There is no description at this point.
There are currently no references.
rule win_tandfuy_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.tandfuy." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.tandfuy" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 52 8b942458010000 25ff000000 81e1ff000000 50 } // n = 5, score = 100 // 52 | push edx // 8b942458010000 | mov edx, dword ptr [esp + 0x158] // 25ff000000 | and eax, 0xff // 81e1ff000000 | and ecx, 0xff // 50 | push eax $sequence_1 = { f68221eb6e0004 7403 40 ff01 ff01 40 e9???????? } // n = 7, score = 100 // f68221eb6e0004 | test byte ptr [edx + 0x6eeb21], 4 // 7403 | je 5 // 40 | inc eax // ff01 | inc dword ptr [ecx] // ff01 | inc dword ptr [ecx] // 40 | inc eax // e9???????? | $sequence_2 = { e8???????? 83c404 85c0 0f8440010000 b93e000000 33c0 8dbdd8f9ffff } // n = 7, score = 100 // e8???????? | // 83c404 | add esp, 4 // 85c0 | test eax, eax // 0f8440010000 | je 0x146 // b93e000000 | mov ecx, 0x3e // 33c0 | xor eax, eax // 8dbdd8f9ffff | lea edi, [ebp - 0x628] $sequence_3 = { 8bec 8b4508 ff3485a0d66e00 ff15???????? 5d c3 55 } // n = 7, score = 100 // 8bec | mov ebp, esp // 8b4508 | mov eax, dword ptr [ebp + 8] // ff3485a0d66e00 | push dword ptr [eax*4 + 0x6ed6a0] // ff15???????? | // 5d | pop ebp // c3 | ret // 55 | push ebp $sequence_4 = { 6a00 51 6a02 52 56 ff15???????? 56 } // n = 7, score = 100 // 6a00 | push 0 // 51 | push ecx // 6a02 | push 2 // 52 | push edx // 56 | push esi // ff15???????? | // 56 | push esi $sequence_5 = { 52 33c9 8a4801 51 33d2 8a10 } // n = 6, score = 100 // 52 | push edx // 33c9 | xor ecx, ecx // 8a4801 | mov cl, byte ptr [eax + 1] // 51 | push ecx // 33d2 | xor edx, edx // 8a10 | mov dl, byte ptr [eax] $sequence_6 = { f3ab 8dbc2474020000 83c9ff f2ae f7d1 2bf9 8bc1 } // n = 7, score = 100 // f3ab | rep stosd dword ptr es:[edi], eax // 8dbc2474020000 | lea edi, [esp + 0x274] // 83c9ff | or ecx, 0xffffffff // f2ae | repne scasb al, byte ptr es:[edi] // f7d1 | not ecx // 2bf9 | sub edi, ecx // 8bc1 | mov eax, ecx $sequence_7 = { 7562 b8???????? 81c49c000000 c3 83f806 7551 } // n = 6, score = 100 // 7562 | jne 0x64 // b8???????? | // 81c49c000000 | add esp, 0x9c // c3 | ret // 83f806 | cmp eax, 6 // 7551 | jne 0x53 $sequence_8 = { 8d95e8feffff 8b7d08 83c9ff 33c0 f2ae f7d1 } // n = 6, score = 100 // 8d95e8feffff | lea edx, [ebp - 0x118] // 8b7d08 | mov edi, dword ptr [ebp + 8] // 83c9ff | or ecx, 0xffffffff // 33c0 | xor eax, eax // f2ae | repne scasb al, byte ptr es:[edi] // f7d1 | not ecx $sequence_9 = { 6800000080 56 f3ab ff15???????? 8bd8 } // n = 5, score = 100 // 6800000080 | push 0x80000000 // 56 | push esi // f3ab | rep stosd dword ptr es:[edi], eax // ff15???????? | // 8bd8 | mov ebx, eax condition: 7 of them and filesize < 155648 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY