There is no description at this point.
rule win_smominru_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.smominru." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smominru" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 0f8422febb7b 8b5f14 c1eb1a f7d3 83e301 } // n = 5, score = 100 // 0f8422febb7b | je 0x7bbbfe28 // 8b5f14 | mov ebx, dword ptr [edi + 0x14] // c1eb1a | shr ebx, 0x1a // f7d3 | not ebx // 83e301 | and ebx, 1 $sequence_1 = { 0fb7f9 8a4807 80f905 0f84694ac17b f6c140 } // n = 5, score = 100 // 0fb7f9 | movzx edi, cx // 8a4807 | mov cl, byte ptr [eax + 7] // 80f905 | cmp cl, 5 // 0f84694ac17b | je 0x7bc14a6f // f6c140 | test cl, 0x40 $sequence_2 = { 50 6a00 ffd7 8bd8 85db 0f8c21f7b07b 0fbe75f4 } // n = 7, score = 100 // 50 | push eax // 6a00 | push 0 // ffd7 | call edi // 8bd8 | mov ebx, eax // 85db | test ebx, ebx // 0f8c21f7b07b | jl 0x7bb0f727 // 0fbe75f4 | movsx esi, byte ptr [ebp - 0xc] $sequence_3 = { 8b8d48ffffff 03ca 898574ffffff 8b8544ffffff } // n = 4, score = 100 // 8b8d48ffffff | mov ecx, dword ptr [ebp - 0xb8] // 03ca | add ecx, edx // 898574ffffff | mov dword ptr [ebp - 0x8c], eax // 8b8544ffffff | mov eax, dword ptr [ebp - 0xbc] $sequence_4 = { ff7514 ff7510 50 56 ff15???????? 85c0 } // n = 6, score = 100 // ff7514 | push dword ptr [ebp + 0x14] // ff7510 | push dword ptr [ebp + 0x10] // 50 | push eax // 56 | push esi // ff15???????? | // 85c0 | test eax, eax $sequence_5 = { 85c0 0f8c05e5c07b 8a45fc 241f b120 } // n = 5, score = 100 // 85c0 | test eax, eax // 0f8c05e5c07b | jl 0x7bc0e50b // 8a45fc | mov al, byte ptr [ebp - 4] // 241f | and al, 0x1f // b120 | mov cl, 0x20 $sequence_6 = { 8b8d44feffff 85c9 7c1e 8b8540feffff } // n = 4, score = 100 // 8b8d44feffff | mov ecx, dword ptr [ebp - 0x1bc] // 85c9 | test ecx, ecx // 7c1e | jl 0x20 // 8b8540feffff | mov eax, dword ptr [ebp - 0x1c0] $sequence_7 = { 8b8d48ffffff 03cb 894584 8b8544ffffff } // n = 4, score = 100 // 8b8d48ffffff | mov ecx, dword ptr [ebp - 0xb8] // 03cb | add ecx, ebx // 894584 | mov dword ptr [ebp - 0x7c], eax // 8b8544ffffff | mov eax, dword ptr [ebp - 0xbc] $sequence_8 = { 8b8d44ffffff 8b03 ba???????? e8???????? } // n = 4, score = 100 // 8b8d44ffffff | mov ecx, dword ptr [ebp - 0xbc] // 8b03 | mov eax, dword ptr [ebx] // ba???????? | // e8???????? | $sequence_9 = { 5d c20400 57 5f 55 54 } // n = 6, score = 100 // 5d | pop ebp // c20400 | ret 4 // 57 | push edi // 5f | pop edi // 55 | push ebp // 54 | push esp $sequence_10 = { 8b8d48ffffff 03cb 8985e8feffff 8b8544ffffff } // n = 4, score = 100 // 8b8d48ffffff | mov ecx, dword ptr [ebp - 0xb8] // 03cb | add ecx, ebx // 8985e8feffff | mov dword ptr [ebp - 0x118], eax // 8b8544ffffff | mov eax, dword ptr [ebp - 0xbc] $sequence_11 = { 8b8d48fdffff 8d41ff 83f80b 77ba } // n = 4, score = 100 // 8b8d48fdffff | mov ecx, dword ptr [ebp - 0x2b8] // 8d41ff | lea eax, [ecx - 1] // 83f80b | cmp eax, 0xb // 77ba | ja 0xffffffbc $sequence_12 = { 8b8d48fdffff 338dfcfdffff 894350 8b8544fdffff } // n = 4, score = 100 // 8b8d48fdffff | mov ecx, dword ptr [ebp - 0x2b8] // 338dfcfdffff | xor ecx, dword ptr [ebp - 0x204] // 894350 | mov dword ptr [ebx + 0x50], eax // 8b8544fdffff | mov eax, dword ptr [ebp - 0x2bc] $sequence_13 = { 55 54 5d 8b4508 85c0 0f84f4e3a87b } // n = 6, score = 100 // 55 | push ebp // 54 | push esp // 5d | pop ebp // 8b4508 | mov eax, dword ptr [ebp + 8] // 85c0 | test eax, eax // 0f84f4e3a87b | je 0x7ba8e3fa $sequence_14 = { 50 e8???????? c745fcfeffffff e8???????? 0fb7461c } // n = 5, score = 100 // 50 | push eax // e8???????? | // c745fcfeffffff | mov dword ptr [ebp - 4], 0xfffffffe // e8???????? | // 0fb7461c | movzx eax, word ptr [esi + 0x1c] $sequence_15 = { 8b8d40ffffff 8b9d74ffffff 8bb564ffffff c1c210 03ca } // n = 5, score = 100 // 8b8d40ffffff | mov ecx, dword ptr [ebp - 0xc0] // 8b9d74ffffff | mov ebx, dword ptr [ebp - 0x8c] // 8bb564ffffff | mov esi, dword ptr [ebp - 0x9c] // c1c210 | rol edx, 0x10 // 03ca | add ecx, edx condition: 7 of them and filesize < 8167424 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY