Actor(s): APT41
A Microsoft SQL Server backdoor
rule win_skip20_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-04-08" version = "1" description = "Detects win.skip20." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skip20" malpedia_rule_date = "20220405" malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a" malpedia_version = "20220411" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 0f88f9f5ffff 488b4510 4c8d15b794ffff 8b08 894b08 4883451004 e9???????? } // n = 7, score = 200 // 0f88f9f5ffff | mov edx, edi // 488b4510 | dec eax // 4c8d15b794ffff | mov ecx, ebx // 8b08 | mov dl, 0x5d // 894b08 | dec eax // 4883451004 | mov ecx, ebx // e9???????? | $sequence_1 = { 740d b801000000 66d3e0 664109402c 4589584c ffca 49ffc2 } // n = 7, score = 200 // 740d | bts eax, 0x19 // b801000000 | or dword ptr [esi + 4], 0x4000 // 66d3e0 | inc esp // 664109402c | mov eax, dword ptr [ebp + 0x1c] // 4589584c | dec esp // ffca | mov ecx, ebx // 49ffc2 | dec eax $sequence_2 = { ff15???????? eb41 ba0e000000 488bcb e8???????? 4885c0 0f847affffff } // n = 7, score = 200 // ff15???????? | // eb41 | dec ebp // ba0e000000 | add eax, ebp // 488bcb | dec eax // e8???????? | // 4885c0 | mov ecx, ebx // 0f847affffff | mov dword ptr [esp + 0x48], esi $sequence_3 = { 740a 418bc1 66d3e0 6609422c } // n = 4, score = 200 // 740a | dec eax // 418bc1 | lea ecx, dword ptr [eax + ecx + 4] // 66d3e0 | dec eax // 6609422c | add edx, 4 $sequence_4 = { 440fb648ff 4989442410 0fbae61d 7357 4180f920 725c 488b542468 } // n = 7, score = 200 // 440fb648ff | dec ecx // 4989442410 | mov ecx, eax // 0fbae61d | inc ecx // 7357 | cmp byte ptr [eax], bl // 4180f920 | dec esp // 725c | lea ebx, dword ptr [0x1ffbd] // 488b542468 | dec ebp $sequence_5 = { 7435 4180c410 41b820000000 448864bb23 66448944bb24 e9???????? b840000000 } // n = 7, score = 200 // 7435 | mov eax, ebx // 4180c410 | inc ecx // 41b820000000 | cmp ecx, 1 // 448864bb23 | inc ecx // 66448944bb24 | cmove eax, esi // e9???????? | // b840000000 | mov dword ptr [esp + 0x58], eax $sequence_6 = { 57 4883ec20 bf24000000 488d1d9c330100 8bf7 488b2b 4885ed } // n = 7, score = 200 // 57 | mov dword ptr [esp + 0x25c], 0xc3c28b48 // 4883ec20 | mov word ptr [esp + 0x260], 0x9090 // bf24000000 | mov byte ptr [esp + 0x262], 0x90 // 488d1d9c330100 | mov dword ptr [esp + 0x254], 0xfc // 8bf7 | mov dword ptr [esp + 0x258], 0x1b // 488b2b | mov dword ptr [esp + 0x25c], 0xc3c28b48 // 4885ed | mov word ptr [esp + 0x260], 0x9090 $sequence_7 = { 6685c9 7503 33c0 c3 0fb7c1 ba00e00000 } // n = 6, score = 200 // 6685c9 | mov dword ptr [esp + 0x50], 0 // 7503 | inc esp // 33c0 | mov dword ptr [esp + 0x48], ebp // c3 | je 0x14 // 0fb7c1 | mov ecx, 0x200 // ba00e00000 | inc esp $sequence_8 = { 440fb75c2476 89442440 894c2438 89542430 4489542428 44895c2420 488d15c32b0100 } // n = 7, score = 200 // 440fb75c2476 | mov ecx, ebx // 89442440 | dec eax // 894c2438 | test eax, eax // 89542430 | je 0x2e7 // 4489542428 | dec esp // 44895c2420 | lea eax, dword ptr [esp + 0x2e8] // 488d15c32b0100 | mov edx, edi $sequence_9 = { 4c89742430 83fe0f 0f8442020000 837db302 754e 8b4dbf 0fbae119 } // n = 7, score = 200 // 4c89742430 | inc cx // 83fe0f | cmp eax, esp // 0f8442020000 | je 0x1919 // 837db302 | mov ecx, 0x133 // 754e | mov ecx, 0x2d // 8b4dbf | cmovl edx, ecx // 0fbae119 | dec eax condition: 7 of them and filesize < 794624 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY