There is no description at this point.
rule win_remy_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.remy." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.remy" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 0f82bc010000 8b5544 52 e8???????? 83c404 e9???????? 8b4d08 } // n = 7, score = 200 // 0f82bc010000 | jb 0x1c2 // 8b5544 | mov edx, dword ptr [ebp + 0x44] // 52 | push edx // e8???????? | // 83c404 | add esp, 4 // e9???????? | // 8b4d08 | mov ecx, dword ptr [ebp + 8] $sequence_1 = { 6a10 6a02 897df8 ff15???????? 8945f4 85c0 0f85b0000000 } // n = 7, score = 200 // 6a10 | push 0x10 // 6a02 | push 2 // 897df8 | mov dword ptr [ebp - 8], edi // ff15???????? | // 8945f4 | mov dword ptr [ebp - 0xc], eax // 85c0 | test eax, eax // 0f85b0000000 | jne 0xb6 $sequence_2 = { ff15???????? 6a04 8d8c24e4000000 51 56 6a06 57 } // n = 7, score = 200 // ff15???????? | // 6a04 | push 4 // 8d8c24e4000000 | lea ecx, [esp + 0xe4] // 51 | push ecx // 56 | push esi // 6a06 | push 6 // 57 | push edi $sequence_3 = { a1???????? 33c5 50 8d45f4 64a300000000 8d45e0 50 } // n = 7, score = 200 // a1???????? | // 33c5 | xor eax, ebp // 50 | push eax // 8d45f4 | lea eax, [ebp - 0xc] // 64a300000000 | mov dword ptr fs:[0], eax // 8d45e0 | lea eax, [ebp - 0x20] // 50 | push eax $sequence_4 = { 50 e8???????? 83c404 885dfc be0f000000 885d0c 895d1c } // n = 7, score = 200 // 50 | push eax // e8???????? | // 83c404 | add esp, 4 // 885dfc | mov byte ptr [ebp - 4], bl // be0f000000 | mov esi, 0xf // 885d0c | mov byte ptr [ebp + 0xc], bl // 895d1c | mov dword ptr [ebp + 0x1c], ebx $sequence_5 = { 8930 897e04 897e08 897e0c 897e10 89bb8c000000 89bb90000000 } // n = 7, score = 200 // 8930 | mov dword ptr [eax], esi // 897e04 | mov dword ptr [esi + 4], edi // 897e08 | mov dword ptr [esi + 8], edi // 897e0c | mov dword ptr [esi + 0xc], edi // 897e10 | mov dword ptr [esi + 0x10], edi // 89bb8c000000 | mov dword ptr [ebx + 0x8c], edi // 89bb90000000 | mov dword ptr [ebx + 0x90], edi $sequence_6 = { 85ff 0f8487fdffff 2b14b568f84200 8b88bc160000 be10000000 2bf7 3bce } // n = 7, score = 200 // 85ff | test edi, edi // 0f8487fdffff | je 0xfffffd8d // 2b14b568f84200 | sub edx, dword ptr [esi*4 + 0x42f868] // 8b88bc160000 | mov ecx, dword ptr [eax + 0x16bc] // be10000000 | mov esi, 0x10 // 2bf7 | sub esi, edi // 3bce | cmp ecx, esi $sequence_7 = { 50 6805100000 68ffff0000 51 c745e420bf0200 ff15???????? 837d0800 } // n = 7, score = 200 // 50 | push eax // 6805100000 | push 0x1005 // 68ffff0000 | push 0xffff // 51 | push ecx // c745e420bf0200 | mov dword ptr [ebp - 0x1c], 0x2bf20 // ff15???????? | // 837d0800 | cmp dword ptr [ebp + 8], 0 $sequence_8 = { 895d38 885d28 397d58 0f82e5000000 8b4544 } // n = 5, score = 200 // 895d38 | mov dword ptr [ebp + 0x38], ebx // 885d28 | mov byte ptr [ebp + 0x28], bl // 397d58 | cmp dword ptr [ebp + 0x58], edi // 0f82e5000000 | jb 0xeb // 8b4544 | mov eax, dword ptr [ebp + 0x44] $sequence_9 = { c7459c493e472b c745a03e4a4e3e 66c745a44c4d c645a600 c745d030424721 c745d44d4d492b c745d83e3a3d1d } // n = 7, score = 200 // c7459c493e472b | mov dword ptr [ebp - 0x64], 0x2b473e49 // c745a03e4a4e3e | mov dword ptr [ebp - 0x60], 0x3e4e4a3e // 66c745a44c4d | mov word ptr [ebp - 0x5c], 0x4d4c // c645a600 | mov byte ptr [ebp - 0x5a], 0 // c745d030424721 | mov dword ptr [ebp - 0x30], 0x21474230 // c745d44d4d492b | mov dword ptr [ebp - 0x2c], 0x2b494d4d // c745d83e3a3d1d | mov dword ptr [ebp - 0x28], 0x1d3d3a3e condition: 7 of them and filesize < 507904 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY