745fcf8ffffff } // n = 5, score = 900 // 3bf7 | cmp esi, edi // 740f | je 0x11 // ebda | jmp 0xffffffdc // 33f6 | xor esi, esi // c745fcf8ffffff | mov dword ptr [ebp - 4], 0xfffffff8 $sequence_3 = { 53 51 ffd0 8bf8 57 ff15???????? } // n = 6, score = 900 // 53 | push ebx // 51 | push ecx // ffd0 | call eax // 8bf8 | mov edi, eax // 57 | push edi // ff15???????? | $sequence_4 = { 0faf45fc 8907 83c704 ff4d0c } // n = 4, score = 900 // 0faf45fc | imul eax, dword ptr [ebp - 4] // 8907 | mov dword ptr [edi], eax // 83c704 | add edi, 4 // ff4d0c | dec dword ptr [ebp + 0xc] $sequence_5 = { 8b4514 56 881c30 ff15???????? 3bc3 59 } // n = 6, score = 900 // 8b4514 | mov eax, dword ptr [ebp + 0x14] // 56 | push esi // 881c30 | mov byte ptr [eax + esi], bl // ff15???????? | // 3bc3 | cmp eax, ebx // 59 | pop ecx $sequence_6 = { 85c0 750f 56 ff15???????? 6afe 58 e9???????? } // n = 7, score = 900 // 85c0 | test eax, eax // 750f | jne 0x11 // 56 | push esi // ff15???????? | // 6afe | push -2 // 58 | pop eax // e9???????? | $sequence_7 = { 897518 bf00800000 57 53 56 } // n = 5, score = 900 // 897518 | mov dword ptr [ebp + 0x18], esi // bf00800000 | mov edi, 0x8000 // 57 | push edi // 53 | push ebx // 56 | push esi $sequence_8 = { 8975fc 75ec 8bc6 5e 8be5 } // n = 5, score = 600 // 8975fc | mov dword ptr [ebp - 4], esi // 75ec | jne 0xffffffee // 8bc6 | mov eax, esi // 5e | pop esi // 8be5 | mov esp, ebp $sequence_9 = { 81c418020000 c21000 8b8c241c020000 68???????? } // n = 4, score = 600 // 81c418020000 | add esp, 0x218 // c21000 | ret 0x10 // 8b8c241c020000 | mov ecx, dword ptr [esp + 0x21c] // 68???????? | $sequence_10 = { 8b8c241c020000 68???????? 51 ff15???????? 33c0 81c418020000 c21000 } // n = 7, score = 600 // 8b8c241c020000 | mov ecx, dword ptr [esp + 0x21c] // 68???????? | // 51 | push ecx // ff15???????? | // 33c0 | xor eax, eax // 81c418020000 | add esp, 0x218 // c21000 | ret 0x10 $sequence_11 = { 8b8c242c020000 51 ff15???????? 8d54240c 52 ff15???????? 8d842420010000 } // n = 7, score = 600 // 8b8c242c020000 | mov ecx, dword ptr [esp + 0x22c] // 51 | push ecx // ff15???????? | // 8d54240c | lea edx, [esp + 0xc] // 52 | push edx // ff15???????? | // 8d842420010000 | lea eax, [esp + 0x120] $sequence_12 = { 52 53 50 8b1d???????? ffd3 85c0 743b } // n = 7, score = 600 // 52 | push edx // 53 | push ebx // 50 | push eax // 8b1d???????? | // ffd3 | call ebx // 85c0 | test eax, eax // 743b | je 0x3d $sequence_13 = { 6a00 6a00 50 c705????????00000000 ff15???????? 33c0 81c418020000 } // n = 7, score = 600 // 6a00 | push 0 // 6a00 | push 0 // 50 | push eax // c705????????00000000 | // ff15???????? | // 33c0 | xor eax, eax // 81c418020000 | add esp, 0x218 $sequence_14 = { 7e1c 55 8bc7 33d2 } // n = 4, score = 600 // 7e1c | jle 0x1e // 55 | push ebp // 8bc7 | mov eax, edi // 33d2 | xor edx, edx $sequence_15 = { 8b4c2408 81ec18020000 8d41d0 3de0000000 } // n = 4, score = 600 // 8b4c2408 | mov ecx, dword ptr [esp + 8] // 81ec18020000 | sub esp, 0x218 // 8d41d0 | lea eax, [ecx - 0x30] // 3de0000000 | cmp eax, 0xe0 $sequence_16 = { 648b1530000000 8b520c 8b521c 8b5a08 } // n = 4, score = 200 // 648b1530000000 | mov edx, dword ptr fs:[0x30] // 8b520c | mov edx, dword ptr [edx + 0xc] // 8b521c | mov edx, dword ptr [edx + 0x1c] // 8b5a08 | mov ebx, dword ptr [edx + 8] $sequence_17 = { 8b733c 8b741e78 03f3 56 8b7620 03f3 } // n = 6, score = 200 // 8b733c | mov esi, dword ptr [ebx + 0x3c] // 8b741e78 | mov esi, dword ptr [esi + ebx + 0x78] // 03f3 | add esi, ebx // 56 | push esi // 8b7620 | mov esi, dword ptr [esi + 0x20] // 03f3 | add esi, ebx $sequence_18 = { 8945f4 e8???????? 85c0 0f849f020000 8945f0 6a0c 8d4de0 } // n = 7, score = 100 // 8945f4 | mov dword ptr [ebp - 0xc], eax // e8???????? | // 85c0 | test eax, eax // 0f849f020000 | je 0x2a5 // 8945f0 | mov dword ptr [ebp - 0x10], eax // 6a0c | push 0xc // 8d4de0 | lea ecx, [ebp - 0x20] $sequence_19 = { 394510 747e 394514 7679 8b4d0c } // n = 5, score = 100 // 394510 | cmp dword ptr [ebp + 0x10], eax // 747e | je 0x80 // 394514 | cmp dword ptr [ebp + 0x14], eax // 7679 | jbe 0x7b // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] $sequence_20 = { 895704 3bda 0f8568ffffff e8???????? 8b7df0 e9???????? } // n = 6, score = 100 // 895704 | mov dword ptr [edi + 4], edx // 3bda | cmp ebx, edx // 0f8568ffffff | jne 0xffffff6e // e8???????? | // 8b7df0 | mov edi, dword ptr [ebp - 0x10] // e9???????? | $sequence_21 = { ff5648 eb0d ff75f8 e8???????? 8b45f8 eb02 } // n = 6, score = 100 // ff5648 | call dword ptr [esi + 0x48] // eb0d | jmp 0xf // ff75f8 | push dword ptr [ebp - 8] // e8???????? | // 8b45f8 | mov eax, dword ptr [ebp - 8] // eb02 | jmp 4 $sequence_22 = { 85c0 741d ff7304 50 ff750c } // n = 5, score = 100 // 85c0 | test eax, eax // 741d | je 0x1f // ff7304 | push dword ptr [ebx + 4] // 50 | push eax // ff750c | push dword ptr [ebp + 0xc] $sequence_23 = { 03c2 46 e2f5 5a 5e } // n = 5, score = 100 // 03c2 | add eax, edx // 46 | inc esi // e2f5 | loop 0xfffffff7 // 5a | pop edx // 5e | pop esi condition: 7 of them and filesize < 8224768 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY