Actor(s): Groundbait
There is no description at this point.
rule win_prikormka_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.prikormka." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.prikormka" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8d0446 50 e8???????? 83c40c 6a00 56 } // n = 6, score = 1600 // 8d0446 | lea eax, [esi + eax*2] // 50 | push eax // e8???????? | // 83c40c | add esp, 0xc // 6a00 | push 0 // 56 | push esi $sequence_1 = { 83c40c 6a00 56 ffd3 8b2d???????? 85c0 7405 } // n = 7, score = 1400 // 83c40c | add esp, 0xc // 6a00 | push 0 // 56 | push esi // ffd3 | call ebx // 8b2d???????? | // 85c0 | test eax, eax // 7405 | je 7 $sequence_2 = { ffd3 85c0 7405 6a02 56 } // n = 5, score = 1400 // ffd3 | call ebx // 85c0 | test eax, eax // 7405 | je 7 // 6a02 | push 2 // 56 | push esi $sequence_3 = { 85f6 7420 68???????? ffd7 } // n = 4, score = 1400 // 85f6 | test esi, esi // 7420 | je 0x22 // 68???????? | // ffd7 | call edi $sequence_4 = { 740e 68???????? 50 ff15???????? ffd0 } // n = 5, score = 1400 // 740e | je 0x10 // 68???????? | // 50 | push eax // ff15???????? | // ffd0 | call eax $sequence_5 = { 8d1446 52 e8???????? 83c40c } // n = 4, score = 1400 // 8d1446 | lea edx, [esi + eax*2] // 52 | push edx // e8???????? | // 83c40c | add esp, 0xc $sequence_6 = { 83c40c 68???????? ffd7 03c0 50 68???????? 56 } // n = 7, score = 1400 // 83c40c | add esp, 0xc // 68???????? | // ffd7 | call edi // 03c0 | add eax, eax // 50 | push eax // 68???????? | // 56 | push esi $sequence_7 = { 6800020000 ff15???????? 68???????? ffd7 } // n = 4, score = 1400 // 6800020000 | push 0x200 // ff15???????? | // 68???????? | // ffd7 | call edi $sequence_8 = { 7408 41 42 3bce } // n = 4, score = 1000 // 7408 | je 0xa // 41 | inc ecx // 42 | inc edx // 3bce | cmp ecx, esi $sequence_9 = { 8d442404 50 ff15???????? 5e 85c0 } // n = 5, score = 1000 // 8d442404 | lea eax, [esp + 4] // 50 | push eax // ff15???????? | // 5e | pop esi // 85c0 | test eax, eax $sequence_10 = { 6a00 ff15???????? 85c0 7502 59 c3 50 } // n = 7, score = 1000 // 6a00 | push 0 // ff15???????? | // 85c0 | test eax, eax // 7502 | jne 4 // 59 | pop ecx // c3 | ret // 50 | push eax $sequence_11 = { ff15???????? ffd0 c705????????01000000 c705????????01000000 } // n = 4, score = 900 // ff15???????? | // ffd0 | call eax // c705????????01000000 | // c705????????01000000 | $sequence_12 = { c3 57 6a00 6a00 6a00 6a02 } // n = 6, score = 900 // c3 | ret // 57 | push edi // 6a00 | push 0 // 6a00 | push 0 // 6a00 | push 0 // 6a02 | push 2 $sequence_13 = { 5e 85c0 7422 68???????? 50 } // n = 5, score = 900 // 5e | pop esi // 85c0 | test eax, eax // 7422 | je 0x24 // 68???????? | // 50 | push eax $sequence_14 = { 83ec08 68???????? ff15???????? 0fb7c0 6683f805 7d09 b801000000 } // n = 7, score = 900 // 83ec08 | sub esp, 8 // 68???????? | // ff15???????? | // 0fb7c0 | movzx eax, ax // 6683f805 | cmp ax, 5 // 7d09 | jge 0xb // b801000000 | mov eax, 1 $sequence_15 = { 5e 85c0 7414 c705????????01000000 } // n = 4, score = 700 // 5e | pop esi // 85c0 | test eax, eax // 7414 | je 0x16 // c705????????01000000 | $sequence_16 = { ff15???????? 3db7000000 750e 56 ff15???????? 33c0 5e } // n = 7, score = 700 // ff15???????? | // 3db7000000 | cmp eax, 0xb7 // 750e | jne 0x10 // 56 | push esi // ff15???????? | // 33c0 | xor eax, eax // 5e | pop esi $sequence_17 = { 33f6 e8???????? e8???????? e8???????? e8???????? e8???????? e8???????? } // n = 7, score = 700 // 33f6 | xor esi, esi // e8???????? | // e8???????? | // e8???????? | // e8???????? | // e8???????? | // e8???????? | $sequence_18 = { 668b08 83c002 6685c9 75f5 8b0d???????? 2bc2 8b15???????? } // n = 7, score = 600 // 668b08 | mov cx, word ptr [eax] // 83c002 | add eax, 2 // 6685c9 | test cx, cx // 75f5 | jne 0xfffffff7 // 8b0d???????? | // 2bc2 | sub eax, edx // 8b15???????? | $sequence_19 = { ff15???????? 8bf0 ff15???????? 3db7000000 751f 56 ff15???????? } // n = 7, score = 600 // ff15???????? | // 8bf0 | mov esi, eax // ff15???????? | // 3db7000000 | cmp eax, 0xb7 // 751f | jne 0x21 // 56 | push esi // ff15???????? | $sequence_20 = { 6685d2 75f5 2bce 8d1400 52 } // n = 5, score = 600 // 6685d2 | test dx, dx // 75f5 | jne 0xfffffff7 // 2bce | sub ecx, esi // 8d1400 | lea edx, [eax + eax] // 52 | push edx $sequence_21 = { e8???????? 8b35???????? 83c40c 68???????? ffd6 03c0 } // n = 6, score = 500 // e8???????? | // 8b35???????? | // 83c40c | add esp, 0xc // 68???????? | // ffd6 | call esi // 03c0 | add eax, eax $sequence_22 = { 83c002 6685c9 75f5 2bc6 8d0c12 51 d1f8 } // n = 7, score = 500 // 83c002 | add eax, 2 // 6685c9 | test cx, cx // 75f5 | jne 0xfffffff7 // 2bc6 | sub eax, esi // 8d0c12 | lea ecx, [edx + edx] // 51 | push ecx // d1f8 | sar eax, 1 $sequence_23 = { d1f8 8d7102 8da42400000000 668b11 83c102 } // n = 5, score = 500 // d1f8 | sar eax, 1 // 8d7102 | lea esi, [ecx + 2] // 8da42400000000 | lea esp, [esp] // 668b11 | mov dx, word ptr [ecx] // 83c102 | add ecx, 2 $sequence_24 = { 75f5 8d0c12 2bc6 51 d1f8 8d544408 } // n = 6, score = 500 // 75f5 | jne 0xfffffff7 // 8d0c12 | lea ecx, [edx + edx] // 2bc6 | sub eax, esi // 51 | push ecx // d1f8 | sar eax, 1 // 8d544408 | lea edx, [esp + eax*2 + 8] $sequence_25 = { 50 e8???????? b8???????? 83c40c 8d5002 } // n = 5, score = 500 // 50 | push eax // e8???????? | // b8???????? | // 83c40c | add esp, 0xc // 8d5002 | lea edx, [eax + 2] $sequence_26 = { 83c420 8d5002 668b08 83c002 } // n = 4, score = 400 // 83c420 | add esp, 0x20 // 8d5002 | lea edx, [eax + 2] // 668b08 | mov cx, word ptr [eax] // 83c002 | add eax, 2 $sequence_27 = { 85c0 7409 6a02 68???????? } // n = 4, score = 400 // 85c0 | test eax, eax // 7409 | je 0xb // 6a02 | push 2 // 68???????? | $sequence_28 = { 6685c9 75f5 2bc7 8d0c12 } // n = 4, score = 400 // 6685c9 | test cx, cx // 75f5 | jne 0xfffffff7 // 2bc7 | sub eax, edi // 8d0c12 | lea ecx, [edx + edx] $sequence_29 = { 6685c9 75f5 2bc2 d1f8 8bd0 b8???????? } // n = 6, score = 300 // 6685c9 | test cx, cx // 75f5 | jne 0xfffffff7 // 2bc2 | sub eax, edx // d1f8 | sar eax, 1 // 8bd0 | mov edx, eax // b8???????? | $sequence_30 = { b9???????? d1f8 8d7102 668b11 83c102 6685d2 } // n = 6, score = 300 // b9???????? | // d1f8 | sar eax, 1 // 8d7102 | lea esi, [ecx + 2] // 668b11 | mov dx, word ptr [ecx] // 83c102 | add ecx, 2 // 6685d2 | test dx, dx $sequence_31 = { 68???????? 57 ffd6 03c7 50 e8???????? 83c40c } // n = 7, score = 300 // 68???????? | // 57 | push edi // ffd6 | call esi // 03c7 | add eax, edi // 50 | push eax // e8???????? | // 83c40c | add esp, 0xc $sequence_32 = { 83c40c eb0d 6a00 6800020000 ff15???????? } // n = 5, score = 300 // 83c40c | add esp, 0xc // eb0d | jmp 0xf // 6a00 | push 0 // 6800020000 | push 0x200 // ff15???????? | $sequence_33 = { 6685c9 75f5 2bc2 b9???????? d1f8 8d7102 } // n = 6, score = 300 // 6685c9 | test cx, cx // 75f5 | jne 0xfffffff7 // 2bc2 | sub eax, edx // b9???????? | // d1f8 | sar eax, 1 // 8d7102 | lea esi, [ecx + 2] $sequence_34 = { 8bd0 b8???????? 8d7002 8da42400000000 668b08 83c002 } // n = 6, score = 300 // 8bd0 | mov edx, eax // b8???????? | // 8d7002 | lea esi, [eax + 2] // 8da42400000000 | lea esp, [esp] // 668b08 | mov cx, word ptr [eax] // 83c002 | add eax, 2 $sequence_35 = { 68???????? 33ff 57 57 ff15???????? 8bf0 } // n = 6, score = 300 // 68???????? | // 33ff | xor edi, edi // 57 | push edi // 57 | push edi // ff15???????? | // 8bf0 | mov esi, eax $sequence_36 = { 83c102 6685d2 75f5 8d1400 } // n = 4, score = 300 // 83c102 | add ecx, 2 // 6685d2 | test dx, dx // 75f5 | jne 0xfffffff7 // 8d1400 | lea edx, [eax + eax] $sequence_37 = { 83c40c 68???????? ffd6 50 68???????? 57 ffd6 } // n = 7, score = 300 // 83c40c | add esp, 0xc // 68???????? | // ffd6 | call esi // 50 | push eax // 68???????? | // 57 | push edi // ffd6 | call esi $sequence_38 = { 75f5 2bc6 03d2 52 } // n = 4, score = 300 // 75f5 | jne 0xfffffff7 // 2bc6 | sub eax, esi // 03d2 | add edx, edx // 52 | push edx $sequence_39 = { 50 e8???????? 8b1d???????? 83c40c 6a00 68???????? } // n = 6, score = 200 // 50 | push eax // e8???????? | // 8b1d???????? | // 83c40c | add esp, 0xc // 6a00 | push 0 // 68???????? | $sequence_40 = { 40 ebdd 55 8dac2478ffffff 81ec08010000 a1???????? 33c5 } // n = 7, score = 100 // 40 | inc eax // ebdd | jmp 0xffffffdf // 55 | push ebp // 8dac2478ffffff | lea ebp, [esp - 0x88] // 81ec08010000 | sub esp, 0x108 // a1???????? | // 33c5 | xor eax, ebp $sequence_41 = { 6a5c 99 5b f7fb 3bc1 7312 } // n = 6, score = 100 // 6a5c | push 0x5c // 99 | cdq // 5b | pop ebx // f7fb | idiv ebx // 3bc1 | cmp eax, ecx // 7312 | jae 0x14 $sequence_42 = { 85c0 7506 2105???????? 8b8d98010000 5f } // n = 5, score = 100 // 85c0 | test eax, eax // 7506 | jne 8 // 2105???????? | // 8b8d98010000 | mov ecx, dword ptr [ebp + 0x198] // 5f | pop edi $sequence_43 = { 891f 59 395dec 7409 ff75ec } // n = 5, score = 100 // 891f | mov dword ptr [edi], ebx // 59 | pop ecx // 395dec | cmp dword ptr [ebp - 0x14], ebx // 7409 | je 0xb // ff75ec | push dword ptr [ebp - 0x14] $sequence_44 = { 8bf8 e8???????? 85ff 7c67 ff75e8 } // n = 5, score = 100 // 8bf8 | mov edi, eax // e8???????? | // 85ff | test edi, edi // 7c67 | jl 0x69 // ff75e8 | push dword ptr [ebp - 0x18] condition: 7 of them and filesize < 401408 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY
