Actor(s): BlackTech
PLEAD is a RAT used by the actor BlackTech. FireEye uses the synonyms GOODTIMES for the RAT module and DRAWDOWN for the respective downloader.
rule win_plead_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.plead." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.plead" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 740f ebda 33f6 c745fcf8ffffff } // n = 4, score = 900 // 740f | je 0x11 // ebda | jmp 0xffffffdc // 33f6 | xor esi, esi // c745fcf8ffffff | mov dword ptr [ebp - 4], 0xfffffff8 $sequence_1 = { 8b4514 56 881c30 ff15???????? 3dc8000000 59 } // n = 6, score = 900 // 8b4514 | mov eax, dword ptr [ebp + 0x14] // 56 | push esi // 881c30 | mov byte ptr [eax + esi], bl // ff15???????? | // 3dc8000000 | cmp eax, 0xc8 // 59 | pop ecx $sequence_2 = { 7503 897518 bf00800000 57 53 56 } // n = 6, score = 900 // 7503 | jne 5 // 897518 | mov dword ptr [ebp + 0x18], esi // bf00800000 | mov edi, 0x8000 // 57 | push edi // 53 | push ebx // 56 | push esi $sequence_3 = { 57 53 56 897d14 e8???????? 83c40c 8d4514 } // n = 7, score = 900 // 57 | push edi // 53 | push ebx // 56 | push esi // 897d14 | mov dword ptr [ebp + 0x14], edi // e8???????? | // 83c40c | add esp, 0xc // 8d4514 | lea eax, [ebp + 0x14] $sequence_4 = { 750f 56 ff15???????? 6afe 58 } // n = 5, score = 900 // 750f | jne 0x11 // 56 | push esi // ff15???????? | // 6afe | push -2 // 58 | pop eax $sequence_5 = { 85f6 7417 56 e8???????? 40 } // n = 5, score = 900 // 85f6 | test esi, esi // 7417 | je 0x19 // 56 | push esi // e8???????? | // 40 | inc eax $sequence_6 = { 0145fc ff75fc ff15???????? 59 } // n = 4, score = 900 // 0145fc | add dword ptr [ebp - 4], eax // ff75fc | push dword ptr [ebp - 4] // ff15???????? | // 59 | pop ecx $sequence_7 = { 59 59 5e c20400 8b4c2404 56 33f6 } // n = 7, score = 900 // 59 | pop ecx // 59 | pop ecx // 5e | pop esi // c20400 | ret 4 // 8b4c2404 | mov ecx, dword ptr [esp + 4] // 56 | push esi // 33f6 | xor esi, esi $sequence_8 = { 6804010000 ff15???????? 8b4c2412 8b54240e 8b44240c 81e1ffff0000 } // n = 6, score = 600 // 6804010000 | push 0x104 // ff15???????? | // 8b4c2412 | mov ecx, dword ptr [esp + 0x12] // 8b54240e | mov edx, dword ptr [esp + 0xe] // 8b44240c | mov eax, dword ptr [esp + 0xc] // 81e1ffff0000 | and ecx, 0xffff $sequence_9 = { 8b8c241c020000 68???????? 51 ff15???????? 33c0 81c418020000 c21000 } // n = 7, score = 600 // 8b8c241c020000 | mov ecx, dword ptr [esp + 0x21c] // 68???????? | // 51 | push ecx // ff15???????? | // 33c0 | xor eax, eax // 81c418020000 | add esp, 0x218 // c21000 | ret 0x10 $sequence_10 = { c705????????01000000 ff15???????? 8b1d???????? ffd3 8bf8 } // n = 5, score = 600 // c705????????01000000 | // ff15???????? | // 8b1d???????? | // ffd3 | call ebx // 8bf8 | mov edi, eax $sequence_11 = { c21000 8b942428020000 8b842424020000 52 } // n = 4, score = 600 // c21000 | ret 0x10 // 8b942428020000 | mov edx, dword ptr [esp + 0x228] // 8b842424020000 | mov eax, dword ptr [esp + 0x224] // 52 | push edx $sequence_12 = { 6801020000 6a01 50 ff15???????? 50 } // n = 5, score = 600 // 6801020000 | push 0x201 // 6a01 | push 1 // 50 | push eax // ff15???????? | // 50 | push eax $sequence_13 = { 03f2 40 49 8975fc 75ec 8bc6 } // n = 6, score = 600 // 03f2 | add esi, edx // 40 | inc eax // 49 | dec ecx // 8975fc | mov dword ptr [ebp - 4], esi // 75ec | jne 0xffffffee // 8bc6 | mov eax, esi $sequence_14 = { 6a00 6a00 50 c705????????00000000 ff15???????? 33c0 } // n = 6, score = 600 // 6a00 | push 0 // 6a00 | push 0 // 50 | push eax // c705????????00000000 | // ff15???????? | // 33c0 | xor eax, eax $sequence_15 = { 50 51 8b8c2428020000 51 ff15???????? } // n = 5, score = 600 // 50 | push eax // 51 | push ecx // 8b8c2428020000 | mov ecx, dword ptr [esp + 0x228] // 51 | push ecx // ff15???????? | $sequence_16 = { 648b1530000000 8b520c 8b521c 8b5a08 } // n = 4, score = 200 // 648b1530000000 | mov edx, dword ptr fs:[0x30] // 8b520c | mov edx, dword ptr [edx + 0xc] // 8b521c | mov edx, dword ptr [edx + 0x1c] // 8b5a08 | mov ebx, dword ptr [edx + 8] $sequence_17 = { 56 394510 747e 394514 } // n = 4, score = 100 // 56 | push esi // 394510 | cmp dword ptr [ebp + 0x10], eax // 747e | je 0x80 // 394514 | cmp dword ptr [ebp + 0x14], eax $sequence_18 = { ff563c 50 ff5628 c3 } // n = 4, score = 100 // ff563c | call dword ptr [esi + 0x3c] // 50 | push eax // ff5628 | call dword ptr [esi + 0x28] // c3 | ret $sequence_19 = { 0fb74814 8d5c0118 53 33c9 51 8b45fc } // n = 6, score = 100 // 0fb74814 | movzx ecx, word ptr [eax + 0x14] // 8d5c0118 | lea ebx, [ecx + eax + 0x18] // 53 | push ebx // 33c9 | xor ecx, ecx // 51 | push ecx // 8b45fc | mov eax, dword ptr [ebp - 4] $sequence_20 = { 0fb708 83c002 6a00 51 50 e8???????? } // n = 6, score = 100 // 0fb708 | movzx ecx, word ptr [eax] // 83c002 | add eax, 2 // 6a00 | push 0 // 51 | push ecx // 50 | push eax // e8???????? | $sequence_21 = { 0fb703 85c0 741d ff7304 50 } // n = 5, score = 100 // 0fb703 | movzx eax, word ptr [ebx] // 85c0 | test eax, eax // 741d | je 0x1f // ff7304 | push dword ptr [ebx + 4] // 50 | push eax $sequence_22 = { 53 57 51 035b3c 894334 e8???????? 8b45f8 } // n = 7, score = 100 // 53 | push ebx // 57 | push edi // 51 | push ecx // 035b3c | add ebx, dword ptr [ebx + 0x3c] // 894334 | mov dword ptr [ebx + 0x34], eax // e8???????? | // 8b45f8 | mov eax, dword ptr [ebp - 8] $sequence_23 = { 8b4b10 85c9 751a f6c240 7408 8b4dfc 8b4920 } // n = 7, score = 100 // 8b4b10 | mov ecx, dword ptr [ebx + 0x10] // 85c9 | test ecx, ecx // 751a | jne 0x1c // f6c240 | test dl, 0x40 // 7408 | je 0xa // 8b4dfc | mov ecx, dword ptr [ebp - 4] // 8b4920 | mov ecx, dword ptr [ecx + 0x20] condition: 7 of them and filesize < 8224768 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY