SYMBOLCOMMON_NAMEaka. SYNONYMS
win.rc2fm (Back to overview)

RC2FM


A family identified by ESET Research in the InvisiMole campaign.

References
2020-06-08ESET ResearchZuzana Hromcová, Anton Cherepanov
@techreport{hromcov:20200608:invisimole:70a4dc1, author = {Zuzana Hromcová and Anton Cherepanov}, title = {{InvisiMole: The Hidden Part of the Story - Unearthing InvisiMole's Espionage Toolset and Strategic Cooperations}}, date = {2020-06-08}, institution = {ESET Research}, url = {https://www.welivesecurity.com/wp-content/uploads/2020/06/ESET_InvisiMole.pdf}, language = {English}, urldate = {2020-06-29} } InvisiMole: The Hidden Part of the Story - Unearthing InvisiMole's Espionage Toolset and Strategic Cooperations
InvisiMole RC2FM
Yara Rules
[TLP:WHITE] win_rc2fm_auto (20220411 | Detects win.rc2fm.)
rule win_rc2fm_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-04-08"
        version = "1"
        description = "Detects win.rc2fm."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rc2fm"
        malpedia_rule_date = "20220405"
        malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a"
        malpedia_version = "20220411"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0f8c9afcffff 833d????????02 0f8482000000 488d8c24a0000000 ff15???????? }
            // n = 5, score = 100
            //   0f8c9afcffff         | mov                 esi, dword ptr [esp + 0x34]
            //   833d????????02       |                     
            //   0f8482000000         | xor                 ebx, ebx
            //   488d8c24a0000000     | mov                 ecx, dword ptr [esp + 0x30]
            //   ff15????????         |                     

        $sequence_1 = { 448bc8 b903000100 e8???????? 4c8d9c24e0000000 0fb6c3 498b5b10 498b6b18 }
            // n = 7, score = 100
            //   448bc8               | mov                 byte ptr [ecx - 1], al
            //   b903000100           | dec                 eax
            //   e8????????           |                     
            //   4c8d9c24e0000000     | dec                 ebx
            //   0fb6c3               | dec                 eax
            //   498b5b10             | lea                 edx, dword ptr [eax + 7]
            //   498b6b18             | inc                 ecx

        $sequence_2 = { 4c8d35d5430000 0f1f440000 448b839c000000 4181f802010000 7729 488bcb e8???????? }
            // n = 7, score = 100
            //   4c8d35d5430000       | mov                 eax, esi
            //   0f1f440000           | mov                 esi, eax
            //   448b839c000000       | test                eax, eax
            //   4181f802010000       | jne                 0x868
            //   7729                 | dec                 esp
            //   488bcb               | mov                 eax, edi
            //   e8????????           |                     

        $sequence_3 = { 0fb64364 884102 0fb64365 884103 0fb64308 8bca 4903c8 }
            // n = 7, score = 100
            //   0fb64364             | dec                 eax
            //   884102               | mov                 ecx, dword ptr [ebx + ecx + 0x10]
            //   0fb64365             | dec                 eax
            //   884103               | add                 ebx, 0x18
            //   0fb64308             | dec                 eax
            //   8bca                 | cmp                 ebx, 0x30
            //   4903c8               | jl                  0x13c8

        $sequence_4 = { 4533c0 498bd2 488bc8 32db 498bfe 4489b424a0000000 ff15???????? }
            // n = 7, score = 100
            //   4533c0               | inc                 ebp
            //   498bd2               | xor                 eax, eax
            //   488bc8               | xor                 edx, edx
            //   32db                 | dec                 eax
            //   498bfe               | lea                 ecx, dword ptr [esp + 0xd8]
            //   4489b424a0000000     | dec                 eax
            //   ff15????????         |                     

        $sequence_5 = { e8???????? 48895c2458 48895c2450 48895c2448 48895c2440 895c2438 895c2430 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   48895c2458           | cmp                 edx, ecx
            //   48895c2450           | jne                 0xfe5
            //   48895c2448           | dec                 ecx
            //   48895c2440           | add                 ecx, 0x102
            //   895c2438             | movzx               ecx, byte ptr [eax + 1]
            //   895c2430             | jne                 0x1006

        $sequence_6 = { ba64000000 ff15???????? 85c0 744c 3d02010000 743a 83f8ff }
            // n = 7, score = 100
            //   ba64000000           | dec                 eax
            //   ff15????????         |                     
            //   85c0                 | mov                 ecx, ebx
            //   744c                 | je                  0x206
            //   3d02010000           | dec                 eax
            //   743a                 | cmp                 dword ptr [ebx + 0x28], -1
            //   83f8ff               | jne                 0xf7

        $sequence_7 = { 4585c0 7417 488b5c2448 4533c9 488bce 488bd3 e8???????? }
            // n = 7, score = 100
            //   4585c0               | inc                 eax
            //   7417                 | mov                 ch, 2
            //   488b5c2448           | dec                 eax
            //   4533c9               | inc                 eax
            //   488bce               | mov                 byte ptr [eax - 1], cl
            //   488bd3               | dec                 eax
            //   e8????????           |                     

        $sequence_8 = { 49035500 448bd0 4503d2 458bca 4585d2 7424 488bca }
            // n = 7, score = 100
            //   49035500             | js                  0xa98
            //   448bd0               | inc                 esp
            //   4503d2               | mov                 eax, dword ptr [esp + 0xa8]
            //   458bca               | inc                 ebp
            //   4585d2               | test                eax, eax
            //   7424                 | je                  0xa42
            //   488bca               | dec                 eax

        $sequence_9 = { 412a8a14170000 6641d3e9 41838214170000f3 6645898a10170000 eb16 8d4103 6641d3e1 }
            // n = 7, score = 100
            //   412a8a14170000       | dec                 esp
            //   6641d3e9             | mov                 edi, eax
            //   41838214170000f3     | dec                 eax
            //   6645898a10170000     | test                eax, eax
            //   eb16                 | je                  0x1ce4
            //   8d4103               | dec                 eax
            //   6641d3e1             | mov                 ecx, eax

    condition:
        7 of them and filesize < 410624
}
Download all Yara Rules