SYMBOLCOMMON_NAMEaka. SYNONYMS
win.smokeloader (Back to overview)

SmokeLoader

aka: Dofoil, Sharik, Smoke, Smoke Loader

Actor(s): SMOKY SPIDER, UAC-0006

VTCollection     URLhaus            

The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.

References
2025-09-15 ⋅ Zscalar ⋅ ThreatLabZ research team
SmokeLoader Rises From the Ashes
SmokeLoader
2025-06-17 ⋅ DARKReading ⋅ James Shank
Operation Endgame: Do Takedowns and Arrests Matter?
BumbleBee Emotet Pikabot SmokeLoader TrickBot
2025-04-09 ⋅ Europol ⋅ Europol
Operation Endgame follow-up leads to five detentions and interrogations as well as server takedowns
SmokeLoader
2025-03-28 ⋅ Intrinsec ⋅ David Sardinha
From espionage to PsyOps: Tracking operations and bulletproof providers of UACs in 2025
sLoad NetSupportManager RAT Remcos SmokeLoader
2025-02-06 ⋅ Hunt.io ⋅ Hunt.io
SmokeLoader Malware Found in Open Directories Targeting Ukraine’s Auto & Banking Industries
SmokeLoader
2025-02-04 ⋅ Trend Micro ⋅ Peter Girnus
CVE-2025-0411: Ukrainian Organizations Targeted in Zero-Day Campaign and Homoglyph Attacks
SmokeLoader
2024-12-02 ⋅ FortiGuard Labs ⋅ Pei Han Liao
SmokeLoader Attack Targets Companies in Taiwan
SmokeLoader
2024-11-07 ⋅ Perception Point ⋅ Arthur Vaiselbuh
Evasive ZIP Concatenation: Trojan Targets Windows Users
SmokeLoader
2024-10-17 ⋅ Loader Insight Agency ⋅ LIA
Correlating Vidar Stealer Build IDs Based on Loader Tasks
Lumma Stealer SmokeLoader Vidar
2024-07-02 ⋅ Sekoia ⋅ Quentin Bourgue
Exposing FakeBat loader: distribution methods and adversary infrastructure
BlackCat Royal Ransom EugenLoader Carbanak Cobalt Strike DICELOADER Gozi IcedID Lumma Stealer NetSupportManager RAT Pikabot RedLine Stealer SectopRAT Sliver SmokeLoader Vidar
2024-06-11 ⋅ Zscaler ⋅ ThreatLabZ research team
A Brief History of SmokeLoader, Part 1
SmokeLoader
2024-05-30 ⋅ Europol ⋅ Europol
Largest ever operation against botnets hits dropper malware ecosystem
BumbleBee IcedID SmokeLoader SystemBC TrickBot
2024-03-05 ⋅ CIP ⋅ paloalto Networks: Unit42, State Service of Special Communication and Information Protection of Ukraine (CIP)
Semi-Annual Chronicles of UAC-0006 Operations
SmokeLoader
2024-03-01 ⋅ farghlymal github.io ⋅ Aziz Farghly
Taking a deep dive into SmokeLoader
SmokeLoader
2024-02-28 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Toot about SmokeLoader dropping Xehook Stealer
SmokeLoader
2024-01-30 ⋅ ANY.RUN ⋅ Lena (LambdaMamba)
CrackedCantil: A Malware Symphony Breakdown - PrivateLoader, Smoke, Lumma, RedLine, RisePro, Amadey, Stealc, Socks5Systemz, STOP
Amadey CrackedCantil Lumma Stealer PrivateLoader RedLine Stealer RisePro SmokeLoader Socks5 Systemz Stealc STOP
2024-01-06 ⋅ irfan_eternal ⋅ Muhammed Irfan V A
Understanding Internals of SmokeLoader
SmokeLoader
2023-11-19 ⋅ Twitter (@embee_research) ⋅ Embee_research
Combining Pivot Points to Identify Malware Infrastructure - Redline, Smokeloader and Cobalt Strike
Amadey Cobalt Strike RedLine Stealer SmokeLoader
2023-10-24 ⋅ National Security and Defense Council of Ukraine ⋅ Organization of the National Security and Defense Council of Ukraine
The Surge in SmokeLoader Attacks on Ukrainian Institutions
SmokeLoader
2023-10-12 ⋅ Cluster25 ⋅ Cluster25 Threat Intel Team
CVE-2023-38831 Exploited by Pro-Russia Hacking Groups in RU-UA Conflict Zone for Credential Harvesting Operations
Agent Tesla Crimson RAT Nanocore RAT SmokeLoader
2023-09-28 ⋅ HarfangLab ⋅ Claudio Teixeira
Loader Galore - TaskLoader at the start of a Pay-per-Install Infection Chain
CustomerLoader Fabookie LgoogLoader SmokeLoader
2023-08-23 ⋅ Logpoint ⋅ Anish Bogati, Nischal khadgi
Defending Against 8base: Uncovering Their Arsenal and Crafting Responses
8Base Phobos SmokeLoader SystemBC
2023-07-17 ⋅ Acronis ⋅ Acronis Security
8Base ransomware stays unseen for a year
8Base Phobos SmokeLoader
2023-06-28 ⋅ vmware ⋅ Bria Beathley, Dana Behling, Deborah Snyder, Fae Carlisle
8Base Ransomware: A Heavy Hitting Player
8Base Phobos SmokeLoader SystemBC
2023-06-24 ⋅ Twitter (@embee_research) ⋅ Embee_research
SmokeLoader - Malware Analysis and Decoding With Procmon
SmokeLoader
2023-02-27 ⋅ PRODAFT Threat Intelligence ⋅ PRODAFT
RIG Exploit Kit: In-Depth Analysis
Dridex IcedID ISFB PureCrypter Raccoon RecordBreaker RedLine Stealer Royal Ransom Silence SmokeLoader Zloader
2022-11-19 ⋅ Malwarology ⋅ Robert Simmons
Malicious Packer pkr_ce1a
SmokeLoader Vidar
2022-11-17 ⋅ Trellix ⋅ Trelix
Trellix Insights: SmokeLoader Exploits Old Vulnerabilities to Drop zgRAT
SmokeLoader zgRAT
2022-10-07 ⋅ YouTube (BSides Portland) ⋅ Pim Trouerbach
SmokeLoader - The Pandora's box of Tricks
SmokeLoader
2022-09-29 ⋅ Team Cymru ⋅ S2 Research Team
Seychelles, Seychelles, on the C(2) Shore: An overview of a bulletproof hosting provider named ELITETEAM.
Amadey Raccoon RedLine Stealer SmokeLoader STOP
2022-09-26 ⋅ Kaspersky ⋅ Artem Ushkov, Haim Zigel, Oleg Kupreev
NullMixer: oodles of Trojans in a single dropper
ColdStealer DanaBot GCleaner Nullmixer PrivateLoader PseudoManuscrypt RedLine Stealer SmokeLoader Vidar
2022-09-15 ⋅ Sekoia ⋅ Threat & Detection Research Team
PrivateLoader: the loader of the prevalent ruzki PPI service
Agent Tesla Coinminer DanaBot DCRat Eternity Stealer Glupteba Mars Stealer NetSupportManager RAT Nymaim Nymaim2 Phoenix Keylogger PrivateLoader Raccoon RedLine Stealer SmokeLoader Socelars STOP Vidar YTStealer
2022-08-31 ⋅ BitSight ⋅ André Tavares
Tracking PrivateLoader: Malware Distribution Service
PrivateLoader RedLine Stealer SmokeLoader
2022-08-30 ⋅ Github (vc0RExor) ⋅ vc0RExor
SmokeLoader - Quick-Analysis
SmokeLoader
2022-08-25 ⋅ OALabs ⋅ Sergei Frankoff
SmokeLoader Triage Taking a look how Smoke Loader works
SmokeLoader
2022-08-08 ⋅ Fortinet ⋅ James Slaughter
Life After Death - SmokeLoader Continues to Haunt Using Old Vulnerabilities
SmokeLoader zgRAT
2022-08-08 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader
2022-07-29 ⋅ Blackberry ⋅ BlackBerry Research & Intelligence Team
SmokeLoader Malware Used to Augment Amadey Infostealer
Amadey SmokeLoader
2022-07-27 ⋅ Darktrace ⋅ Sam Lister, Shuh Chin Goh
PrivateLoader: Network-Based Indicators of Compromise
PrivateLoader SmokeLoader
2022-07-21 ⋅ AhnLab ⋅ ASEC
Amadey Bot Being Distributed Through SmokeLoader
Amadey SmokeLoader
2022-06-21 ⋅ SonicWall ⋅ SonicWall
HTML Application Files are being used to distribute Smoke Loader Malware
SmokeLoader
2022-04-20 ⋅ CISA ⋅ CISA
Alert (AA22-110A): Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader Killnet
2022-04-20 ⋅ CISA ⋅ Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), CISA, FBI, Government Communications Security Bureau, National Crime Agency (NCA), NCSC UK, NSA
AA22-110A Joint CSA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader
2022-04-12 ⋅ AhnLab ⋅ ASEC Analysis Team
SystemBC Being Used by Various Attackers
Emotet SmokeLoader SystemBC
2022-02-18 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
New Golang botnet empties Windows users’ cryptocurrency wallets
Anubis Loader SmokeLoader
2022-02-17 ⋅ Blackberry ⋅ BlackBerry Research & Intelligence Team
Threat Thursday: Arkei Infostealer Expands Reach Using SmokeLoader to Target Crypto Wallets and MFA
Arkei Stealer SmokeLoader
2022-02-08 ⋅ Intel 471 ⋅ Intel 471
PrivateLoader: The first step in many malware schemes
Dridex Kronos LockBit Nanocore RAT NjRAT PrivateLoader Quasar RAT RedLine Stealer Remcos SmokeLoader STOP Tofsee TrickBot Vidar
2022-01-01 ⋅ Silent Push ⋅ Silent Push
Privacy tools (not) for you
SmokeLoader
2021-06-17 ⋅ Suvaditya Sur
Analysis of SmokeLoader
SmokeLoader
2021-06-10 ⋅ ZAYOTEM ⋅ Buğra KÖSE, Çağlar YÜN, Esmanur ALİCAN, Fatih YILMAZ, İrem ALKAŞİ
SmokeLoader Technical Analysis Report
SmokeLoader
2021-05-26 ⋅ DeepInstinct ⋅ Ron Ben Yizhak
A Deep Dive into Packing Software CryptOne
Cobalt Strike Dridex Emotet Gozi ISFB Mailto QakBot SmokeLoader WastedLocker Zloader
2021-05-19 ⋅ Intel 471 ⋅ Intel 471
Look how many cybercriminals love Cobalt Strike
BazarBackdoor Cobalt Strike Hancitor QakBot SmokeLoader SystemBC TrickBot
2021-04-12 ⋅ PTSecurity ⋅ PTSecurity
PaaS, or how hackers evade antivirus software
Amadey Bunitu Cerber Dridex ISFB KPOT Stealer Mailto Nemty Phobos Pony Predator The Thief QakBot Raccoon RTM SmokeLoader Zloader
2021-03-21 ⋅ Blackberry ⋅ Blackberry Research
2021 Threat Report
Bashlite FritzFrog IPStorm Mirai Tsunami elf.wellmess AppleJeus Dacls EvilQuest Manuscrypt Astaroth BazarBackdoor Cerber Cobalt Strike Emotet FinFisher RAT Kwampirs MimiKatz NjRAT Ryuk SmokeLoader TrickBot
2021-03-18 ⋅ Proofpoint ⋅ Brandon Murphy, Dennis Schwarz, Jack Mott, Proofpoint Threat Research Team
Now You See It, Now You Don’t: CopperStealer Performs Widespread Theft
CopperStealer SmokeLoader
2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-02-18 ⋅ PTSecurity ⋅ PTSecurity
https://www.ptsecurity.com/ww-en/analytics/antisandbox-techniques/
Poet RAT Gravity RAT Ketrican Okrum OopsIE Remcos RogueRobinNET RokRAT SmokeLoader
2021-02-02 ⋅ ⋅ CRONUP ⋅ Germán Fernández
De ataque con Malware a incidente de Ransomware
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DanaBot Dharma Dridex Egregor Emotet Empire Downloader FriedEx GootKit IcedID MegaCortex Nemty Phorpiex PwndLocker PyXie QakBot RansomEXX REvil Ryuk SDBbot SmokeLoader TrickBot Zloader
2021-02-01 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team
What tracking an attacker email infrastructure tells us about persistent cybercriminal operations
Dridex Emotet Makop Ransomware SmokeLoader TrickBot
2021-01-18 ⋅ Medium csis-techblog ⋅ Benoît Ancel
GCleaner — Garbage Provider Since 2019
Amadey Ficker Stealer Raccoon RedLine Stealer SmokeLoader STOP
2021-01-11 ⋅ AhnLab ⋅ ASEC Analysis Team
Smoke Loader Learns New Tricks
SmokeLoader
2021-01-09 ⋅ Marco Ramilli's Blog ⋅ Marco Ramilli
Command and Control Traffic Patterns
ostap LaZagne Agent Tesla Azorult Buer Cobalt Strike DanaBot DarkComet Dridex Emotet Formbook IcedID ISFB NetWire RC PlugX Quasar RAT SmokeLoader TrickBot
2020-12-23 ⋅ 0xC0DECAFE ⋅ Thomas Barabosch
Detect RC4 in (malicious) binaries
SmokeLoader Zloader
2020-12-21 ⋅ Cisco Talos ⋅ JON MUNSHAW
2020: The year in malware
WolfRAT Prometei Poet RAT Agent Tesla Astaroth Ave Maria CRAT Emotet Gozi IndigoDrop JhoneRAT Nanocore RAT NjRAT Oblique RAT SmokeLoader StrongPity WastedLocker Zloader
2020-12-17 ⋅ Telekom ⋅ Thomas Barabosch
Smokeloader is still alive and kickin’ – A new way to encrypt CC server URLs
SmokeLoader
2020-09-09 ⋅ Malwarebytes ⋅ Threat Intelligence Team
Malvertising campaigns come back in full swing
Raccoon SmokeLoader Malsmoke
2020-09-09 ⋅ Malwarebytes ⋅ Threat Intelligence Team
Malvertising campaigns come back in full swing
Raccoon SmokeLoader
2020-09-02 ⋅ Cisco Talos ⋅ Edmund Brumaghin, Holger Unterbrink
Salfram: Robbing the place without removing your name tag
Ave Maria ISFB SmokeLoader Zloader
2020-08-27 ⋅ Hatching.io ⋅ Pete Cowman
Smokeloader Analysis and More Family Detections
SmokeLoader
2020-06-22 ⋅ m.alvar.es ⋅ Marcos Alvares
Comparative analysis between Bindiff and Diaphora - Patched Smokeloader Study Case
SmokeLoader
2020-06-21 ⋅ N1ght-W0lf Blog ⋅ Abdallah Elshinbary
Deep Analysis of SmokeLoader
SmokeLoader
2020-06-10 ⋅ m.alvar.es ⋅ Marcos Alvares
Unpacking Smokeloader and Reconstructing PE Programatically using LIEF
SmokeLoader
2020-05-24 ⋅ Malware and Stuff ⋅ Andreas Klopsch
Examining Smokeloader’s Anti Hooking technique
SmokeLoader
2020-05-24 ⋅ Positive Technologies ⋅ PT ESC Threat Intelligence
Operation TA505: network infrastructure. Part 3.
AndroMut Buhtrap SmokeLoader
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-02-18 ⋅ Github (DanusMinimus) ⋅ Dan Lisichkin
Analyzing Modern Malware Techniques Part 4: I’m afraid of no packer(Part 1 of 2)
SmokeLoader
2019-11-21 ⋅ SentinelOne ⋅ Mario Ciccarelli
Going Deep | A Guide to Reversing Smoke Loader Malware
SmokeLoader
2019-10-31 ⋅ m.alvar.es ⋅ Marcos Alvares
Dynamic Imports and Working Around Indirect Calls - Smokeloader Study Case
SmokeLoader
2019-08-05 ⋅ security.neurolabs ⋅ Marcos Alvares
Smokeloader's Hardcoded Domains - Sneaky Third Party Vendor or Cheap Buyer?
SmokeLoader
2019-07-09 ⋅ Check Point ⋅ Israel Gubi
The 2019 Resurgence of Smokeloader
SmokeLoader
2019-05-02 ⋅ Proofpoint ⋅ Bryan Campbell, Proofpoint Threat Insight Team
2019: The Return of Retefe
Dok Retefe SmokeLoader
2018-12-19 ⋅ Palo Alto Networks Unit 42 ⋅ Kaoru Hayashi
Analysis of Smoke Loader in New Tsunami Campaign
SmokeLoader
2018-09-18 ⋅ int 0xcc blog ⋅ Raashid Bhat
A taste of our own medicine: How SmokeLoader is deceiving configuration extraction by using binary code as bait
SmokeLoader
2018-08-14 ⋅ Plug it, play it, burn it, rip it ⋅ Alberto Ortega
Anti-Hooking checks of SmokeLoader 2018
SmokeLoader
2018-07-18 ⋅ CERT.PL ⋅ Michał Praszmo
Dissecting Smoke Loader
SmokeLoader
2018-07-03 ⋅ Talos Intelligence ⋅ Ben Baker, Holger Unterbrink
Smoking Guns - Smoke Loader learned new tricks
SmokeLoader TrickBot
2018-04-16 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Smoke Loader malware improves after Microsoft spoils its Campaign
SmokeLoader
2018-04-04 ⋅ Microsoft ⋅ Microsoft Defender ATP Research Team
Hunting down Dofoil with Windows Defender ATP
SmokeLoader
2018-01-12 ⋅ Malwarebytes ⋅ Jérôme Segura
Fake Spectre and Meltdown patch pushes Smoke Loader malware
SmokeLoader
2017-08-24 ⋅ Blaze's Security Blog ⋅ BartBlaze
Crystal Finance Millennium used to spread malware
Chthonic SmokeLoader
2017-08-04 ⋅ PhishLabs ⋅ Jason Davison
Smoke Loader Adds Additional Obfuscation Methods to Mitigate Analysis
SmokeLoader
2017-04-03 ⋅ Malware Breakdown ⋅ Malware Breakdown
Shadow Server Domains Leading to RIG Exploit Kit Dropping Smoke Loader
SmokeLoader
2016-10-17 ⋅ Malwarebytes ⋅ Jérôme Segura
New-looking Sundown EK drops Smoke Loader, Kronos banker
Kronos SmokeLoader
2016-08-05 ⋅ Malwarebytes ⋅ Malwarebytes Labs
Smoke Loader – downloader with a smokescreen still alive
SmokeLoader
2014-10-05 ⋅ Eternal Todo ⋅ Jose Miguel Esparza
Dissecting SmokeLoader (or Yulia's sweet ass proposition)
SmokeLoader
Yara Rules
[TLP:WHITE] win_smokeloader_auto (20251219 | Detects win.smokeloader.)
rule win_smokeloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-01-05"
        version = "1"
        description = "Detects win.smokeloader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader"
        malpedia_rule_date = "20260105"
        malpedia_hash = "19b79e7cab4eaf532122e5b45a77dd8f6bb5cc79"
        malpedia_version = "20251219"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ff15???????? 8d45f0 50 8d45e8 50 8d45e0 50 }
            // n = 7, score = 1200
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax
            //   8d45e8               | lea                 eax, [ebp - 0x18]
            //   50                   | push                eax
            //   8d45e0               | lea                 eax, [ebp - 0x20]
            //   50                   | push                eax

        $sequence_1 = { 50 6a00 53 ff15???????? 8d45f0 50 }
            // n = 6, score = 1000
            //   50                   | push                eax
            //   6a00                 | push                0
            //   53                   | push                ebx
            //   ff15????????         |                     
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax

        $sequence_2 = { ff15???????? 8bf0 8d45dc 50 6a00 53 }
            // n = 6, score = 1000
            //   ff15????????         |                     
            //   8bf0                 | mov                 esi, eax
            //   8d45dc               | lea                 eax, [ebp - 0x24]
            //   50                   | push                eax
            //   6a00                 | push                0
            //   53                   | push                ebx

        $sequence_3 = { 57 ff15???????? 6a00 6800000002 6a03 }
            // n = 5, score = 1000
            //   57                   | push                edi
            //   ff15????????         |                     
            //   6a00                 | push                0
            //   6800000002           | push                0x2000000
            //   6a03                 | push                3

        $sequence_4 = { 50 8d45e0 50 56 ff15???????? 56 ff15???????? }
            // n = 7, score = 1000
            //   50                   | push                eax
            //   8d45e0               | lea                 eax, [ebp - 0x20]
            //   50                   | push                eax
            //   56                   | push                esi
            //   ff15????????         |                     
            //   56                   | push                esi
            //   ff15????????         |                     

        $sequence_5 = { 740a 83c104 83f920 72f0 }
            // n = 4, score = 900
            //   740a                 | push                esi
            //   83c104               | push                esi
            //   83f920               | lea                 eax, [ebp - 4]
            //   72f0                 | push                eax

        $sequence_6 = { e8???????? 8bf0 8d45fc 50 ff75fc 56 6a19 }
            // n = 7, score = 900
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   8d45fc               | lea                 eax, [ebp - 4]
            //   50                   | push                eax
            //   ff75fc               | push                dword ptr [ebp - 4]
            //   56                   | push                esi
            //   6a19                 | push                0x19

        $sequence_7 = { 0fb64405dc 50 8d45ec 50 }
            // n = 4, score = 900
            //   0fb64405dc           | lea                 eax, [ebp - 4]
            //   50                   | push                eax
            //   8d45ec               | push                edi
            //   50                   | push                edi

        $sequence_8 = { 50 56 681f000f00 57 }
            // n = 4, score = 900
            //   50                   | push                eax
            //   56                   | push                esi
            //   681f000f00           | push                0xf001f
            //   57                   | push                edi

        $sequence_9 = { ff15???????? bf90010000 8bcf e8???????? }
            // n = 4, score = 900
            //   ff15????????         |                     
            //   bf90010000           | mov                 edi, 0x190
            //   8bcf                 | mov                 ecx, edi
            //   e8????????           |                     

        $sequence_10 = { 56 8d45fc 50 57 57 6a19 ff75f8 }
            // n = 7, score = 900
            //   56                   | je                  0xb
            //   8d45fc               | push                eax
            //   50                   | push                edi
            //   57                   | inc                 ebx
            //   57                   | lea                 eax, [ebp - 0x10]
            //   6a19                 | push                eax
            //   ff75f8               | lea                 eax, [ebp - 0x18]

        $sequence_11 = { 6800a00f00 50 a3???????? ff15???????? }
            // n = 4, score = 800
            //   6800a00f00           | lea                 eax, [ebp - 0x14]
            //   50                   | push                eax
            //   a3????????           |                     
            //   ff15????????         |                     

        $sequence_12 = { 7507 33c0 e9???????? e8???????? b904010000 }
            // n = 5, score = 800
            //   7507                 | jne                 9
            //   33c0                 | xor                 eax, eax
            //   e9????????           |                     
            //   e8????????           |                     
            //   b904010000           | mov                 ecx, 0x104

        $sequence_13 = { 668ce8 6685c0 7406 fe05???????? }
            // n = 4, score = 800
            //   668ce8               | lea                 eax, [ebp - 0x24]
            //   6685c0               | push                eax
            //   7406                 | push                0
            //   fe05????????         |                     

        $sequence_14 = { 56 ff15???????? 50 56 6a00 ff15???????? }
            // n = 6, score = 700
            //   56                   | push                ebx
            //   ff15????????         |                     
            //   50                   | lea                 eax, [ebp - 0x10]
            //   56                   | push                0
            //   6a00                 | push                ebx
            //   ff15????????         |                     

        $sequence_15 = { 8b07 03c3 50 ff15???????? }
            // n = 4, score = 700
            //   8b07                 | lea                 eax, [ebp - 0x10]
            //   03c3                 | push                eax
            //   50                   | lea                 eax, [ebp - 0x18]
            //   ff15????????         |                     

        $sequence_16 = { 03c8 81e1ff000000 8a440c18 30042b 43 3b9c241c010000 }
            // n = 6, score = 700
            //   03c8                 | push                dword ptr [ebp - 4]
            //   81e1ff000000         | push                esi
            //   8a440c18             | push                0x19
            //   30042b               | mov                 esi, eax
            //   43                   | lea                 eax, [ebp - 4]
            //   3b9c241c010000       | push                eax

        $sequence_17 = { 8bc3 c745ec25303258 885df0 8945fc }
            // n = 4, score = 700
            //   8bc3                 | push                dword ptr [ebp - 8]
            //   c745ec25303258       | mov                 esi, eax
            //   885df0               | lea                 eax, [ebp - 4]
            //   8945fc               | push                eax

        $sequence_18 = { ffb43108010000 8b84310c010000 03c7 50 8b843104010000 03c5 }
            // n = 6, score = 700
            //   ffb43108010000       | push                dword ptr [ebp - 4]
            //   8b84310c010000       | push                esi
            //   03c7                 | je                  0xc
            //   50                   | add                 ecx, 4
            //   8b843104010000       | cmp                 ecx, 0x20
            //   03c5                 | jb                  0xfffffff5

        $sequence_19 = { 50 53 e8???????? 8d8decfdffff 8d95f0fdffff c70200000000 6800800000 }
            // n = 7, score = 500
            //   50                   | push                eax
            //   53                   | push                ebx
            //   e8????????           |                     
            //   8d8decfdffff         | lea                 ecx, [ebp - 0x214]
            //   8d95f0fdffff         | lea                 edx, [ebp - 0x210]
            //   c70200000000         | mov                 dword ptr [edx], 0
            //   6800800000           | push                0x8000

        $sequence_20 = { 8db5f8fdffff c60653 56 6a00 }
            // n = 4, score = 500
            //   8db5f8fdffff         | lea                 esi, [ebp - 0x208]
            //   c60653               | mov                 byte ptr [esi], 0x53
            //   56                   | push                esi
            //   6a00                 | push                0

        $sequence_21 = { 8985ecfdffff ffb5f0fdffff 50 53 }
            // n = 4, score = 500
            //   8985ecfdffff         | mov                 dword ptr [ebp - 0x214], eax
            //   ffb5f0fdffff         | push                dword ptr [ebp - 0x210]
            //   50                   | push                eax
            //   53                   | push                ebx

        $sequence_22 = { 8d85f0fdffff 8b750c 8b7d10 50 57 56 }
            // n = 6, score = 500
            //   8d85f0fdffff         | lea                 eax, [ebp - 0x210]
            //   8b750c               | mov                 esi, dword ptr [ebp + 0xc]
            //   8b7d10               | mov                 edi, dword ptr [ebp + 0x10]
            //   50                   | push                eax
            //   57                   | push                edi
            //   56                   | push                esi

        $sequence_23 = { 89c6 6804010000 56 57 }
            // n = 4, score = 500
            //   89c6                 | mov                 esi, eax
            //   6804010000           | push                0x104
            //   56                   | push                esi
            //   57                   | push                edi

        $sequence_24 = { 31c0 66894603 8d8de8fdffff 50 50 }
            // n = 5, score = 500
            //   31c0                 | xor                 eax, eax
            //   66894603             | mov                 word ptr [esi + 3], ax
            //   8d8de8fdffff         | lea                 ecx, [ebp - 0x218]
            //   50                   | push                eax
            //   50                   | push                eax

        $sequence_25 = { 50 50 50 51 50 50 56 }
            // n = 7, score = 500
            //   50                   | push                eax
            //   50                   | push                eax
            //   50                   | push                eax
            //   51                   | push                ecx
            //   50                   | push                eax
            //   50                   | push                eax
            //   56                   | push                esi

        $sequence_26 = { e8???????? 2500300038 005800 2500300038 }
            // n = 4, score = 500
            //   e8????????           |                     
            //   2500300038           | and                 eax, 0x38003000
            //   005800               | add                 byte ptr [eax], bl
            //   2500300038           | and                 eax, 0x38003000

        $sequence_27 = { fc 5f 5e 5b }
            // n = 4, score = 400
            //   fc                   | mov                 edi, dword ptr [ebp + 0x10]
            //   5f                   | push                eax
            //   5e                   | push                edi
            //   5b                   | push                esi

        $sequence_28 = { 89c6 89cf fc b280 31db a4 }
            // n = 6, score = 400
            //   89c6                 | inc                 ecx
            //   89cf                 | mov                 edi, dword ptr [ebx + 0x1c]
            //   fc                   | xor                 eax, eax
            //   b280                 | lodsb               al, byte ptr [esi]
            //   31db                 | add                 edx, eax
            //   a4                   | test                eax, eax

        $sequence_29 = { 30d0 aa e2f3 7505 }
            // n = 4, score = 400
            //   30d0                 | xor                 al, dl
            //   aa                   | stosb               byte ptr es:[edi], al
            //   e2f3                 | loop                0xfffffff5
            //   7505                 | jne                 7

        $sequence_30 = { 89e5 81ec5c060000 53 56 }
            // n = 4, score = 400
            //   89e5                 | mov                 ebp, esp
            //   81ec5c060000         | sub                 esp, 0x65c
            //   53                   | push                ebx
            //   56                   | push                esi

        $sequence_31 = { 01c2 31c0 ac 01c2 }
            // n = 4, score = 300
            //   01c2                 | add                 edx, eax
            //   31c0                 | xor                 eax, eax
            //   ac                   | lodsb               al, byte ptr [esi]
            //   01c2                 | add                 edx, eax

        $sequence_32 = { e8???????? 41b919000200 4533c0 4c8bf0 488d4540 }
            // n = 5, score = 300
            //   e8????????           |                     
            //   41b919000200         | dec                 eax
            //   4533c0               | mov                 ebp, esp
            //   4c8bf0               | dec                 eax
            //   488d4540             | sub                 esp, 0x60

        $sequence_33 = { 4c8d4580 488b01 33d2 ff5060 }
            // n = 4, score = 300
            //   4c8d4580             | dec                 eax
            //   488b01               | mov                 edi, ecx
            //   33d2                 | inc                 ecx
            //   ff5060               | mov                 ecx, 0x20019

        $sequence_34 = { 48895c2418 48897c2420 89542410 55 488bec 4883ec60 488bf9 }
            // n = 7, score = 300
            //   48895c2418           | je                  0x25
            //   48897c2420           | dec                 eax
            //   89542410             | mov                 dword ptr [esp + 0x18], ebx
            //   55                   | dec                 eax
            //   488bec               | mov                 dword ptr [esp + 0x20], edi
            //   4883ec60             | mov                 dword ptr [esp + 0x10], edx
            //   488bf9               | push                ebp

        $sequence_35 = { 8b7b24 4c 01c7 668b0c4f 41 8b7b1c 4c }
            // n = 7, score = 300
            //   8b7b24               | mov                 edi, dword ptr [ebx + 0x24]
            //   4c                   | dec                 esp
            //   01c7                 | add                 edi, eax
            //   668b0c4f             | mov                 cx, word ptr [edi + ecx*2]
            //   41                   | inc                 ecx
            //   8b7b1c               | mov                 edi, dword ptr [ebx + 0x1c]
            //   4c                   | dec                 esp

        $sequence_36 = { ac 01c2 85c0 75f0 }
            // n = 4, score = 300
            //   ac                   | lodsb               al, byte ptr [esi]
            //   01c2                 | add                 edx, eax
            //   85c0                 | test                eax, eax
            //   75f0                 | jne                 0xfffffff2

        $sequence_37 = { 4885c0 7428 80383c 7423 }
            // n = 4, score = 300
            //   4885c0               | dec                 eax
            //   7428                 | test                eax, eax
            //   80383c               | je                  0x2a
            //   7423                 | cmp                 byte ptr [eax], 0x3c

        $sequence_38 = { 55 89e5 81ec54040000 53 }
            // n = 4, score = 300
            //   55                   | push                eax
            //   89e5                 | push                eax
            //   81ec54040000         | mov                 edi, dword ptr [ebp + 0x10]
            //   53                   | push                eax

        $sequence_39 = { 4f 8d1c10 41 8b4b18 45 8b6320 4d }
            // n = 7, score = 300
            //   4f                   | dec                 edi
            //   8d1c10               | lea                 ebx, [eax + edx]
            //   41                   | inc                 ecx
            //   8b4b18               | mov                 ecx, dword ptr [ebx + 0x18]
            //   45                   | inc                 ebp
            //   8b6320               | mov                 esp, dword ptr [ebx + 0x20]
            //   4d                   | dec                 ebp

        $sequence_40 = { eb08 4863433c 8b7c1828 488bcb e8???????? 4863d7 498bcc }
            // n = 7, score = 300
            //   eb08                 | inc                 ebp
            //   4863433c             | xor                 eax, eax
            //   8b7c1828             | dec                 esp
            //   488bcb               | mov                 esi, eax
            //   e8????????           |                     
            //   4863d7               | dec                 eax
            //   498bcc               | lea                 eax, [ebp + 0x40]

        $sequence_41 = { 4c 01c7 8b048f 4c }
            // n = 4, score = 300
            //   4c                   | dec                 esp
            //   01c7                 | add                 edi, eax
            //   8b048f               | mov                 eax, dword ptr [edi + ecx*4]
            //   4c                   | dec                 esp

        $sequence_42 = { 8b6320 4d 01c4 ffc9 49 8d3c8c }
            // n = 6, score = 300
            //   8b6320               | mov                 esp, dword ptr [ebx + 0x20]
            //   4d                   | dec                 ebp
            //   01c4                 | add                 esp, eax
            //   ffc9                 | dec                 ecx
            //   49                   | dec                 ecx
            //   8d3c8c               | lea                 edi, [esp + ecx*4]

        $sequence_43 = { 8b957cffffff 895164 6814318b23 8b45e4 50 }
            // n = 5, score = 200
            //   8b957cffffff         | test                eax, eax
            //   895164               | jne                 0xffffff8e
            //   6814318b23           | mov                 edx, dword ptr [ebp - 4]
            //   8b45e4               | imul                ecx, ecx, 0x63
            //   50                   | mov                 eax, dword ptr [ebp + 8]

        $sequence_44 = { 895118 8b4584 8b4db8 89481c 8b5584 8b45b4 }
            // n = 6, score = 200
            //   895118               | mov                 eax, dword ptr [ebp - 0x1c]
            //   8b4584               | push                eax
            //   8b4db8               | mov                 eax, dword ptr [ebp - 0x1c]
            //   89481c               | push                eax
            //   8b5584               | mov                 dword ptr [ebp - 0x64], eax
            //   8b45b4               | mov                 ecx, dword ptr [ebp - 0x60]

        $sequence_45 = { 688dbdc13f 8b45e4 50 e8???????? 8945d8 8b4da0 }
            // n = 6, score = 200
            //   688dbdc13f           | xor                 edx, edx
            //   8b45e4               | call                dword ptr [eax + 0x60]
            //   50                   | jmp                 0xa
            //   e8????????           |                     
            //   8945d8               | dec                 eax
            //   8b4da0               | arpl                word ptr [ebx + 0x3c], ax

        $sequence_46 = { 56 57 007508 bbb84340c1 4a }
            // n = 5, score = 200
            //   56                   | mov                 edi, ecx
            //   57                   | cld                 
            //   007508               | mov                 edi, ecx
            //   bbb84340c1           | cld                 
            //   4a                   | mov                 dl, 0x80

        $sequence_47 = { 50 8b4dfc 51 e8???????? 85c0 7589 8b55fc }
            // n = 7, score = 200
            //   50                   | mov                 edi, dword ptr [eax + ebx + 0x28]
            //   8b4dfc               | dec                 eax
            //   51                   | mov                 ecx, ebx
            //   e8????????           |                     
            //   85c0                 | dec                 eax
            //   7589                 | arpl                di, dx
            //   8b55fc               | dec                 ecx

        $sequence_48 = { c1e002 03471c 8b0428 01e8 5e c3 }
            // n = 6, score = 200
            //   c1e002               | push                edi
            //   03471c               | add                 byte ptr [ebp + 8], dh
            //   8b0428               | mov                 ebx, 0xc14043b8
            //   01e8                 | inc                 eax
            //   5e                   | cmp                 byte ptr [eax], 0
            //   c3                   | jne                 0xfffffffa

        $sequence_49 = { 56 89c2 8b453c 8b7c2878 }
            // n = 4, score = 200
            //   56                   | mov                 bl, 2
            //   89c2                 | mov                 esi, eax
            //   8b453c               | mov                 edi, ecx
            //   8b7c2878             | cld                 

        $sequence_50 = { aa e2f3 7506 7404 }
            // n = 4, score = 200
            //   aa                   | mov                 ebp, esp
            //   e2f3                 | sub                 esp, 0x454
            //   7506                 | push                ebx
            //   7404                 | xor                 al, dl

        $sequence_51 = { 894ddc c745e000000000 8b55e4 3b55dc 0f8327010000 c745e801000000 }
            // n = 6, score = 200
            //   894ddc               | push                eax
            //   c745e000000000       | mov                 dword ptr [ebp - 0x28], eax
            //   8b55e4               | mov                 ecx, dword ptr [ebp - 0x60]
            //   3b55dc               | push                eax
            //   0f8327010000         | mov                 ecx, dword ptr [ebp - 4]
            //   c745e801000000       | push                ecx

        $sequence_52 = { 5b c9 c20800 55 89e5 83ec04 }
            // n = 6, score = 200
            //   5b                   | sub                 esp, 0x454
            //   c9                   | push                ebx
            //   c20800               | push                esi
            //   55                   | ret                 0x10
            //   89e5                 | push                ebp
            //   83ec04               | mov                 ebp, esp

        $sequence_53 = { 8945cc 8b4da0 8b55cc 895144 68d770a437 }
            // n = 5, score = 200
            //   8945cc               | lea                 eax, [eax + 8]
            //   8b4da0               | dec                 eax
            //   8b55cc               | sub                 edx, 8
            //   895144               | push                0x3fc1bd8d
            //   68d770a437           | mov                 eax, dword ptr [ebp - 0x1c]

        $sequence_54 = { 58 29c6 d1ee 037724 0fb7442efe c1e002 03471c }
            // n = 7, score = 200
            //   58                   | push                esi
            //   29c6                 | lodsd               eax, dword ptr [esi]
            //   d1ee                 | add                 eax, ebp
            //   037724               | push                esi
            //   0fb7442efe           | mov                 edx, eax
            //   c1e002               | mov                 eax, dword ptr [ebp + 0x3c]
            //   03471c               | mov                 edi, dword ptr [eax + ebp + 0x78]

        $sequence_55 = { c1c108 3208 40 803800 75f5 31d1 }
            // n = 6, score = 200
            //   c1c108               | pop                 eax
            //   3208                 | sub                 esi, eax
            //   40                   | shr                 esi, 1
            //   803800               | add                 esi, dword ptr [edi + 0x24]
            //   75f5                 | movzx               eax, word ptr [esi + ebp - 2]
            //   31d1                 | shl                 eax, 2

        $sequence_56 = { 6bc963 8b4508 33d2 f7f1 }
            // n = 4, score = 200
            //   6bc963               | mov                 ecx, esp
            //   8b4508               | mov                 edx, dword ptr [eax + 4]
            //   33d2                 | mov                 ecx, dword ptr [eax]
            //   f7f1                 | dec                 esp

        $sequence_57 = { 8946fc ad 85c0 75f3 c3 56 }
            // n = 6, score = 200
            //   8946fc               | mov                 dl, 0x80
            //   ad                   | xor                 ebx, ebx
            //   85c0                 | movsb               byte ptr es:[edi], byte ptr [esi]
            //   75f3                 | mov                 bl, 2
            //   c3                   | push                esi
            //   56                   | push                edi

        $sequence_58 = { 8b45e4 50 e8???????? 89459c 8b4da0 8b559c 895158 }
            // n = 7, score = 200
            //   8b45e4               | xor                 edx, edx
            //   50                   | div                 ecx
            //   e8????????           |                     
            //   89459c               | mov                 dword ptr [ebp - 0x34], eax
            //   8b4da0               | mov                 ecx, dword ptr [ebp - 0x60]
            //   8b559c               | mov                 edx, dword ptr [ebp - 0x34]
            //   895158               | mov                 dword ptr [ecx + 0x44], edx

        $sequence_59 = { 8b7c2878 01ef 8b7720 01ee 56 ad 01e8 }
            // n = 7, score = 200
            //   8b7c2878             | xor                 ebx, ebx
            //   01ef                 | movsb               byte ptr es:[edi], byte ptr [esi]
            //   8b7720               | mov                 edi, ecx
            //   01ee                 | cld                 
            //   56                   | mov                 dl, 0x80
            //   ad                   | xor                 ebx, ebx
            //   01e8                 | movsb               byte ptr es:[edi], byte ptr [esi]

        $sequence_60 = { 5d 5d 2e3f 3438 }
            // n = 4, score = 100
            //   5d                   | pop                 esp
            //   5d                   | salc                
            //   2e3f                 | sub                 byte ptr [ecx - 0x2a], dl
            //   3438                 | pop                 ebp

        $sequence_61 = { 9d d418 a1???????? 0da20e09d8 }
            // n = 4, score = 100
            //   9d                   | jne                 0xa
            //   d418                 | stosb               byte ptr es:[edi], al
            //   a1????????           |                     
            //   0da20e09d8           | loop                0xfffffff5

        $sequence_62 = { b0b6 49 92 06 4e 55 }
            // n = 6, score = 100
            //   b0b6                 | jne                 0xa
            //   49                   | je                  0xa
            //   92                   | add                 byte ptr [ebp + 0x6c], dl
            //   06                   | popfd               
            //   4e                   | aam                 0x18
            //   55                   | test                eax, 0xd44910d6

        $sequence_63 = { 00556c 9d d418 a9d61049d4 5c d6 2851d6 }
            // n = 7, score = 100
            //   00556c               | stosb               byte ptr es:[edi], al
            //   9d                   | loop                0xfffffff5
            //   d418                 | jne                 0xa
            //   a9d61049d4           | je                  0xa
            //   5c                   | pop                 ebx
            //   d6                   | leave               
            //   2851d6               | ret                 8

        $sequence_64 = { 5d 5d 5d 5d 285b29 59 }
            // n = 6, score = 100
            //   5d                   | push                ebp
            //   5d                   | mov                 ebp, esp
            //   5d                   | sub                 esp, 4
            //   5d                   | xor                 al, dl
            //   285b29               | stosb               byte ptr es:[edi], al
            //   59                   | loop                0xfffffff5

    condition:
        7 of them and filesize < 245760
}
Download all Yara Rules