There is no description at this point.
rule win_ransoc_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.ransoc." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ransoc" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8d5e34 85c9 7531 8b4638 8b4e3c 85d2 7403 } // n = 7, score = 300 // 8d5e34 | lea ebx, [esi + 0x34] // 85c9 | test ecx, ecx // 7531 | jne 0x33 // 8b4638 | mov eax, dword ptr [esi + 0x38] // 8b4e3c | mov ecx, dword ptr [esi + 0x3c] // 85d2 | test edx, edx // 7403 | je 5 $sequence_1 = { 894a30 894130 e9???????? 894a34 894130 e9???????? 890b } // n = 7, score = 300 // 894a30 | mov dword ptr [edx + 0x30], ecx // 894130 | mov dword ptr [ecx + 0x30], eax // e9???????? | // 894a34 | mov dword ptr [edx + 0x34], ecx // 894130 | mov dword ptr [ecx + 0x30], eax // e9???????? | // 890b | mov dword ptr [ebx], ecx $sequence_2 = { 8932 e8???????? 83c404 33c0 } // n = 4, score = 300 // 8932 | mov dword ptr [edx], esi // e8???????? | // 83c404 | add esp, 4 // 33c0 | xor eax, eax $sequence_3 = { 56 b101 8d7770 8a06 8ad0 } // n = 5, score = 300 // 56 | push esi // b101 | mov cl, 1 // 8d7770 | lea esi, [edi + 0x70] // 8a06 | mov al, byte ptr [esi] // 8ad0 | mov dl, al $sequence_4 = { ffd1 85c0 7551 8b462c a900000400 0f84ab000000 8b54240c } // n = 7, score = 300 // ffd1 | call ecx // 85c0 | test eax, eax // 7551 | jne 0x53 // 8b462c | mov eax, dword ptr [esi + 0x2c] // a900000400 | test eax, 0x40000 // 0f84ab000000 | je 0xb1 // 8b54240c | mov edx, dword ptr [esp + 0xc] $sequence_5 = { ff15???????? f7472c00001000 0f8480000000 8b4e30 51 ff15???????? 5d } // n = 7, score = 300 // ff15???????? | // f7472c00001000 | test dword ptr [edi + 0x2c], 0x100000 // 0f8480000000 | je 0x86 // 8b4e30 | mov ecx, dword ptr [esi + 0x30] // 51 | push ecx // ff15???????? | // 5d | pop ebp $sequence_6 = { 8b4e2c 751b f6c101 7516 } // n = 4, score = 300 // 8b4e2c | mov ecx, dword ptr [esi + 0x2c] // 751b | jne 0x1d // f6c101 | test cl, 1 // 7516 | jne 0x18 $sequence_7 = { a1???????? 83f801 7f0d 6a00 68???????? } // n = 5, score = 300 // a1???????? | // 83f801 | cmp eax, 1 // 7f0d | jg 0xf // 6a00 | push 0 // 68???????? | $sequence_8 = { b843270000 c3 b851270000 c3 b814270000 c3 b846270000 } // n = 7, score = 300 // b843270000 | mov eax, 0x2743 // c3 | ret // b851270000 | mov eax, 0x2751 // c3 | ret // b814270000 | mov eax, 0x2714 // c3 | ret // b846270000 | mov eax, 0x2746 $sequence_9 = { 89462c a820 7406 8b7604 ff4e04 } // n = 5, score = 300 // 89462c | mov dword ptr [esi + 0x2c], eax // a820 | test al, 0x20 // 7406 | je 8 // 8b7604 | mov esi, dword ptr [esi + 4] // ff4e04 | dec dword ptr [esi + 4] condition: 7 of them and filesize < 958464 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY