Shellcode-based malware family that according to ESET Research was likely written by the same authors as win.crosswalk.
rule win_sidewalk_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-08-05" version = "1" description = "Detects win.sidewalk." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.sidewalk" malpedia_rule_date = "20220805" malpedia_hash = "6ec06c64bcfdbeda64eff021c766b4ce34542b71" malpedia_version = "20220808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { c1e810 880a c1e918 884202 884a03 4183f810 7ccc } // n = 7, score = 200 // c1e810 | shl ecx, 8 // 880a | or ecx, eax // c1e918 | inc ecx // 884202 | mov dword ptr [eax + edx], ecx // 884a03 | inc ecx // 4183f810 | mov byte ptr [eax + ecx], al // 7ccc | dec eax $sequence_1 = { 418b09 418bc0 c1e002 4d8d4904 } // n = 4, score = 200 // 418b09 | inc ecx // 418bc0 | mov dword ptr [eax + edx], ecx // c1e002 | dec eax // 4d8d4904 | lea edx, [edx + 4] $sequence_2 = { 41880408 48ffc1 488d040a 483bc6 7ce2 4883c640 } // n = 6, score = 200 // 41880408 | inc ecx // 48ffc1 | mov byte ptr [eax + ecx], al // 488d040a | dec eax // 483bc6 | inc ecx // 7ce2 | dec eax // 4883c640 | lea eax, [edx + ecx] $sequence_3 = { 8945ef 8bc2 33c6 c1c010 } // n = 4, score = 200 // 8945ef | inc ecx // 8bc2 | mov ecx, dword ptr [ecx] // 33c6 | inc ecx // c1c010 | mov eax, eax $sequence_4 = { 41890c10 488d5204 4983e901 75d4 } // n = 4, score = 200 // 41890c10 | dec eax // 488d5204 | cmp eax, esi // 4983e901 | jl 0xffffffe7 // 75d4 | dec eax $sequence_5 = { 4403df 41c1c610 4503e6 4403cb 4533d1 } // n = 5, score = 200 // 4403df | mov dword ptr [ebp + 3], edi // 41c1c610 | inc esp // 4503e6 | mov dword ptr [ebp - 1], esp // 4403cb | inc esp // 4533d1 | mov dword ptr [ebp - 5], ebp $sequence_6 = { 4403c8 4533d1 41c1c208 4503fa 418bdf 33d8 } // n = 6, score = 200 // 4403c8 | shr eax, 0x10 // 4533d1 | mov byte ptr [edx], cl // 41c1c208 | shr ecx, 0x18 // 4503fa | mov byte ptr [edx + 2], al // 418bdf | mov byte ptr [edx + 3], cl // 33d8 | inc ecx $sequence_7 = { 33c3 c1c207 c1c00c 4403c8 4533d1 } // n = 5, score = 200 // 33c3 | cmp eax, esi // c1c207 | mov al, byte ptr [edi + ecx] // c1c00c | xor al, byte ptr [ecx] // 4403c8 | inc ecx // 4533d1 | mov byte ptr [eax + ecx], al $sequence_8 = { 4403c9 458bf1 4433f0 41c1c608 4503ee 418bc5 } // n = 6, score = 200 // 4403c9 | dec eax // 458bf1 | inc ecx // 4433f0 | dec eax // 41c1c608 | lea eax, [edx + ecx] // 4503ee | mov al, byte ptr [edi + ecx] // 418bc5 | xor al, byte ptr [ecx] $sequence_9 = { 4403de 4403e8 4133db 418bcd } // n = 4, score = 200 // 4403de | dec eax // 4403e8 | add esi, 0x40 // 4133db | dec eax // 418bcd | add ebx, 0x40 $sequence_10 = { 33f0 418bc1 4133c6 c1c608 c1c010 4403de } // n = 6, score = 200 // 33f0 | cmp eax, 0x10 // 418bc1 | jl 0xffffffdd // 4133c6 | mov dword ptr [ebp + 0xb], esi // c1c608 | inc esp // c1c010 | mov dword ptr [ebp + 0xf], esi // 4403de | inc esp $sequence_11 = { 33c6 c1c010 4403d8 4133db c1c30c 03d3 8bf2 } // n = 7, score = 200 // 33c6 | inc ecx // c1c010 | mov byte ptr [eax + ecx], al // 4403d8 | dec eax // 4133db | inc ecx // c1c30c | dec eax // 03d3 | lea eax, [edx + ecx] // 8bf2 | dec eax $sequence_12 = { c1c610 4433f2 c1c710 4403df 41c1c610 } // n = 5, score = 200 // c1c610 | inc ecx // 4433f2 | mov ecx, dword ptr [ecx] // c1c710 | inc ecx // 4403df | mov eax, eax // 41c1c610 | shl eax, 2 $sequence_13 = { 4489750f 44897d03 448965ff 44896dfb } // n = 4, score = 200 // 4489750f | jl 0xffffffee // 44897d03 | dec eax // 448965ff | add esi, 0x40 // 44896dfb | or ecx, eax $sequence_14 = { 8a040f 3201 41880408 48ffc1 } // n = 4, score = 200 // 8a040f | shl eax, 2 // 3201 | dec ebp // 41880408 | lea ecx, [ecx + 4] // 48ffc1 | dec eax $sequence_15 = { 0bc8 0fb642fe c1e108 0bc8 41890c10 488d5204 } // n = 6, score = 200 // 0bc8 | dec eax // 0fb642fe | inc ecx // c1e108 | dec eax // 0bc8 | lea eax, [edx + ecx] // 41890c10 | dec eax // 488d5204 | cmp eax, esi condition: 7 of them and filesize < 237568 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY