SYMBOLCOMMON_NAMEaka. SYNONYMS
win.saigon (Back to overview)

SaiGon


FireEye reports SaiGon as a variant of ISFB v3 (versions documented are tagged 3.50.132) that is more a generic backdoor than being focused on enabling banking fraud.

References
2020-08-28CheckpointCheck Point Research
@online{research:20200828:gozi:944c005, author = {Check Point Research}, title = {{Gozi: The Malware with a Thousand Faces}}, date = {2020-08-28}, organization = {Checkpoint}, url = {https://research.checkpoint.com/2020/gozi-the-malware-with-a-thousand-faces/}, language = {English}, urldate = {2020-09-01} } Gozi: The Malware with a Thousand Faces
DreamBot ISFB LOLSnif SaiGon
2020-01-09FireEyeSandor Nemes, Zander Work
@online{nemes:20200109:saigon:d0a0c27, author = {Sandor Nemes and Zander Work}, title = {{SAIGON, the Mysterious Ursnif Fork}}, date = {2020-01-09}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html}, language = {English}, urldate = {2020-01-13} } SAIGON, the Mysterious Ursnif Fork
SaiGon
Yara Rules
[TLP:WHITE] win_saigon_auto (20201014 | autogenerated rule brought to you by yara-signator)
rule win_saigon_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-10-14"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.5.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.saigon"
        malpedia_rule_date = "20201014"
        malpedia_hash = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
        malpedia_version = "20201014"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 488b4c2478 488bd7 488b01 ff90b8000000 }
            // n = 4, score = 200
            //   488b4c2478           | test                esi, esi
            //   488bd7               | mov                 dword ptr [esp + 0xb0], edx
            //   488b01               | je                  0x6b3
            //   ff90b8000000         | dec                 esp

        $sequence_1 = { 448d4b01 89442428 4533c0 488bd5 48897c2420 ff15???????? }
            // n = 6, score = 200
            //   448d4b01             | dec                 esp
            //   89442428             | mov                 eax, ebx
            //   4533c0               | xor                 edx, edx
            //   488bd5               | dec                 eax
            //   48897c2420           | lea                 ecx, [esp + 0xc0]
            //   ff15????????         |                     

        $sequence_2 = { 458bcd ba05000000 ff15???????? 3bc3 }
            // n = 4, score = 200
            //   458bcd               | inc                 ecx
            //   ba05000000           | mov                 edx, ebp
            //   ff15????????         |                     
            //   3bc3                 | xor                 ecx, ecx

        $sequence_3 = { 4889742428 4889742420 e8???????? 488b0d???????? 4c8bc5 33d2 8bd8 }
            // n = 7, score = 200
            //   4889742428           | dec                 eax
            //   4889742420           | lea                 edx, [esp + 0x58]
            //   e8????????           |                     
            //   488b0d????????       |                     
            //   4c8bc5               | mov                 word ptr [edi + ecx*2], 0x5c
            //   33d2                 | test                eax, eax
            //   8bd8                 | je                  0x44d

        $sequence_4 = { 33d2 488bcf e8???????? 83c9ff 413bc4 0f44d9 }
            // n = 6, score = 200
            //   33d2                 | lea                 edx, [esp + 0x98]
            //   488bcf               | dec                 eax
            //   e8????????           |                     
            //   83c9ff               | mov                 eax, dword ptr [ecx]
            //   413bc4               | test                ebx, ebx
            //   0f44d9               | js                  0x1a35

        $sequence_5 = { 443bd8 885c2440 410f42c3 c744243801000000 488bcf }
            // n = 5, score = 200
            //   443bd8               | mov                 eax, ebx
            //   885c2440             | dec                 esp
            //   410f42c3             | lea                 ebx, [esp + 0x130]
            //   c744243801000000     | mov                 eax, ebx
            //   488bcf               | dec                 ecx

        $sequence_6 = { 0f8497010000 488bcf ff15???????? 488b0d???????? 33d2 448d444024 }
            // n = 6, score = 200
            //   0f8497010000         | ja                  0x16a
            //   488bcf               | mov                 edx, ebx
            //   ff15????????         |                     
            //   488b0d????????       |                     
            //   33d2                 | mov                 dword ptr [esp + 0x40], ebx
            //   448d444024           | jmp                 0x171

        $sequence_7 = { 4889442460 488d442450 4889442448 488d842480000000 4533c9 4889442440 }
            // n = 6, score = 200
            //   4889442460           | je                  0x39
            //   488d442450           | dec                 eax
            //   4889442448           | mov                 ecx, esi
            //   488d842480000000     | mov                 ebp, eax
            //   4533c9               | movzx               ebx, word ptr [esp + 0x20]
            //   4889442440           | je                  0x45

        $sequence_8 = { 488d842480000000 4533c9 4889442440 488364243800 488364243000 4533c0 }
            // n = 6, score = 200
            //   488d842480000000     | dec                 eax
            //   4533c9               | lea                 ecx, [esp + 0x660]
            //   4889442440           | inc                 esp
            //   488364243800         | mov                 ecx, ebx
            //   488364243000         | inc                 esp
            //   4533c0               | mov                 ecx, ebx

        $sequence_9 = { 8b442440 48897d00 8906 eb17 }
            // n = 4, score = 200
            //   8b442440             | lea                 edx, [esp + 0x30]
            //   48897d00             | dec                 eax
            //   8906                 | lea                 ecx, [esp + 0x30]
            //   eb17                 | inc                 esp

    condition:
        7 of them and filesize < 147456
}
Download all Yara Rules