Actor(s): Operation Sharpshooter
There is no description at this point.
rule win_rising_sun_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-12-22" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.rising_sun" malpedia_rule_date = "20201222" malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130" malpedia_version = "20201023" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 4881ecf0090000 488b05???????? 4833c4 488985e0080000 448bea 488bd9 } // n = 6, score = 100 // 4881ecf0090000 | mov eax, edx // 488b05???????? | // 4833c4 | mov eax, ecx // 488985e0080000 | jmp 0x154a // 448bea | inc ecx // 488bd9 | mov eax, esp $sequence_1 = { 488d152ddb0100 e8???????? 85c0 0f85aa110000 448d4004 488d1515db0100 } // n = 6, score = 100 // 488d152ddb0100 | mov dword ptr [ebx + 0x28], ebp // e8???????? | // 85c0 | dec esp // 0f85aa110000 | mov dword ptr [esi], edi // 448d4004 | cmp edi, 0x13 // 488d1515db0100 | dec eax $sequence_2 = { 66f3a7 75bf 488d4c2430 e8???????? 488d4c2430 ba281c0000 } // n = 6, score = 100 // 66f3a7 | test eax, eax // 75bf | jne 0x2c7 // 488d4c2430 | dec esp // e8???????? | // 488d4c2430 | cmp edi, edi // ba281c0000 | inc ecx $sequence_3 = { 8bc2 48c1e803 488d44d808 410fb70c44 0fb6c2 2407 } // n = 6, score = 100 // 8bc2 | mov dword ptr [eax + edx*8 + 8], eax // 48c1e803 | mov edx, 0xd // 488d44d808 | dec esp // 410fb70c44 | mov dword ptr [esp + 0x20], esi // 0fb6c2 | dec eax // 2407 | add edx, edx $sequence_4 = { 41b800040000 e8???????? 488d8c24200c0000 41b801000000 ba00040000 } // n = 5, score = 100 // 41b800040000 | mov dword ptr [esp + 0x5c], 0x1b091ab6 // e8???????? | // 488d8c24200c0000 | mov dword ptr [esp + 0x60], 0x92241eb7 // 41b801000000 | mov dword ptr [esp + 0x64], 0xc4902d36 // ba00040000 | mov dword ptr [esp + 0x58], 0x67b0abfd $sequence_5 = { 488bd8 e8???????? 488d1532600100 488d8d50020000 ff15???????? 4c8d85e0010000 8d5634 } // n = 7, score = 100 // 488bd8 | mov dword ptr [ebx + 0x20], esp // e8???????? | // 488d1532600100 | test al, al // 488d8d50020000 | jne 0xfba // ff15???????? | // 4c8d85e0010000 | xor eax, eax // 8d5634 | mov edx, edi $sequence_6 = { 8bd6 4a894cf008 488bcb e8???????? 85c0 } // n = 5, score = 100 // 8bd6 | mov edx, dword ptr [edx + eax*8] // 4a894cf008 | dec ecx // 488bcb | cmp ebx, dword ptr [esi + 0x10] // e8???????? | // 85c0 | jae 0x30f $sequence_7 = { 720b b957000780 e8???????? cc 4863c8 488b4308 4803d2 } // n = 7, score = 100 // 720b | mov eax, 0xffffffff // b957000780 | dec eax // e8???????? | // cc | cmova ebx, eax // 4863c8 | nop // 488b4308 | dec eax // 4803d2 | mov edx, eax $sequence_8 = { 4889442420 ff15???????? 488b4c2438 488d542444 4533c9 448bc7 ff15???????? } // n = 7, score = 100 // 4889442420 | lea edx, [0x1e0ac] // ff15???????? | // 488b4c2438 | dec eax // 488d542444 | lea ecx, [0x29595] // 4533c9 | nop // 448bc7 | inc ebp // ff15???????? | $sequence_9 = { 03df 4863cb 42890439 8d4304 488b8d30650000 4833cc } // n = 6, score = 100 // 03df | mov dword ptr [esp + 8], 0xc44754f0 // 4863cb | mov dword ptr [esp + 0xc], 0xa4a33437 // 42890439 | dec esp // 8d4304 | arpl dx, cx // 488b8d30650000 | mov eax, 0x55555556 // 4833cc | dec eax condition: 7 of them and filesize < 409600 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY