Actor(s): Silent Chollima
There is no description at this point.
rule win_sharpknot_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.sharpknot." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sharpknot" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8b4514 f6c303 7509 8b0c85e8dc4000 eb07 8b0c851cdd4000 } // n = 6, score = 100 // 8b4514 | mov eax, dword ptr [ebp + 0x14] // f6c303 | test bl, 3 // 7509 | jne 0xb // 8b0c85e8dc4000 | mov ecx, dword ptr [eax*4 + 0x40dce8] // eb07 | jmp 9 // 8b0c851cdd4000 | mov ecx, dword ptr [eax*4 + 0x40dd1c] $sequence_1 = { 7508 660fb6b680f74400 663bfe 751f 6685ff 742d } // n = 6, score = 100 // 7508 | jne 0xa // 660fb6b680f74400 | movzx si, byte ptr [esi + 0x44f780] // 663bfe | cmp di, si // 751f | jne 0x21 // 6685ff | test di, di // 742d | je 0x2f $sequence_2 = { 55 50 8bcb 89442428 e8???????? } // n = 5, score = 100 // 55 | push ebp // 50 | push eax // 8bcb | mov ecx, ebx // 89442428 | mov dword ptr [esp + 0x28], eax // e8???????? | $sequence_3 = { 50 2bcd b8abaaaa2a f7e9 c1fa02 8bca } // n = 6, score = 100 // 50 | push eax // 2bcd | sub ecx, ebp // b8abaaaa2a | mov eax, 0x2aaaaaab // f7e9 | imul ecx // c1fa02 | sar edx, 2 // 8bca | mov ecx, edx $sequence_4 = { 8d4c2420 89442414 51 6a01 50 8bcb e8???????? } // n = 7, score = 100 // 8d4c2420 | lea ecx, [esp + 0x20] // 89442414 | mov dword ptr [esp + 0x14], eax // 51 | push ecx // 6a01 | push 1 // 50 | push eax // 8bcb | mov ecx, ebx // e8???????? | $sequence_5 = { 83c448 8d442404 56 68???????? 50 e8???????? } // n = 6, score = 100 // 83c448 | add esp, 0x48 // 8d442404 | lea eax, [esp + 4] // 56 | push esi // 68???????? | // 50 | push eax // e8???????? | $sequence_6 = { 50 eb24 6a00 8d4c2414 } // n = 4, score = 100 // 50 | push eax // eb24 | jmp 0x26 // 6a00 | push 0 // 8d4c2414 | lea ecx, [esp + 0x14] $sequence_7 = { 7522 8d44240c 50 e8???????? 8bf0 83c408 85f6 } // n = 7, score = 100 // 7522 | jne 0x24 // 8d44240c | lea eax, [esp + 0xc] // 50 | push eax // e8???????? | // 8bf0 | mov esi, eax // 83c408 | add esp, 8 // 85f6 | test esi, esi $sequence_8 = { 85c0 742e 8d44243c 68???????? 50 ff15???????? } // n = 6, score = 100 // 85c0 | test eax, eax // 742e | je 0x30 // 8d44243c | lea eax, [esp + 0x3c] // 68???????? | // 50 | push eax // ff15???????? | $sequence_9 = { 0fb6c3 f68081f8440004 741a 8a4601 46 84c0 741d } // n = 7, score = 100 // 0fb6c3 | movzx eax, bl // f68081f8440004 | test byte ptr [eax + 0x44f881], 4 // 741a | je 0x1c // 8a4601 | mov al, byte ptr [esi + 1] // 46 | inc esi // 84c0 | test al, al // 741d | je 0x1f condition: 7 of them and filesize < 1032192 }
rule win_sharpknot_w0 { meta: author = "NCCIC Partner" source = "NCCIC Partner" date = "2017-12-12" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sharpknot" malpedia_version = "20180413" malpedia_sharing = "TLP:WHITE" malpedia_license = "" strings: $mbr_code = { 33 C0 8E D0 BC 00 7C FB 50 07 50 1F FC BE 5D 7C 33 C9 41 81 F9 00 ?? 74 24 B4 43 B0 00 CD 13 FE C2 80 FA 84 7C F3 B2 80 BF 65 7C 81 05 00 04 83 55 02 00 83 55 04 00 83 55 06 00 EB D5 BE 4D 7C B4 43 B0 00 CD 13 33 C9 BE 5D 7C EB C5 } $controlServiceFoundlnBoth = { 83 EC 1C 57 68 3F 00 0F 00 6A 00 6A 00 FF 15 ?? ?? ?? ?? 8B F8 85 FF 74 44 8B 44 24 24 53 56 6A 24 50 57 FF 15 ?? ?? ?? ?? 8B 1D ?? ?? ?? ?? 8B F0 85 F6 74 1C 8D 4C 24 0C 51 6A 01 56 FF 15 ?? ?? ?? ?? 68 E8 03 00 00 FF 15 ?? ?? ?? ?? 56 FF D3 57 FF D3 5E 5B 33 C0 5F 83 C4 1C C3 33 C0 5F 83 C4 1C C3 } condition: any of them }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY