Actor(s): TA505
There is no description at this point.
rule win_sdbbot_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.sdbbot." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sdbbot" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 013c31 eb27 6683f801 7511 81e1ff0f0000 8bc7 } // n = 6, score = 800 // 013c31 | add dword ptr [ecx + esi], edi // eb27 | jmp 0x29 // 6683f801 | cmp ax, 1 // 7511 | jne 0x13 // 81e1ff0f0000 | and ecx, 0xfff // 8bc7 | mov eax, edi $sequence_1 = { 8907 83c704 85f6 8d4604 0f44c6 833f00 } // n = 6, score = 800 // 8907 | mov dword ptr [edi], eax // 83c704 | add edi, 4 // 85f6 | test esi, esi // 8d4604 | lea eax, [esi + 4] // 0f44c6 | cmove eax, esi // 833f00 | cmp dword ptr [edi], 0 $sequence_2 = { 8b0418 03c3 eb0f 8b07 } // n = 4, score = 800 // 8b0418 | mov eax, dword ptr [eax + ebx] // 03c3 | add eax, ebx // eb0f | jmp 0x11 // 8b07 | mov eax, dword ptr [edi] $sequence_3 = { 8b37 8b55fc 03f2 8b7f10 03fa } // n = 5, score = 800 // 8b37 | mov esi, dword ptr [edi] // 8b55fc | mov edx, dword ptr [ebp - 4] // 03f2 | add esi, edx // 8b7f10 | mov edi, dword ptr [edi + 0x10] // 03fa | add edi, edx $sequence_4 = { 8bc7 c1e810 66010431 eb10 } // n = 4, score = 800 // 8bc7 | mov eax, edi // c1e810 | shr eax, 0x10 // 66010431 | add word ptr [ecx + esi], ax // eb10 | jmp 0x12 $sequence_5 = { 83c002 8945e8 85db 759d } // n = 4, score = 800 // 83c002 | add eax, 2 // 8945e8 | mov dword ptr [ebp - 0x18], eax // 85db | test ebx, ebx // 759d | jne 0xffffff9f $sequence_6 = { 750b 81e2ff0f0000 013c32 eb38 6683f803 } // n = 5, score = 800 // 750b | jne 0xd // 81e2ff0f0000 | and edx, 0xfff // 013c32 | add dword ptr [edx + esi], edi // eb38 | jmp 0x3a // 6683f803 | cmp ax, 3 $sequence_7 = { 3df232f60e 7507 8b01 03c6 } // n = 4, score = 800 // 3df232f60e | cmp eax, 0xef632f2 // 7507 | jne 9 // 8b01 | mov eax, dword ptr [ecx] // 03c6 | add eax, esi $sequence_8 = { c744245c00000000 c744246000000000 ffd7 85c0 0f88a0000000 } // n = 5, score = 400 // c744245c00000000 | mov dword ptr [esp + 0x5c], 0 // c744246000000000 | mov dword ptr [esp + 0x60], 0 // ffd7 | call edi // 85c0 | test eax, eax // 0f88a0000000 | js 0xa6 $sequence_9 = { 80eb61 0fb6d1 80fb19 0fb6cd 0f47d1 0fbeca } // n = 6, score = 400 // 80eb61 | sub bl, 0x61 // 0fb6d1 | movzx edx, cl // 80fb19 | cmp bl, 0x19 // 0fb6cd | movzx ecx, ch // 0f47d1 | cmova edx, ecx // 0fbeca | movsx ecx, dl $sequence_10 = { 8d442434 50 ffd6 8d442438 c744244018000000 89442448 } // n = 6, score = 400 // 8d442434 | lea eax, [esp + 0x34] // 50 | push eax // ffd6 | call esi // 8d442438 | lea eax, [esp + 0x38] // c744244018000000 | mov dword ptr [esp + 0x40], 0x18 // 89442448 | mov dword ptr [esp + 0x48], eax $sequence_11 = { 50 c744245840000000 c744245c00000000 c744246000000000 } // n = 4, score = 400 // 50 | push eax // c744245840000000 | mov dword ptr [esp + 0x58], 0x40 // c744245c00000000 | mov dword ptr [esp + 0x5c], 0 // c744246000000000 | mov dword ptr [esp + 0x60], 0 $sequence_12 = { ffd0 6800800000 8d442424 c744242400000000 50 } // n = 5, score = 400 // ffd0 | call eax // 6800800000 | push 0x8000 // 8d442424 | lea eax, [esp + 0x24] // c744242400000000 | mov dword ptr [esp + 0x24], 0 // 50 | push eax $sequence_13 = { 6a40 6800300000 89442424 8d442424 50 } // n = 5, score = 400 // 6a40 | push 0x40 // 6800300000 | push 0x3000 // 89442424 | mov dword ptr [esp + 0x24], eax // 8d442424 | lea eax, [esp + 0x24] // 50 | push eax $sequence_14 = { 742e 8add c1c80d 8acd } // n = 4, score = 400 // 742e | je 0x30 // 8add | mov bl, ch // c1c80d | ror eax, 0xd // 8acd | mov cl, ch $sequence_15 = { 8a01 8d4901 88440eff 83ea01 75f2 } // n = 5, score = 400 // 8a01 | mov al, byte ptr [ecx] // 8d4901 | lea ecx, [ecx + 1] // 88440eff | mov byte ptr [esi + ecx - 1], al // 83ea01 | sub edx, 1 // 75f2 | jne 0xfffffff4 $sequence_16 = { 4a8b0402 498d0c01 4a890c02 eb3c 6683f903 } // n = 5, score = 300 // 4a8b0402 | movzx eax, dx // 498d0c01 | je 0x9a // 4a890c02 | inc esp // eb3c | mov eax, dword ptr [ebx] // 6683f903 | dec esp $sequence_17 = { 6690 410fb713 49ffca 0fb7ca 0fb7c2 } // n = 5, score = 300 // 6690 | dec eax // 410fb713 | mov eax, dword ptr [0x60] // 49ffca | inc ecx // 0fb7ca | mov ebx, 1 // 0fb7c2 | dec eax $sequence_18 = { ebd9 65488b042560000000 41bb01000000 48897c2438 4c89ac2488000000 } // n = 5, score = 300 // ebd9 | dec ecx // 65488b042560000000 | mov ecx, ebp // 41bb01000000 | dec eax // 48897c2438 | test edx, edx // 4c89ac2488000000 | jmp 0xffffffdb $sequence_19 = { 4d85c0 741b 482bd1 0f1f840000000000 } // n = 4, score = 300 // 4d85c0 | movzx edx, word ptr [ebx] // 741b | dec ecx // 482bd1 | dec edx // 0f1f840000000000 | movzx ecx, dx $sequence_20 = { 4533c0 0fb601 0f1f4000 41c1c80d 488d4901 0fbec0 } // n = 6, score = 300 // 4533c0 | lea edx, [eax - 8] // 0fb601 | dec ebp // 0f1f4000 | add eax, esi // 41c1c80d | dec esp // 488d4901 | lea ebx, [ebx + 8] // 0fbec0 | dec ebp $sequence_21 = { 0f1f8000000000 0fb602 48ffc2 8801 488d4901 4983e801 75ee } // n = 7, score = 300 // 0f1f8000000000 | test eax, eax // 0fb602 | je 0x1d // 48ffc2 | dec eax // 8801 | sub edx, ecx // 488d4901 | nop dword ptr [eax + eax] // 4983e801 | dec edx // 75ee | mov eax, dword ptr [edx + eax] $sequence_22 = { 4c8bf0 ffd5 418b5754 498bcd 4885d2 } // n = 5, score = 300 // 4c8bf0 | dec esp // ffd5 | mov esi, eax // 418b5754 | call ebp // 498bcd | inc ecx // 4885d2 | mov edx, dword ptr [edi + 0x54] $sequence_23 = { 0f8494000000 448b03 4c8d50f8 4d03c6 4c8d5b08 } // n = 5, score = 300 // 0f8494000000 | mov dword ptr [esp + 0x38], edi // 448b03 | dec esp // 4c8d50f8 | mov dword ptr [esp + 0x88], ebp // 4d03c6 | nop // 4c8d5b08 | inc ecx condition: 7 of them and filesize < 1015808 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY