SYMBOLCOMMON_NAMEaka. SYNONYMS
win.sappycache (Back to overview)

SappyCache


There is no description at this point.

References
2019-08-05Reversing LabsTomislav Pericin
@online{pericin:20190805:catching:4aeb984, author = {Tomislav Pericin}, title = {{Catching lateral movement in internal emails}}, date = {2019-08-05}, organization = {Reversing Labs}, url = {https://blog.reversinglabs.com/blog/catching-lateral-movement-in-internal-emails}, language = {English}, urldate = {2020-07-15} } Catching lateral movement in internal emails
SappyCache
2019-08ClearSkyClearSky Cyber Security
@techreport{security:201908:2019:716d69e, author = {ClearSky Cyber Security}, title = {{2019 H1 Cyber Events Summary Report}}, date = {2019-08}, institution = {ClearSky}, url = {https://www.clearskysec.com/wp-content/uploads/2019/08/ClearSky-2019-H1-Cyber-Events-Summary-Report.pdf}, language = {English}, urldate = {2020-06-29} } 2019 H1 Cyber Events Summary Report
EVILNUM Cardinal RAT SappyCache
2019-03-27ESTsecurityAlyac
@online{alyac:20190327:lazarus:df092d7, author = {Alyac}, title = {{Lazarus Group APT Counterattack Against Israeli Military}}, date = {2019-03-27}, organization = {ESTsecurity}, url = {https://blog.alyac.co.kr/2219}, language = {Korean}, urldate = {2020-06-29} } Lazarus Group APT Counterattack Against Israeli Military
SappyCache
2019-03-27Alyac
@online{alyac:20190327:lazarus:2172304, author = {Alyac}, title = {{라자루스(Lazarus) 그룹, 이스라엘 군수업체 대상 APT 역습}}, date = {2019-03-27}, url = {https://blog.alyac.co.kr/m/2219}, language = {Korean}, urldate = {2020-07-15} } 라자루스(Lazarus) 그룹, 이스라엘 군수업체 대상 APT 역습
SappyCache
2019-03-26FireEyeDileep Kumar Jallepalli
@online{jallepalli:20190326:winrar:dff4878, author = {Dileep Kumar Jallepalli}, title = {{WinRAR Zero-day Abused in Multiple Campaigns}}, date = {2019-03-26}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2019/03/winrar-zero-day-abused-in-multiple-campaigns.html}, language = {English}, urldate = {2019-12-20} } WinRAR Zero-day Abused in Multiple Campaigns
SappyCache
Yara Rules
[TLP:WHITE] win_sappycache_auto (20211008 | Detects win.sappycache.)
rule win_sappycache_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.sappycache."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sappycache"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 488bd8 4c896c2440 ff15???????? 488d4540 498bd7 48ffc2 44382c10 }
            // n = 7, score = 200
            //   488bd8               | lea                 edx, dword ptr [0x9041]
            //   4c896c2440           | dec                 eax
            //   ff15????????         |                     
            //   488d4540             | sub                 esp, 0x20
            //   498bd7               | dec                 eax
            //   48ffc2               | lea                 eax, dword ptr [0x9a13]
            //   44382c10             | dec                 eax

        $sequence_1 = { 488d1553db0000 483950f0 740b 488b10 4885d2 }
            // n = 5, score = 200
            //   488d1553db0000       | dec                 eax
            //   483950f0             | test                eax, eax
            //   740b                 | jne                 0x99f
            //   488b10               | dec                 eax
            //   4885d2               | mov                 ecx, ebx

        $sequence_2 = { 4863c9 488d1556fa0000 488bc1 83e13f 48c1f806 }
            // n = 5, score = 200
            //   4863c9               | dec                 eax
            //   488d1556fa0000       | mov                 dword ptr [esp + 0xa0], esi
            //   488bc1               | dec                 eax
            //   83e13f               | mov                 edx, ebp
            //   48c1f806             | inc                 ecx

        $sequence_3 = { b9c1000000 ff15???????? 33c0 e9???????? 410fb74614 498d5624 }
            // n = 6, score = 200
            //   b9c1000000           | mov                 word ptr [esp + 0x59], 0
            //   ff15????????         |                     
            //   33c0                 | mov                 byte ptr [esp + 0x58], 0
            //   e9????????           |                     
            //   410fb74614           | inc                 ecx
            //   498d5624             | inc                 edx

        $sequence_4 = { 498bdd 0f1f440000 33d2 488d8d20420000 41b800200000 e8???????? 4c8d4d80 }
            // n = 7, score = 200
            //   498bdd               | xor                 edx, edx
            //   0f1f440000           | mov                 eax, 1
            //   33d2                 | dec                 eax
            //   488d8d20420000       | mov                 ecx, dword ptr [esp + 0x48]
            //   41b800200000         | dec                 eax
            //   e8????????           |                     
            //   4c8d4d80             | mov                 ecx, dword ptr [esp + 0x40]

        $sequence_5 = { 418bc0 83e03f 2bc8 48d3cf 488d0d5abaffff 4933f8 4a87bcf150800100 }
            // n = 7, score = 200
            //   418bc0               | xor                 edx, edx
            //   83e03f               | inc                 edx
            //   2bc8                 | lea                 eax, dword ptr [edi + esi]
            //   48d3cf               | div                 ebp
            //   488d0d5abaffff       | dec                 esp
            //   4933f8               | lea                 eax, dword ptr [esp + 0x40]
            //   4a87bcf150800100     | je                  0x26f

        $sequence_6 = { e8???????? 83fb48 0f82dc000000 8b5740 8b4f44 89542420 }
            // n = 6, score = 200
            //   e8????????           |                     
            //   83fb48               | lea                 edx, dword ptr [0x11ec6]
            //   0f82dc000000         | dec                 esp
            //   8b5740               | mov                 ecx, dword ptr [esp + 0x40]
            //   8b4f44               | dec                 esp
            //   89542420             | mov                 esp, eax

        $sequence_7 = { 8938 e8???????? 488d1dcb070100 4885c0 7404 488d5820 8bcf }
            // n = 7, score = 200
            //   8938                 | je                  0x2b8
            //   e8????????           |                     
            //   488d1dcb070100       | dec                 eax
            //   4885c0               | mov                 dword ptr [esp + 0x20], 0
            //   7404                 | dec                 eax
            //   488d5820             | mov                 edx, eax
            //   8bcf                 | inc                 esp

        $sequence_8 = { 83fa48 7243 8b4b40 8b4344 894c2450 83c140 }
            // n = 6, score = 200
            //   83fa48               | mov                 ecx, ebx
            //   7243                 | jne                 0xcb
            //   8b4b40               | xor                 eax, eax
            //   8b4344               | dec                 eax
            //   894c2450             | mov                 ecx, dword ptr [esp + 0x50]
            //   83c140               | dec                 eax

        $sequence_9 = { 4883ec20 8bd9 4c8d0d19900000 b905000000 4c8d0505900000 488d1506900000 }
            // n = 6, score = 200
            //   4883ec20             | lea                 edx, dword ptr [ebp - 8]
            //   8bd9                 | dec                 edx
            //   4c8d0d19900000       | mov                 ecx, dword ptr [ecx + esi + 0x28]
            //   b905000000           | inc                 edx
            //   4c8d0505900000       | cmp                 dword ptr [ecx], 0x4550
            //   488d1506900000       | dec                 esp

    condition:
        7 of them and filesize < 262144
}
Download all Yara Rules