Actor(s): Turla Group
There is no description at this point.
rule win_skipper_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-12-22" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.skipper" malpedia_rule_date = "20201222" malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130" malpedia_version = "20201023" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 6a03 68???????? 68???????? 6a50 } // n = 4, score = 600 // 6a03 | push 3 // 68???????? | // 68???????? | // 6a50 | push 0x50 $sequence_1 = { 59 5d c3 55 8bec 33c0 50 } // n = 7, score = 500 // 59 | pop ecx // 5d | pop ebp // c3 | ret // 55 | push ebp // 8bec | mov ebp, esp // 33c0 | xor eax, eax // 50 | push eax $sequence_2 = { ff15???????? 6a00 6a00 6a00 6a00 50 } // n = 6, score = 500 // ff15???????? | // 6a00 | push 0 // 6a00 | push 0 // 6a00 | push 0 // 6a00 | push 0 // 50 | push eax $sequence_3 = { 6804010000 e8???????? 6804010000 8bf8 6a00 } // n = 5, score = 500 // 6804010000 | push 0x104 // e8???????? | // 6804010000 | push 0x104 // 8bf8 | mov edi, eax // 6a00 | push 0 $sequence_4 = { 0fb68405fcfeffff 320439 47 8847ff 4e } // n = 5, score = 400 // 0fb68405fcfeffff | push 0 // 320439 | push 0 // 47 | push 0x104 // 8847ff | push 0x104 // 4e | mov edi, eax $sequence_5 = { 03d0 8b85f8feffff 8a1a 0fb6c0 } // n = 4, score = 400 // 03d0 | push 0 // 8b85f8feffff | push 0 // 8a1a | push 0 // 0fb6c0 | push 0 $sequence_6 = { e8???????? 6804010000 c7470400000000 e8???????? 6804010000 6a00 50 } // n = 7, score = 400 // e8???????? | // 6804010000 | push 0x104 // c7470400000000 | push 0x104 // e8???????? | // 6804010000 | mov edi, eax // 6a00 | push 0 // 50 | push edi $sequence_7 = { 6800308000 6a00 6a00 68???????? } // n = 4, score = 300 // 6800308000 | push 0x803000 // 6a00 | push 0 // 6a00 | push 0 // 68???????? | $sequence_8 = { 83c404 6a00 6a64 52 50 e8???????? } // n = 6, score = 300 // 83c404 | push 0 // 6a00 | push 0 // 6a64 | push 0 // 52 | push eax // 50 | push 0x104 // e8???????? | $sequence_9 = { 53 e8???????? 6804010000 e8???????? } // n = 4, score = 300 // 53 | push ebx // e8???????? | // 6804010000 | push 0x104 // e8???????? | $sequence_10 = { e8???????? 83c404 6a00 6a64 } // n = 4, score = 300 // e8???????? | // 83c404 | mov edi, eax // 6a00 | push eax // 6a64 | push 0 $sequence_11 = { 81c900ffffff 41 898de8feffff 8b85e0feffff 8a8c05f0feffff 888deffeffff } // n = 6, score = 200 // 81c900ffffff | push edx // 41 | push eax // 898de8feffff | jmp 0xffffffd2 // 8b85e0feffff | mov dword ptr [ebp - 0x118], 0 // 8a8c05f0feffff | mov dword ptr [ebp - 0x120], 0 // 888deffeffff | jmp 0x1b $sequence_12 = { 450fb608 4803d0 0fb602 418800 } // n = 4, score = 200 // 450fb608 | movzx eax, cl // 4803d0 | dec esp // 0fb602 | lea eax, [esp] // 418800 | dec eax $sequence_13 = { 0fb6c1 4c8d0424 488d1424 4c03c0 } // n = 4, score = 200 // 0fb6c1 | inc ecx // 4c8d0424 | dec eax // 488d1424 | arpl cx, ax // 4c03c0 | movzx edx, byte ptr [esp + eax] $sequence_14 = { f77d0c 8b4508 0fb61410 03ca 81e1ff000080 } // n = 5, score = 200 // f77d0c | push 0x64 // 8b4508 | push edx // 0fb61410 | push eax // 03ca | add esp, 4 // 81e1ff000080 | push 0 $sequence_15 = { 408832 4181f900010000 7c9a 488bdd 85ed 0f8e8e000000 } // n = 6, score = 200 // 408832 | inc eax // 4181f900010000 | mov byte ptr [edx], dh // 7c9a | inc ecx // 488bdd | cmp ecx, 0x100 // 85ed | jl 0xffffff9c // 0f8e8e000000 | dec eax $sequence_16 = { 81e1ff000080 7908 49 81c900ffffff 41 898de8feffff } // n = 6, score = 200 // 81e1ff000080 | mov edi, eax // 7908 | push 0 // 49 | push edi // 81c900ffffff | pop ecx // 41 | pop ebp // 898de8feffff | ret $sequence_17 = { 4889842400010000 4c8b9c2440010000 33c9 4963e9 } // n = 4, score = 200 // 4889842400010000 | movzx ecx, byte ptr [eax] // 4c8b9c2440010000 | dec eax // 33c9 | add edx, eax // 4963e9 | movzx eax, byte ptr [edx] $sequence_18 = { 488b8c2400010000 4833cc e8???????? 4c8d9c2410010000 498b5b10 } // n = 5, score = 200 // 488b8c2400010000 | lea edx, [esp] // 4833cc | dec esp // e8???????? | // 4c8d9c2410010000 | add eax, eax // 498b5b10 | inc ebp $sequence_19 = { 038ddcfeffff 8811 e9???????? b001 8b4df4 33cd e8???????? } // n = 7, score = 200 // 038ddcfeffff | push 0 // 8811 | push 3 // e9???????? | // b001 | push 0x50 // 8b4df4 | push 0 // 33cd | push 3 // e8???????? | $sequence_20 = { 0f8e8e000000 492bfb ffc1 81e1ff000080 } // n = 4, score = 200 // 0f8e8e000000 | inc ecx // 492bfb | mov byte ptr [eax], al // ffc1 | dec eax // 81e1ff000080 | mov ecx, dword ptr [esp + 0x100] $sequence_21 = { 7907 48 0d00ffffff 40 8945f8 8b4df8 0fb6940df0feffff } // n = 7, score = 200 // 7907 | push 0 // 48 | push 0 // 0d00ffffff | push 0 // 40 | push eax // 8945f8 | push edi // 8b4df8 | push 8 // 0fb6940df0feffff | push 0 $sequence_22 = { 8a85effeffff 888415f0feffff 0fb64df8 0fb6940df0feffff 0fb645fc 0fb68c05f0feffff } // n = 6, score = 200 // 8a85effeffff | push 0x64 // 888415f0feffff | push edx // 0fb64df8 | push eax // 0fb6940df0feffff | add esp, 4 // 0fb645fc | push 0 // 0fb68c05f0feffff | push 0x64 $sequence_23 = { ffc0 488d5201 3d00010000 7cf1 448bc1 448bc9 } // n = 6, score = 200 // ffc0 | dec eax // 488d5201 | xor ecx, esp // 3d00010000 | dec esp // 7cf1 | lea ebx, [esp + 0x110] // 448bc1 | dec ecx // 448bc9 | mov ebx, dword ptr [ebx + 0x10] $sequence_24 = { ebd0 c785e8feffff00000000 c785e0feffff00000000 eb0f 8b85e0feffff } // n = 5, score = 200 // ebd0 | mov edi, eax // c785e8feffff00000000 | push 0 // c785e0feffff00000000 | push edi // eb0f | push 0x104 // 8b85e0feffff | push 0x104 $sequence_25 = { 81e1ff000080 7d0a ffc9 81c900ffffff ffc1 4863c1 0fb61404 } // n = 7, score = 200 // 81e1ff000080 | mov ebx, ebp // 7d0a | test ebp, ebp // ffc9 | jle 0x96 // 81c900ffffff | and ecx, 0x800000ff // ffc1 | jge 0xc // 4863c1 | dec ecx // 0fb61404 | or ecx, 0xffffff00 $sequence_26 = { 8955fc 0fb645f8 8a8c05f0feffff 888deffeffff 0fb655fc } // n = 5, score = 200 // 8955fc | push ebp // 0fb645f8 | mov ebp, esp // 8a8c05f0feffff | xor eax, eax // 888deffeffff | push eax // 0fb655fc | push 0 $sequence_27 = { 0f84a9010000 488bc8 ff15???????? 488d15e1580000 488bcb } // n = 5, score = 100 // 0f84a9010000 | jne 0x295 // 488bc8 | inc ecx // ff15???????? | // 488d15e1580000 | inc edi // 488bcb | dec eax $sequence_28 = { c785d4feffff3a040000 eb0a c785d4feffffffff1f00 8b4508 } // n = 4, score = 100 // c785d4feffff3a040000 | mov dword ptr [ebp - 0x12c], 0x43a // eb0a | jmp 0xc // c785d4feffffffff1f00 | mov dword ptr [ebp - 0x12c], 0x1fffff // 8b4508 | mov eax, dword ptr [ebp + 8] $sequence_29 = { 83c40c c78560ffffff94000000 8d8d60ffffff 51 ff15???????? 83bd64ffffff05 } // n = 6, score = 100 // 83c40c | add esp, 0xc // c78560ffffff94000000 | mov dword ptr [ebp - 0xa0], 0x94 // 8d8d60ffffff | lea ecx, [ebp - 0xa0] // 51 | push ecx // ff15???????? | // 83bd64ffffff05 | cmp dword ptr [ebp - 0x9c], 5 $sequence_30 = { e8???????? 488d05bf7f0000 488d5547 488d4de7 48894547 e8???????? 488d05977f0000 } // n = 7, score = 100 // e8???????? | // 488d05bf7f0000 | push eax // 488d5547 | push 0x104 // 488d4de7 | push 0x104 // 48894547 | mov edi, eax // e8???????? | // 488d05977f0000 | push 0x104 $sequence_31 = { 4863c6 488d15e5b90000 ffc6 488d0c80 488d0cca baa00f0000 } // n = 6, score = 100 // 4863c6 | push edi // 488d15e5b90000 | push eax // ffc6 | push 0 // 488d0c80 | push 0 // 488d0cca | push 0 // baa00f0000 | push 0 $sequence_32 = { 8985e4feffff 6a04 6800300000 6804010000 6a00 8b95e4feffff 52 } // n = 7, score = 100 // 8985e4feffff | mov dword ptr [ebp - 0x11c], eax // 6a04 | push 4 // 6800300000 | push 0x3000 // 6804010000 | push 0x104 // 6a00 | push 0 // 8b95e4feffff | mov edx, dword ptr [ebp - 0x11c] // 52 | push edx $sequence_33 = { 488d15f5be0000 488bc8 e8???????? 84c0 0f858d020000 41ffc7 4883c614 } // n = 7, score = 100 // 488d15f5be0000 | push 0 // 488bc8 | push 0 // e8???????? | // 84c0 | push eax // 0f858d020000 | push 0 // 41ffc7 | push 0 // 4883c614 | push 0 $sequence_34 = { 8d34fd1ca92300 ff36 e8???????? 59 } // n = 4, score = 100 // 8d34fd1ca92300 | lea esi, [edi*8 + 0x23a91c] // ff36 | push dword ptr [esi] // e8???????? | // 59 | pop ecx $sequence_35 = { 55 8bec 8b4508 ff34c570a02300 ff15???????? } // n = 5, score = 100 // 55 | push ebp // 8bec | mov ebp, esp // 8b4508 | mov eax, dword ptr [ebp + 8] // ff34c570a02300 | push dword ptr [eax*8 + 0x23a070] // ff15???????? | $sequence_36 = { 4885c0 7528 ff15???????? 83f857 0f85db010000 488d0df4580000 ff15???????? } // n = 7, score = 100 // 4885c0 | add esi, 0x14 // 7528 | dec esp // ff15???????? | // 83f857 | lea ebx, [eax + eax*2] // 0f85db010000 | dec esp // 488d0df4580000 | lea esi, [0x9e15] // ff15???????? | $sequence_37 = { 8d34c570a02300 833e00 7513 50 } // n = 4, score = 100 // 8d34c570a02300 | lea esi, [eax*8 + 0x23a070] // 833e00 | cmp dword ptr [esi], 0 // 7513 | jne 0x15 // 50 | push eax $sequence_38 = { 898ddcfeffff 8d95e0feffff 52 6a00 8b85d8feffff 50 8b8dd0feffff } // n = 7, score = 100 // 898ddcfeffff | mov dword ptr [ebp - 0x124], ecx // 8d95e0feffff | lea edx, [ebp - 0x120] // 52 | push edx // 6a00 | push 0 // 8b85d8feffff | mov eax, dword ptr [ebp - 0x128] // 50 | push eax // 8b8dd0feffff | mov ecx, dword ptr [ebp - 0x130] $sequence_39 = { 894df8 894df4 894df0 85db } // n = 4, score = 100 // 894df8 | mov dword ptr [ebp - 8], ecx // 894df4 | mov dword ptr [ebp - 0xc], ecx // 894df0 | mov dword ptr [ebp - 0x10], ecx // 85db | test ebx, ebx $sequence_40 = { 7326 e9???????? 8a03 488d1510aa0000 ffc7 } // n = 5, score = 100 // 7326 | push 0 // e9???????? | // 8a03 | push edi // 488d1510aa0000 | push 4 // ffc7 | mov dword ptr [edi], 0 $sequence_41 = { 33db 895dd8 83fb40 0f8d42010000 8b3c9d606d4100 } // n = 5, score = 100 // 33db | xor ebx, ebx // 895dd8 | mov dword ptr [ebp - 0x28], ebx // 83fb40 | cmp ebx, 0x40 // 0f8d42010000 | jge 0x148 // 8b3c9d606d4100 | mov edi, dword ptr [ebx*4 + 0x416d60] $sequence_42 = { 8bcf e8???????? b84d5a0000 66390502deffff 7404 33db } // n = 6, score = 100 // 8bcf | dec eax // e8???????? | // b84d5a0000 | lea edx, [0xbef5] // 66390502deffff | dec eax // 7404 | mov ecx, eax // 33db | test al, al $sequence_43 = { 668b4c4310 66890c4590b22300 40 ebe8 33c0 } // n = 5, score = 100 // 668b4c4310 | mov cx, word ptr [ebx + eax*2 + 0x10] // 66890c4590b22300 | mov word ptr [eax*2 + 0x23b290], cx // 40 | inc eax // ebe8 | jmp 0xffffffea // 33c0 | xor eax, eax $sequence_44 = { 4c8d1c40 4c8d35159e0000 bd04000000 49c1e304 4d03cb } // n = 5, score = 100 // 4c8d1c40 | push 0 // 4c8d35159e0000 | push 0x104 // bd04000000 | push 0x104 // 49c1e304 | mov edi, eax // 4d03cb | push 0 condition: 7 of them and filesize < 262144 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY