There is no description at this point.
rule win_ragnarlocker_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-12-22" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarlocker" malpedia_rule_date = "20201222" malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130" malpedia_version = "20201023" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8bf1 3375e8 2375ac 234de8 8b45d4 } // n = 5, score = 300 // 8bf1 | mov esi, ecx // 3375e8 | xor esi, dword ptr [ebp - 0x18] // 2375ac | and esi, dword ptr [ebp - 0x54] // 234de8 | and ecx, dword ptr [ebp - 0x18] // 8b45d4 | mov eax, dword ptr [ebp - 0x2c] $sequence_1 = { c1e308 0bd8 0fb64133 0fa4de08 99 0bf2 c1e308 } // n = 7, score = 300 // c1e308 | shl ebx, 8 // 0bd8 | or ebx, eax // 0fb64133 | movzx eax, byte ptr [ecx + 0x33] // 0fa4de08 | shld esi, ebx, 8 // 99 | cdq // 0bf2 | or esi, edx // c1e308 | shl ebx, 8 $sequence_2 = { 33d2 898508ffffff 8bd9 8b473c 33ff 898504ffffff 8b851cffffff } // n = 7, score = 300 // 33d2 | xor edx, edx // 898508ffffff | mov dword ptr [ebp - 0xf8], eax // 8bd9 | mov ebx, ecx // 8b473c | mov eax, dword ptr [edi + 0x3c] // 33ff | xor edi, edi // 898504ffffff | mov dword ptr [ebp - 0xfc], eax // 8b851cffffff | mov eax, dword ptr [ebp - 0xe4] $sequence_3 = { 8bf1 8b45f4 0fa4c119 c1ee07 c1e019 0bd1 0bf0 } // n = 7, score = 300 // 8bf1 | mov esi, ecx // 8b45f4 | mov eax, dword ptr [ebp - 0xc] // 0fa4c119 | shld ecx, eax, 0x19 // c1ee07 | shr esi, 7 // c1e019 | shl eax, 0x19 // 0bd1 | or edx, ecx // 0bf0 | or esi, eax $sequence_4 = { 33de 8b75f8 0facd107 33f7 c1ea07 33d9 8b8d58ffffff } // n = 7, score = 300 // 33de | xor ebx, esi // 8b75f8 | mov esi, dword ptr [ebp - 8] // 0facd107 | shrd ecx, edx, 7 // 33f7 | xor esi, edi // c1ea07 | shr edx, 7 // 33d9 | xor ebx, ecx // 8b8d58ffffff | mov ecx, dword ptr [ebp - 0xa8] $sequence_5 = { 13f7 99 8975b0 8bd8 0fb64151 8bf2 0fa4de08 } // n = 7, score = 300 // 13f7 | adc esi, edi // 99 | cdq // 8975b0 | mov dword ptr [ebp - 0x50], esi // 8bd8 | mov ebx, eax // 0fb64151 | movzx eax, byte ptr [ecx + 0x51] // 8bf2 | mov esi, edx // 0fa4de08 | shld esi, ebx, 8 $sequence_6 = { 234de0 2345dc 2375d8 2355ec 33f1 } // n = 5, score = 300 // 234de0 | and ecx, dword ptr [ebp - 0x20] // 2345dc | and eax, dword ptr [ebp - 0x24] // 2375d8 | and esi, dword ptr [ebp - 0x28] // 2355ec | and edx, dword ptr [ebp - 0x14] // 33f1 | xor esi, ecx $sequence_7 = { 8bf9 0facd112 c1e70e c1ea12 0bfa 8975fc 8b55f0 } // n = 7, score = 300 // 8bf9 | mov edi, ecx // 0facd112 | shrd ecx, edx, 0x12 // c1e70e | shl edi, 0xe // c1ea12 | shr edx, 0x12 // 0bfa | or edi, edx // 8975fc | mov dword ptr [ebp - 4], esi // 8b55f0 | mov edx, dword ptr [ebp - 0x10] $sequence_8 = { 8b55ec 8b4df8 03cf 13de 034860 135864 034d90 } // n = 7, score = 300 // 8b55ec | mov edx, dword ptr [ebp - 0x14] // 8b4df8 | mov ecx, dword ptr [ebp - 8] // 03cf | add ecx, edi // 13de | adc ebx, esi // 034860 | add ecx, dword ptr [eax + 0x60] // 135864 | adc ebx, dword ptr [eax + 0x64] // 034d90 | add ecx, dword ptr [ebp - 0x70] $sequence_9 = { 0bf2 8b55f4 897dd8 8bfa } // n = 4, score = 300 // 0bf2 | or esi, edx // 8b55f4 | mov edx, dword ptr [ebp - 0xc] // 897dd8 | mov dword ptr [ebp - 0x28], edi // 8bfa | mov edi, edx condition: 7 of them and filesize < 147456 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY