Actor(s): Lazarus Group
There is no description at this point.
rule win_slickshoes_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-04-08" version = "1" description = "Detects win.slickshoes." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.slickshoes" malpedia_rule_date = "20220405" malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a" malpedia_version = "20220411" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { e9???????? 5f 81e71f000000 be00000000 89e8 81c240000000 09de } // n = 7, score = 100 // e9???????? | // 5f | pop edi // 81e71f000000 | and edi, 0x1f // be00000000 | mov esi, 0 // 89e8 | mov eax, ebp // 81c240000000 | add edx, 0x40 // 09de | or esi, ebx $sequence_1 = { ff3424 5a 83c404 55 e9???????? 81c3007e1d7e 5a } // n = 7, score = 100 // ff3424 | push dword ptr [esp] // 5a | pop edx // 83c404 | add esp, 4 // 55 | push ebp // e9???????? | // 81c3007e1d7e | add ebx, 0x7e1d7e00 // 5a | pop edx $sequence_2 = { e9???????? 52 56 53 bb426aaf77 e9???????? 4a } // n = 7, score = 100 // e9???????? | // 52 | push edx // 56 | push esi // 53 | push ebx // bb426aaf77 | mov ebx, 0x77af6a42 // e9???????? | // 4a | dec edx $sequence_3 = { f7d3 31d8 31c3 31d8 68c326cd5d 893424 beaaa85b7d } // n = 7, score = 100 // f7d3 | not ebx // 31d8 | xor eax, ebx // 31c3 | xor ebx, eax // 31d8 | xor eax, ebx // 68c326cd5d | push 0x5dcd26c3 // 893424 | mov dword ptr [esp], esi // beaaa85b7d | mov esi, 0x7d5ba8aa $sequence_4 = { 89f6 29c0 01cb 09fe 81ee80000000 8b3b 89ee } // n = 7, score = 100 // 89f6 | mov esi, esi // 29c0 | sub eax, eax // 01cb | add ebx, ecx // 09fe | or esi, edi // 81ee80000000 | sub esi, 0x80 // 8b3b | mov edi, dword ptr [ebx] // 89ee | mov esi, ebp $sequence_5 = { e9???????? 313424 333424 8b2424 e9???????? 55 e9???????? } // n = 7, score = 100 // e9???????? | // 313424 | xor dword ptr [esp], esi // 333424 | xor esi, dword ptr [esp] // 8b2424 | mov esp, dword ptr [esp] // e9???????? | // 55 | push ebp // e9???????? | $sequence_6 = { e9???????? 89542404 e9???????? 57 bf9bdb5f56 81f7299ac419 09fa } // n = 7, score = 100 // e9???????? | // 89542404 | mov dword ptr [esp + 4], edx // e9???????? | // 57 | push edi // bf9bdb5f56 | mov edi, 0x565fdb9b // 81f7299ac419 | xor edi, 0x19c49a29 // 09fa | or edx, edi $sequence_7 = { fb 81f300000080 0500000000 21db 09c7 81e9ffffff7f 668b10 } // n = 7, score = 100 // fb | sti // 81f300000080 | xor ebx, 0x80000000 // 0500000000 | add eax, 0 // 21db | and ebx, ebx // 09c7 | or edi, eax // 81e9ffffff7f | sub ecx, 0x7fffffff // 668b10 | mov dx, word ptr [eax] $sequence_8 = { ff3424 8b1c24 81c404000000 52 e9???????? 81ea2115465f 81ea47d5ee7d } // n = 7, score = 100 // ff3424 | push dword ptr [esp] // 8b1c24 | mov ebx, dword ptr [esp] // 81c404000000 | add esp, 4 // 52 | push edx // e9???????? | // 81ea2115465f | sub edx, 0x5f461521 // 81ea47d5ee7d | sub edx, 0x7deed547 $sequence_9 = { e9???????? 83c404 50 b804000000 01c3 58 53 } // n = 7, score = 100 // e9???????? | // 83c404 | add esp, 4 // 50 | push eax // b804000000 | mov eax, 4 // 01c3 | add ebx, eax // 58 | pop eax // 53 | push ebx condition: 7 of them and filesize < 11198464 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY