Shellcode-based malware family that according to ESET Research was likely written by the same authors as win.crosswalk.
rule win_sidewalk_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.sidewalk." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewalk" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 4c8d4dd7 418b09 418bc0 c1e002 4d8d4904 4863d0 41ffc0 } // n = 7, score = 200 // 4c8d4dd7 | xor edx, eax // 418b09 | inc ecx // 418bc0 | mov eax, edi // c1e002 | xor eax, ebx // 4d8d4904 | rol edx, 7 // 4863d0 | rol eax, 0xc // 41ffc0 | inc esp $sequence_1 = { 4403e8 4133db 418bcd c1c307 } // n = 4, score = 200 // 4403e8 | inc ebp // 4133db | add edi, edx // 418bcd | inc ecx // c1c307 | mov ebx, edi $sequence_2 = { 4403df 458bc3 4433c0 418bc5 } // n = 4, score = 200 // 4403df | add esp, esi // 458bc3 | inc esp // 4433c0 | add ecx, ebx // 418bc5 | inc ebp $sequence_3 = { 884202 884a03 4183f810 7ccc } // n = 4, score = 200 // 884202 | inc esp // 884a03 | xor esi, eax // 4183f810 | inc ecx // 7ccc | rol esi, 8 $sequence_4 = { 48ffc1 488d040a 483bc6 7ce2 4883c640 4883c340 4883ef40 } // n = 7, score = 200 // 48ffc1 | xor esi, eax // 488d040a | inc ecx // 483bc6 | rol esi, 8 // 7ce2 | inc ebp // 4883c640 | add ebp, esi // 4883c340 | inc ebp // 4883ef40 | mov esi, ecx $sequence_5 = { 0bc8 0fb642fe c1e108 0bc8 41890c10 488d5204 } // n = 6, score = 200 // 0bc8 | rol edx, 7 // 0fb642fe | rol eax, 0xc // c1e108 | inc esp // 0bc8 | add ecx, eax // 41890c10 | inc ebp // 488d5204 | xor edx, ecx $sequence_6 = { 41890c10 488d5204 4983e901 75d4 4863457f } // n = 5, score = 200 // 41890c10 | xor esi, edx // 488d5204 | rol edi, 0x10 // 4983e901 | inc esp // 75d4 | add ebx, edi // 4863457f | inc ecx $sequence_7 = { 4403c9 458bf1 4433f0 41c1c608 } // n = 4, score = 200 // 4403c9 | inc ecx // 458bf1 | rol edx, 0x10 // 4433f0 | inc esp // 41c1c608 | add ebx, edi $sequence_8 = { 418bc7 33c3 c1c207 c1c00c 4403c8 } // n = 5, score = 200 // 418bc7 | inc ecx // 33c3 | mov eax, edi // c1c207 | xor eax, ebx // c1c00c | rol edx, 7 // 4403c8 | rol eax, 0xc $sequence_9 = { 7d15 8a040f 3201 41880408 48ffc1 488d040a } // n = 6, score = 200 // 7d15 | add ebx, edi // 8a040f | inc ecx // 3201 | rol esi, 0x10 // 41880408 | inc ebp // 48ffc1 | add esp, esi // 488d040a | inc esp $sequence_10 = { 8945ef 8bc2 33c6 c1c010 } // n = 4, score = 200 // 8945ef | jl 0xffffffee // 8bc2 | dec eax // 33c6 | add esi, 0x40 // c1c010 | mov eax, ecx $sequence_11 = { 4433f2 c1c710 4403df 41c1c610 } // n = 4, score = 200 // 4433f2 | inc ebp // c1c710 | add ebp, esi // 4403df | inc esp // 41c1c610 | add ecx, ecx $sequence_12 = { 4533d1 4403ee 41c1c210 418bc3 } // n = 4, score = 200 // 4533d1 | rol edx, 7 // 4403ee | rol eax, 0xc // 41c1c210 | inc esp // 418bc3 | add ecx, eax $sequence_13 = { 89750b 4489750f 44897d03 448965ff } // n = 4, score = 200 // 89750b | inc ebp // 4489750f | add ebp, esi // 44897d03 | inc ecx // 448965ff | mov eax, ebp $sequence_14 = { 4403df 41c1c610 4503e6 4403cb } // n = 4, score = 200 // 4403df | inc ecx // 41c1c610 | rol edx, 8 // 4503e6 | inc ecx // 4403cb | rol edx, 8 $sequence_15 = { 41c1c208 4503fa 418bdf 33d8 } // n = 4, score = 200 // 41c1c208 | inc esp // 4503fa | add ecx, eax // 418bdf | inc ebp // 33d8 | xor edx, ecx condition: 7 of them and filesize < 237568 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY