A downloader trojan with some infostealer capabilities focused on the browser. Previously observed as part of RigEK campaigns.
rule win_snatch_loader_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-07-11" version = "1" description = "Detects win.snatch_loader." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.snatch_loader" malpedia_rule_date = "20230705" malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41" malpedia_version = "20230715" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 740b 42 0fb7c2 6639744102 75f5 8d045502000000 894df8 } // n = 7, score = 600 // 740b | je 0xd // 42 | inc edx // 0fb7c2 | movzx eax, dx // 6639744102 | cmp word ptr [ecx + eax*2 + 2], si // 75f5 | jne 0xfffffff7 // 8d045502000000 | lea eax, [edx*2 + 2] // 894df8 | mov dword ptr [ebp - 8], ecx $sequence_1 = { 33db bfe71edec0 895dfc e8???????? 8bf0 85f6 744b } // n = 7, score = 600 // 33db | xor ebx, ebx // bfe71edec0 | mov edi, 0xc0de1ee7 // 895dfc | mov dword ptr [ebp - 4], ebx // e8???????? | // 8bf0 | mov esi, eax // 85f6 | test esi, esi // 744b | je 0x4d $sequence_2 = { 5f 85c0 7509 8bce e8???????? } // n = 5, score = 600 // 5f | pop edi // 85c0 | test eax, eax // 7509 | jne 0xb // 8bce | mov ecx, esi // e8???????? | $sequence_3 = { 33f6 8bd6 8975fc 66397102 740b 42 } // n = 6, score = 600 // 33f6 | xor esi, esi // 8bd6 | mov edx, esi // 8975fc | mov dword ptr [ebp - 4], esi // 66397102 | cmp word ptr [ecx + 2], si // 740b | je 0xd // 42 | inc edx $sequence_4 = { 53 6a08 57 ffd0 8bf0 5f } // n = 6, score = 600 // 53 | push ebx // 6a08 | push 8 // 57 | push edi // ffd0 | call eax // 8bf0 | mov esi, eax // 5f | pop edi $sequence_5 = { 53 56 ffd0 85c0 8bce 0f457dfc e8???????? } // n = 7, score = 600 // 53 | push ebx // 56 | push esi // ffd0 | call eax // 85c0 | test eax, eax // 8bce | mov ecx, esi // 0f457dfc | cmovne edi, dword ptr [ebp - 4] // e8???????? | $sequence_6 = { 0f457dfc e8???????? 8bc7 5f } // n = 4, score = 600 // 0f457dfc | cmovne edi, dword ptr [ebp - 4] // e8???????? | // 8bc7 | mov eax, edi // 5f | pop edi $sequence_7 = { 668945f6 a1???????? 85c0 7522 33c9 41 } // n = 6, score = 600 // 668945f6 | mov word ptr [ebp - 0xa], ax // a1???????? | // 85c0 | test eax, eax // 7522 | jne 0x24 // 33c9 | xor ecx, ecx // 41 | inc ecx $sequence_8 = { 42 46 3bf3 76d8 33c0 48 } // n = 6, score = 500 // 42 | inc edx // 46 | inc esi // 3bf3 | cmp esi, ebx // 76d8 | jbe 0xffffffda // 33c0 | xor eax, eax // 48 | dec eax $sequence_9 = { 7702 0c20 c1c210 32d0 } // n = 4, score = 500 // 7702 | ja 4 // 0c20 | or al, 0x20 // c1c210 | rol edx, 0x10 // 32d0 | xor dl, al $sequence_10 = { 56 57 51 52 ff750c e8???????? 8945fc } // n = 7, score = 500 // 56 | push esi // 57 | push edi // 51 | push ecx // 52 | push edx // ff750c | push dword ptr [ebp + 0xc] // e8???????? | // 8945fc | mov dword ptr [ebp - 4], eax $sequence_11 = { 0ac0 741f 3a0439 7514 41 3b4df8 72ee } // n = 7, score = 500 // 0ac0 | or al, al // 741f | je 0x21 // 3a0439 | cmp al, byte ptr [ecx + edi] // 7514 | jne 0x16 // 41 | inc ecx // 3b4df8 | cmp ecx, dword ptr [ebp - 8] // 72ee | jb 0xfffffff0 $sequence_12 = { 773b 8b750c 8b7d10 037508 8bde 035dfc } // n = 6, score = 500 // 773b | ja 0x3d // 8b750c | mov esi, dword ptr [ebp + 0xc] // 8b7d10 | mov edi, dword ptr [ebp + 0x10] // 037508 | add esi, dword ptr [ebp + 8] // 8bde | mov ebx, esi // 035dfc | add ebx, dword ptr [ebp - 4] $sequence_13 = { 8b36 56 8b33 33c0 } // n = 4, score = 500 // 8b36 | mov esi, dword ptr [esi] // 56 | push esi // 8b33 | mov esi, dword ptr [ebx] // 33c0 | xor eax, eax $sequence_14 = { 5a 59 5f 5e 5b c9 c20c00 } // n = 7, score = 500 // 5a | pop edx // 59 | pop ecx // 5f | pop edi // 5e | pop esi // 5b | pop ebx // c9 | leave // c20c00 | ret 0xc $sequence_15 = { 734f ff7510 e8???????? 8945f8 0bc0 7440 } // n = 6, score = 500 // 734f | jae 0x51 // ff7510 | push dword ptr [ebp + 0x10] // e8???????? | // 8945f8 | mov dword ptr [ebp - 8], eax // 0bc0 | or eax, eax // 7440 | je 0x42 condition: 7 of them and filesize < 262144 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY