A family identified by ESET Research in the InvisiMole campaign.
rule win_rc2fm_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.rc2fm." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rc2fm" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 0f85c8000000 488b4330 48396810 0f84b3000000 0fb74018 448b5328 } // n = 6, score = 100 // 0f85c8000000 | dec ecx // 488b4330 | dec edi // 48396810 | jne 0xec8 // 0f84b3000000 | inc ebp // 0fb74018 | test ah, ah // 448b5328 | dec ecx $sequence_1 = { b900000000 85c0 0f48c1 488b8c2488000000 8901 4883c448 415d } // n = 7, score = 100 // b900000000 | dec esp // 85c0 | mov edi, dword ptr [esp + 0x100] // 0f48c1 | jmp 0x1ec1 // 488b8c2488000000 | mov edx, 0xb0002 // 8901 | jmp 0x1eae // 4883c448 | dec esp // 415d | mov edi, dword ptr [esp + 0x110] $sequence_2 = { c1c80b 0fb6c9 4883c206 03c1 49ffc9 7580 3dc6adb1fd } // n = 7, score = 100 // c1c80b | je 0x139 // 0fb6c9 | dec esp // 4883c206 | mov eax, dword ptr [edi] // 03c1 | add esi, eax // 49ffc9 | lea eax, [esi + 1] // 7580 | dec esp // 3dc6adb1fd | arpl ax, ax $sequence_3 = { e8???????? 488b0d???????? e8???????? 48c705????????00000000 eb12 448bc0 ba01000000 } // n = 7, score = 100 // e8???????? | // 488b0d???????? | // e8???????? | // 48c705????????00000000 | // eb12 | mov edx, esp // 448bc0 | dec eax // ba01000000 | mov dword ptr [ebp + 0x100], 2 $sequence_4 = { 415d 5d c3 b002 ebe7 b001 } // n = 6, score = 100 // 415d | mov esi, ecx // 5d | push edi // c3 | dec eax // b002 | sub esp, 0x20 // ebe7 | mov eax, dword ptr [ecx + 0x18] // b001 | dec eax $sequence_5 = { 83f810 7707 bb10000000 eb0f bb18000000 83f818 7605 } // n = 7, score = 100 // 83f810 | mov dword ptr [ebp - 0x28], 0x78007a // 7707 | mov dword ptr [ebp - 0x24], 0x760063 // bb10000000 | mov dword ptr [ebp - 0x20], 0x6e0062 // eb0f | mov dword ptr [ebp - 0x1c], 0x31006d // bb18000000 | mov dword ptr [ebp - 0x2d], 0x10000 // 83f818 | mov dword ptr [ebp - 0x28], 0 // 7605 | dec eax $sequence_6 = { 0fb74302 4883c302 6685c0 75ed e9???????? 498bd5 b912040000 } // n = 7, score = 100 // 0fb74302 | jmp 0x11bc // 4883c302 | mov edx, 0x60002 // 6685c0 | dec esp // 75ed | mov eax, edi // e9???????? | // 498bd5 | dec eax // b912040000 | mov edi, dword ptr [edi + 0x10] $sequence_7 = { 4c8b05???????? 4d85c0 7420 488b0d???????? 33d2 ff15???????? eb0f } // n = 7, score = 100 // 4c8b05???????? | // 4d85c0 | jmp 0x5e // 7420 | test eax, eax // 488b0d???????? | // 33d2 | jne 0x4f // ff15???????? | // eb0f | dec ecx $sequence_8 = { ff15???????? eb18 ff15???????? ba02000400 b914000100 448bc0 e8???????? } // n = 7, score = 100 // ff15???????? | // eb18 | je 0x189c // ff15???????? | // ba02000400 | cmp eax, ebx // b914000100 | inc eax // 448bc0 | xor bh, bh // e8???????? | $sequence_9 = { 4032f6 488d55f7 b903000000 ff15???????? 488b4d8f 488b01 ff5010 } // n = 7, score = 100 // 4032f6 | mov esi, dword ptr [esp + 0x40] // 488d55f7 | dec eax // b903000000 | add esp, 0x20 // ff15???????? | // 488b4d8f | inc ecx // 488b01 | pop esi // ff5010 | ret condition: 7 of them and filesize < 410624 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY