Actor(s): DragonOK
There is no description at this point.
rule win_rambo_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-05-16" version = "1" description = "Detects win.rambo." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rambo" malpedia_rule_date = "20220513" malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26" malpedia_version = "20220516" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { ff15???????? 56 ff15???????? 8d85ecfdffff 50 8d85f0feffff 50 } // n = 7, score = 200 // ff15???????? | // 56 | push esi // ff15???????? | // 8d85ecfdffff | lea eax, [ebp - 0x214] // 50 | push eax // 8d85f0feffff | lea eax, [ebp - 0x110] // 50 | push eax $sequence_1 = { 56 6a01 ff7508 e8???????? 59 50 ff7508 } // n = 7, score = 200 // 56 | push esi // 6a01 | push 1 // ff7508 | push dword ptr [ebp + 8] // e8???????? | // 59 | pop ecx // 50 | push eax // ff7508 | push dword ptr [ebp + 8] $sequence_2 = { 8d85fcfeffff 59 50 ff15???????? 33c0 c9 c3 } // n = 7, score = 200 // 8d85fcfeffff | lea eax, [ebp - 0x104] // 59 | pop ecx // 50 | push eax // ff15???????? | // 33c0 | xor eax, eax // c9 | leave // c3 | ret $sequence_3 = { e8???????? ff750c 8d85ecfdffff 50 e8???????? } // n = 5, score = 200 // e8???????? | // // 8d85ecfdffff | lea eax, [ebp - 0x214] // 50 | push eax // e8???????? | $sequence_4 = { 745e 57 6a02 6a00 56 } // n = 5, score = 200 // 745e | je 0x60 // 57 | push edi // 6a02 | push 2 // 6a00 | push 0 // 56 | push esi $sequence_5 = { ff15???????? ff7508 8d85f8feffff 50 e8???????? 8065fe00 } // n = 6, score = 200 // ff15???????? | // ff7508 | push dword ptr [ebp + 8] // 8d85f8feffff | lea eax, [ebp - 0x108] // 50 | push eax // e8???????? | // 8065fe00 | and byte ptr [ebp - 2], 0 $sequence_6 = { 50 ff15???????? 83c41c 6a01 58 } // n = 5, score = 200 // 50 | push eax // ff15???????? | // 83c41c | add esp, 0x1c // 6a01 | push 1 // 58 | pop eax $sequence_7 = { ff15???????? 56 ff15???????? 56 8bf8 ff15???????? 56 } // n = 7, score = 200 // ff15???????? | // 56 | push esi // ff15???????? | // 56 | push esi // 8bf8 | mov edi, eax // ff15???????? | // 56 | push esi $sequence_8 = { 8bca 8d542474 83e103 f3aa 8bcb 8d7c2474 8bc1 } // n = 7, score = 100 // 8bca | mov ecx, edx // 8d542474 | lea edx, [esp + 0x74] // 83e103 | and ecx, 3 // f3aa | rep stosb byte ptr es:[edi], al // 8bcb | mov ecx, ebx // 8d7c2474 | lea edi, [esp + 0x74] // 8bc1 | mov eax, ecx $sequence_9 = { 6a00 50 8d4c2424 c684240c04000007 } // n = 4, score = 100 // 6a00 | push 0 // 50 | push eax // 8d4c2424 | lea ecx, [esp + 0x24] // c684240c04000007 | mov byte ptr [esp + 0x40c], 7 $sequence_10 = { e8???????? 8d4c2428 c684240004000005 e8???????? 8d4c2424 c684240004000006 } // n = 6, score = 100 // e8???????? | // 8d4c2428 | lea ecx, [esp + 0x28] // c684240004000005 | mov byte ptr [esp + 0x400], 5 // e8???????? | // 8d4c2424 | lea ecx, [esp + 0x24] // c684240004000006 | mov byte ptr [esp + 0x400], 6 $sequence_11 = { c644245637 885c2457 884c2459 c644245a47 } // n = 4, score = 100 // c644245637 | mov byte ptr [esp + 0x56], 0x37 // 885c2457 | mov byte ptr [esp + 0x57], bl // 884c2459 | mov byte ptr [esp + 0x59], cl // c644245a47 | mov byte ptr [esp + 0x5a], 0x47 $sequence_12 = { ffd5 8bf8 8a4304 8b7604 84c0 } // n = 5, score = 100 // ffd5 | call ebp // 8bf8 | mov edi, eax // 8a4304 | mov al, byte ptr [ebx + 4] // 8b7604 | mov esi, dword ptr [esi + 4] // 84c0 | test al, al $sequence_13 = { e8???????? 8d8c249c000000 c68424000400000b e8???????? 8d4c2420 } // n = 5, score = 100 // e8???????? | // 8d8c249c000000 | lea ecx, [esp + 0x9c] // c68424000400000b | mov byte ptr [esp + 0x400], 0xb // e8???????? | // 8d4c2420 | lea ecx, [esp + 0x20] $sequence_14 = { c1e805 03c3 8bdf c1e304 03dd 8b6c2418 } // n = 6, score = 100 // c1e805 | shr eax, 5 // 03c3 | add eax, ebx // 8bdf | mov ebx, edi // c1e304 | shl ebx, 4 // 03dd | add ebx, ebp // 8b6c2418 | mov ebp, dword ptr [esp + 0x18] $sequence_15 = { e8???????? 8d4c2430 c684240004000001 e8???????? c684240004000000 8d4c2464 } // n = 6, score = 100 // e8???????? | // 8d4c2430 | lea ecx, [esp + 0x30] // c684240004000001 | mov byte ptr [esp + 0x400], 1 // e8???????? | // c684240004000000 | mov byte ptr [esp + 0x400], 0 // 8d4c2464 | lea ecx, [esp + 0x64] condition: 7 of them and filesize < 57344 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY