There is no description at this point.
rule win_simplefilemover_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.simplefilemover." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.simplefilemover" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8bfc f3a5 e8???????? 81c420020000 } // n = 4, score = 500 // 8bfc | mov edi, esp // f3a5 | rep movsd dword ptr es:[edi], dword ptr [esi] // e8???????? | // 81c420020000 | add esp, 0x220 $sequence_1 = { 33c0 e9???????? 6820020000 ff15???????? } // n = 4, score = 400 // 33c0 | xor eax, eax // e9???????? | // 6820020000 | push 0x220 // ff15???????? | $sequence_2 = { 81c420020000 85c0 7407 68???????? eb05 68???????? ff15???????? } // n = 7, score = 300 // 81c420020000 | add esp, 0x220 // 85c0 | test eax, eax // 7407 | je 9 // 68???????? | // eb05 | jmp 7 // 68???????? | // ff15???????? | $sequence_3 = { b988000000 8bf3 8bfc f3a5 } // n = 4, score = 300 // b988000000 | mov ecx, 0x88 // 8bf3 | mov esi, ebx // 8bfc | mov edi, esp // f3a5 | rep movsd dword ptr es:[edi], dword ptr [esi] $sequence_4 = { 33ff 884c2408 3bf7 88542424 897c2410 } // n = 5, score = 200 // 33ff | xor edi, edi // 884c2408 | mov byte ptr [esp + 8], cl // 3bf7 | cmp esi, edi // 88542424 | mov byte ptr [esp + 0x24], dl // 897c2410 | mov dword ptr [esp + 0x10], edi $sequence_5 = { 7503 8bfa 46 668b4102 83c102 42 } // n = 6, score = 200 // 7503 | jne 5 // 8bfa | mov edi, edx // 46 | inc esi // 668b4102 | mov ax, word ptr [ecx + 2] // 83c102 | add ecx, 2 // 42 | inc edx $sequence_6 = { 8b8d54faffff 51 ff15???????? 6a00 6800200000 8d9554daffff } // n = 6, score = 200 // 8b8d54faffff | mov ecx, dword ptr [ebp - 0x5ac] // 51 | push ecx // ff15???????? | // 6a00 | push 0 // 6800200000 | push 0x2000 // 8d9554daffff | lea edx, [ebp - 0x25ac] $sequence_7 = { 8b8554faffff 50 ff15???????? 85c0 } // n = 4, score = 200 // 8b8554faffff | mov eax, dword ptr [ebp - 0x5ac] // 50 | push eax // ff15???????? | // 85c0 | test eax, eax $sequence_8 = { 8b74241c 57 8a8800010000 8a9001010000 33ff } // n = 5, score = 200 // 8b74241c | mov esi, dword ptr [esp + 0x1c] // 57 | push edi // 8a8800010000 | mov cl, byte ptr [eax + 0x100] // 8a9001010000 | mov dl, byte ptr [eax + 0x101] // 33ff | xor edi, edi $sequence_9 = { ebc2 ebc0 ebbe ebbc ebba ebb8 } // n = 6, score = 200 // ebc2 | jmp 0xffffffc4 // ebc0 | jmp 0xffffffc2 // ebbe | jmp 0xffffffc0 // ebbc | jmp 0xffffffbe // ebba | jmp 0xffffffbc // ebb8 | jmp 0xffffffba $sequence_10 = { e8???????? 81c420020000 85c0 7410 68???????? ff15???????? } // n = 6, score = 200 // e8???????? | // 81c420020000 | add esp, 0x220 // 85c0 | test eax, eax // 7410 | je 0x12 // 68???????? | // ff15???????? | $sequence_11 = { 8b4c2414 8d447b02 50 51 } // n = 4, score = 200 // 8b4c2414 | mov ecx, dword ptr [esp + 0x14] // 8d447b02 | lea eax, [ebx + edi*2 + 2] // 50 | push eax // 51 | push ecx $sequence_12 = { 5f 889000010000 888801010000 5e 83c410 c3 } // n = 6, score = 200 // 5f | pop edi // 889000010000 | mov byte ptr [eax + 0x100], dl // 888801010000 | mov byte ptr [eax + 0x101], cl // 5e | pop esi // 83c410 | add esp, 0x10 // c3 | ret $sequence_13 = { e9???????? 807d0867 0f848f020000 807d0870 0f8513040000 } // n = 5, score = 200 // e9???????? | // 807d0867 | cmp byte ptr [ebp + 8], 0x67 // 0f848f020000 | je 0x295 // 807d0870 | cmp byte ptr [ebp + 8], 0x70 // 0f8513040000 | jne 0x419 $sequence_14 = { 83bd08daffffff 7409 83bd08daffff00 750f c78508daffff00000000 e9???????? 6a04 } // n = 7, score = 200 // 83bd08daffffff | cmp dword ptr [ebp - 0x25f8], -1 // 7409 | je 0xb // 83bd08daffff00 | cmp dword ptr [ebp - 0x25f8], 0 // 750f | jne 0x11 // c78508daffff00000000 | mov dword ptr [ebp - 0x25f8], 0 // e9???????? | // 6a04 | push 4 $sequence_15 = { 47 897c2418 0fbfff 3bfb 0f8c54ffffff 8a4c242c } // n = 6, score = 200 // 47 | inc edi // 897c2418 | mov dword ptr [esp + 0x18], edi // 0fbfff | movsx edi, di // 3bfb | cmp edi, ebx // 0f8c54ffffff | jl 0xffffff5a // 8a4c242c | mov cl, byte ptr [esp + 0x2c] $sequence_16 = { 6a64 ff15???????? ff4de0 395de0 7fd4 } // n = 5, score = 200 // 6a64 | push 0x64 // ff15???????? | // ff4de0 | dec dword ptr [ebp - 0x20] // 395de0 | cmp dword ptr [ebp - 0x20], ebx // 7fd4 | jg 0xffffffd6 $sequence_17 = { 52 8d855cfaffff 50 8d8d60daffff 51 } // n = 5, score = 200 // 52 | push edx // 8d855cfaffff | lea eax, [ebp - 0x5a4] // 50 | push eax // 8d8d60daffff | lea ecx, [ebp - 0x25a0] // 51 | push ecx $sequence_18 = { 8d85b0ddffff 50 e8???????? 8d45dc 57 50 8b45f4 } // n = 7, score = 200 // 8d85b0ddffff | lea eax, [ebp - 0x2250] // 50 | push eax // e8???????? | // 8d45dc | lea eax, [ebp - 0x24] // 57 | push edi // 50 | push eax // 8b45f4 | mov eax, dword ptr [ebp - 0xc] $sequence_19 = { 50 ff7610 6a00 6a00 ffd7 ff7508 8d4302 } // n = 7, score = 200 // 50 | push eax // ff7610 | push dword ptr [esi + 0x10] // 6a00 | push 0 // 6a00 | push 0 // ffd7 | call edi // ff7508 | push dword ptr [ebp + 8] // 8d4302 | lea eax, [ebx + 2] $sequence_20 = { 8b4c2408 8b742424 53 81e1ff000000 } // n = 4, score = 200 // 8b4c2408 | mov ecx, dword ptr [esp + 8] // 8b742424 | mov esi, dword ptr [esp + 0x24] // 53 | push ebx // 81e1ff000000 | and ecx, 0xff $sequence_21 = { 53 52 ff15???????? 83c408 5f 5e } // n = 6, score = 200 // 53 | push ebx // 52 | push edx // ff15???????? | // 83c408 | add esp, 8 // 5f | pop edi // 5e | pop esi condition: 7 of them and filesize < 57344 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY