There is no description at this point.
rule win_ragnarlocker_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.ragnarlocker." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ragnarlocker" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 0fb64705 c1e108 0bc8 0fb64704 c1e108 0bc8 894b08 } // n = 7, score = 300 // 0fb64705 | movzx eax, byte ptr [edi + 5] // c1e108 | shl ecx, 8 // 0bc8 | or ecx, eax // 0fb64704 | movzx eax, byte ptr [edi + 4] // c1e108 | shl ecx, 8 // 0bc8 | or ecx, eax // 894b08 | mov dword ptr [ebx + 8], ecx $sequence_1 = { 0fb64111 8bf2 0fa4de08 99 c1e308 0bf2 } // n = 6, score = 300 // 0fb64111 | movzx eax, byte ptr [ecx + 0x11] // 8bf2 | mov esi, edx // 0fa4de08 | shld esi, ebx, 8 // 99 | cdq // c1e308 | shl ebx, 8 // 0bf2 | or esi, edx $sequence_2 = { 0bf2 c1e11e 3175d4 33f6 8b55b0 c1ef02 0bf9 } // n = 7, score = 300 // 0bf2 | or esi, edx // c1e11e | shl ecx, 0x1e // 3175d4 | xor dword ptr [ebp - 0x2c], esi // 33f6 | xor esi, esi // 8b55b0 | mov edx, dword ptr [ebp - 0x50] // c1ef02 | shr edi, 2 // 0bf9 | or edi, ecx $sequence_3 = { 8975ec 8bf1 8955e8 c1ee02 33d2 0fa4c11e } // n = 6, score = 300 // 8975ec | mov dword ptr [ebp - 0x14], esi // 8bf1 | mov esi, ecx // 8955e8 | mov dword ptr [ebp - 0x18], edx // c1ee02 | shr esi, 2 // 33d2 | xor edx, edx // 0fa4c11e | shld ecx, eax, 0x1e $sequence_4 = { 8bf1 115df4 33ff 0facd11c c1e604 0bf9 c1ea1c } // n = 7, score = 300 // 8bf1 | mov esi, ecx // 115df4 | adc dword ptr [ebp - 0xc], ebx // 33ff | xor edi, edi // 0facd11c | shrd ecx, edx, 0x1c // c1e604 | shl esi, 4 // 0bf9 | or edi, ecx // c1ea1c | shr edx, 0x1c $sequence_5 = { 014de0 8b4d90 8bf1 13d3 c1e60d 8955dc 33db } // n = 7, score = 300 // 014de0 | add dword ptr [ebp - 0x20], ecx // 8b4d90 | mov ecx, dword ptr [ebp - 0x70] // 8bf1 | mov esi, ecx // 13d3 | adc edx, ebx // c1e60d | shl esi, 0xd // 8955dc | mov dword ptr [ebp - 0x24], edx // 33db | xor ebx, ebx $sequence_6 = { 897dfc 8bbd34ffffff 8bf7 8bcf c1e618 0facd108 } // n = 6, score = 300 // 897dfc | mov dword ptr [ebp - 4], edi // 8bbd34ffffff | mov edi, dword ptr [ebp - 0xcc] // 8bf7 | mov esi, edi // 8bcf | mov ecx, edi // c1e618 | shl esi, 0x18 // 0facd108 | shrd ecx, edx, 8 $sequence_7 = { 0bda c1e117 0bf1 8b55d4 8b4dcc 8bf9 0facd112 } // n = 7, score = 300 // 0bda | or ebx, edx // c1e117 | shl ecx, 0x17 // 0bf1 | or esi, ecx // 8b55d4 | mov edx, dword ptr [ebp - 0x2c] // 8b4dcc | mov ecx, dword ptr [ebp - 0x34] // 8bf9 | mov edi, ecx // 0facd112 | shrd ecx, edx, 0x12 $sequence_8 = { c1e117 0bda 8b55b8 0bf1 8b4db4 } // n = 5, score = 300 // c1e117 | shl ecx, 0x17 // 0bda | or ebx, edx // 8b55b8 | mov edx, dword ptr [ebp - 0x48] // 0bf1 | or esi, ecx // 8b4db4 | mov ecx, dword ptr [ebp - 0x4c] $sequence_9 = { 8b45f4 03ce 13c2 03cb 894de8 8b4d0c 13c7 } // n = 7, score = 300 // 8b45f4 | mov eax, dword ptr [ebp - 0xc] // 03ce | add ecx, esi // 13c2 | adc eax, edx // 03cb | add ecx, ebx // 894de8 | mov dword ptr [ebp - 0x18], ecx // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] // 13c7 | adc eax, edi condition: 7 of them and filesize < 147456 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY