SYMBOLCOMMON_NAMEaka. SYNONYMS
win.sappycache (Back to overview)

SappyCache


There is no description at this point.

References
2019-08-05Reversing LabsTomislav Pericin
@online{pericin:20190805:catching:4aeb984, author = {Tomislav Pericin}, title = {{Catching lateral movement in internal emails}}, date = {2019-08-05}, organization = {Reversing Labs}, url = {https://blog.reversinglabs.com/blog/catching-lateral-movement-in-internal-emails}, language = {English}, urldate = {2020-07-15} } Catching lateral movement in internal emails
SappyCache
2019-08ClearSkyClearSky Cyber Security
@techreport{security:201908:2019:716d69e, author = {ClearSky Cyber Security}, title = {{2019 H1 Cyber Events Summary Report}}, date = {2019-08}, institution = {ClearSky}, url = {https://www.clearskysec.com/wp-content/uploads/2019/08/ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf}, language = {English}, urldate = {2020-06-29} } 2019 H1 Cyber Events Summary Report
EVILNUM Cardinal RAT SappyCache
2019-03-27ESTsecurityAlyac
@online{alyac:20190327:lazarus:df092d7, author = {Alyac}, title = {{Lazarus Group APT Counterattack Against Israeli Military}}, date = {2019-03-27}, organization = {ESTsecurity}, url = {https://blog.alyac.co.kr/2219}, language = {Korean}, urldate = {2020-06-29} } Lazarus Group APT Counterattack Against Israeli Military
SappyCache
2019-03-27Alyac
@online{alyac:20190327:lazarus:2172304, author = {Alyac}, title = {{라자루스(Lazarus) 그룹, 이스라엘 군수업체 대상 APT 역습}}, date = {2019-03-27}, url = {https://blog.alyac.co.kr/m/2219}, language = {Korean}, urldate = {2020-07-15} } 라자루스(Lazarus) 그룹, 이스라엘 군수업체 대상 APT 역습
SappyCache
2019-03-26FireEyeDileep Kumar Jallepalli
@online{jallepalli:20190326:winrar:dff4878, author = {Dileep Kumar Jallepalli}, title = {{WinRAR Zero-day Abused in Multiple Campaigns}}, date = {2019-03-26}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2019/03/winrar-zero-day-abused-in-multiple-campaigns.html}, language = {English}, urldate = {2019-12-20} } WinRAR Zero-day Abused in Multiple Campaigns
SappyCache
Yara Rules
[TLP:WHITE] win_sappycache_auto (20230125 | Detects win.sappycache.)
rule win_sappycache_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.sappycache."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 488d8c24c0060000 e8???????? 488d542440 488bcf ff15???????? 85c0 0f852fffffff }
            // n = 7, score = 200
            //   488d8c24c0060000     | mov                 ebx, 0xe3
            //   e8????????           |                     
            //   488d542440           | inc                 ebx
            //   488bcf               | lea                 eax, [ebx + edx]
            //   ff15????????         |                     
            //   85c0                 | inc                 ecx
            //   0f852fffffff         | push                esi

        $sequence_1 = { 488be9 33d2 488d8c24c0060000 41b800000400 }
            // n = 4, score = 200
            //   488be9               | dec                 eax
            //   33d2                 | lea                 edi, [0x1140f]
            //   488d8c24c0060000     | je                  0x4b
            //   41b800000400         | dec                 eax

        $sequence_2 = { 4883ec20 488bf9 4c8d0d086e0000 b903000000 }
            // n = 4, score = 200
            //   4883ec20             | cmp                 edi, edx
            //   488bf9               | jl                  0xfffffefa
            //   4c8d0d086e0000       | dec                 esp
            //   b903000000           | lea                 ecx, [0x130bc]

        $sequence_3 = { ff15???????? 488d15fb1a0100 488d0d24650100 ff15???????? }
            // n = 4, score = 200
            //   ff15????????         |                     
            //   488d15fb1a0100       | jne                 0xffffff37
            //   488d0d24650100       | dec                 eax
            //   ff15????????         |                     

        $sequence_4 = { ff15???????? 49ffc7 47382c3c 75f7 4d8bcc }
            // n = 5, score = 200
            //   ff15????????         |                     
            //   49ffc7               | mov                 ebp, 4
            //   47382c3c             | dec                 esp
            //   75f7                 | lea                 ebx, [eax + eax*2]
            //   4d8bcc               | dec                 ecx

        $sequence_5 = { 4533c9 33d2 41b800800000 e8???????? 488b3b 488bcb e8???????? }
            // n = 7, score = 200
            //   4533c9               | cmp                 esi, eax
            //   33d2                 | jl                  0x8d
            //   41b800800000         | dec                 esp
            //   e8????????           |                     
            //   488b3b               | lea                 edi, [0xfab7]
            //   488bcb               | dec                 ecx
            //   e8????????           |                     

        $sequence_6 = { ff15???????? 33c0 e9???????? 4c89ac24a8000000 488d0c2e 49bd00000000ffffffff }
            // n = 6, score = 200
            //   ff15????????         |                     
            //   33c0                 | inc                 ebp
            //   e9????????           |                     
            //   4c89ac24a8000000     | xor                 ecx, ecx
            //   488d0c2e             | inc                 ebp
            //   49bd00000000ffffffff     | xor    eax, eax

        $sequence_7 = { 89442438 0fb75106 443bfa 0f8cd3feffff 4c8d0dbc300100 4d85d2 746c }
            // n = 7, score = 200
            //   89442438             | dec                 eax
            //   0fb75106             | mov                 dword ptr [edi + 0x30], eax
            //   443bfa               | dec                 eax
            //   0f8cd3feffff         | lea                 eax, [0xfffffca6]
            //   4c8d0dbc300100       | dec                 eax
            //   4d85d2               | mov                 dword ptr [edi + 0x38], eax
            //   746c                 | dec                 eax

        $sequence_8 = { 3b15???????? 7350 488bca 4c8d0595e00000 83e13f 488bc2 }
            // n = 6, score = 200
            //   3b15????????         |                     
            //   7350                 | mov                 edi, dword ptr [esp + 0x6388]
            //   488bca               | ret                 
            //   4c8d0595e00000       | inc                 eax
            //   83e13f               | push                edi
            //   488bc2               | dec                 eax

        $sequence_9 = { 488bd5 ff15???????? 488bf0 4885c0 752d 448d4804 41b800300000 }
            // n = 7, score = 200
            //   488bd5               | inc                 ebp
            //   ff15????????         |                     
            //   488bf0               | xor                 edi, edi
            //   4885c0               | inc                 ecx
            //   752d                 | mov                 ebx, edi
            //   448d4804             | dec                 esp
            //   41b800300000         | lea                 ecx, [0xffffbb0e]

    condition:
        7 of them and filesize < 262144
}
Download all Yara Rules