SYMBOLCOMMON_NAMEaka. SYNONYMS
win.telebot (Back to overview)

TeleBot

Actor(s): TeleBots, Sandworm


There is no description at this point.

References
2020SecureworksSecureWorks
@online{secureworks:2020:iron:3c939bc, author = {SecureWorks}, title = {{IRON VIKING}}, date = {2020}, organization = {Secureworks}, url = {https://www.secureworks.com/research/threat-profiles/iron-viking}, language = {English}, urldate = {2020-05-23} } IRON VIKING
BlackEnergy EternalPetya GreyEnergy Industroyer KillDisk TeleBot TeleDoor
2016-12-13ESET ResearchAnton Cherepanov
@online{cherepanov:20161213:rise:d6ee3c1, author = {Anton Cherepanov}, title = {{The rise of TeleBots: Analyzing disruptive KillDisk attacks}}, date = {2016-12-13}, organization = {ESET Research}, url = {http://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/}, language = {English}, urldate = {2019-12-20} } The rise of TeleBots: Analyzing disruptive KillDisk attacks
Credraptor KillDisk TeleBot TeleBots
Yara Rules
[TLP:WHITE] win_telebot_auto (20201014 | autogenerated rule brought to you by yara-signator)
rule win_telebot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-10-14"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.5.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.telebot"
        malpedia_rule_date = "20201014"
        malpedia_hash = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
        malpedia_version = "20201014"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83ec04 890424 e8???????? 85c0 894308 0f8446020000 }
            // n = 6, score = 100
            //   83ec04               | sub                 esp, 4
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   894308               | mov                 dword ptr [ebx + 8], eax
            //   0f8446020000         | je                  0x24c

        $sequence_1 = { ffd3 83ec08 85c0 a3???????? 0f845d050000 c7442404???????? 893424 }
            // n = 7, score = 100
            //   ffd3                 | call                ebx
            //   83ec08               | sub                 esp, 8
            //   85c0                 | test                eax, eax
            //   a3????????           |                     
            //   0f845d050000         | je                  0x563
            //   c7442404????????     |                     
            //   893424               | mov                 dword ptr [esp], esi

        $sequence_2 = { 8b84249c000000 85ed 8d1c68 7415 90 8d742600 0fb710 }
            // n = 7, score = 100
            //   8b84249c000000       | mov                 eax, dword ptr [esp + 0x9c]
            //   85ed                 | test                ebp, ebp
            //   8d1c68               | lea                 ebx, [eax + ebp*2]
            //   7415                 | je                  0x17
            //   90                   | nop                 
            //   8d742600             | lea                 esi, [esi]
            //   0fb710               | movzx               edx, word ptr [eax]

        $sequence_3 = { 8944243c 8b442430 896c2404 890424 e8???????? 8b54243c }
            // n = 6, score = 100
            //   8944243c             | mov                 dword ptr [esp + 0x3c], eax
            //   8b442430             | mov                 eax, dword ptr [esp + 0x30]
            //   896c2404             | mov                 dword ptr [esp + 4], ebp
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     
            //   8b54243c             | mov                 edx, dword ptr [esp + 0x3c]

        $sequence_4 = { 8b442458 8b400c 8d68ff 8b442458 8b4010 89c2 }
            // n = 6, score = 100
            //   8b442458             | mov                 eax, dword ptr [esp + 0x58]
            //   8b400c               | mov                 eax, dword ptr [eax + 0xc]
            //   8d68ff               | lea                 ebp, [eax - 1]
            //   8b442458             | mov                 eax, dword ptr [esp + 0x58]
            //   8b4010               | mov                 eax, dword ptr [eax + 0x10]
            //   89c2                 | mov                 edx, eax

        $sequence_5 = { 746a ff54241c 83ec04 83e808 8944240c 8d4608 }
            // n = 6, score = 100
            //   746a                 | je                  0x6c
            //   ff54241c             | call                dword ptr [esp + 0x1c]
            //   83ec04               | sub                 esp, 4
            //   83e808               | sub                 eax, 8
            //   8944240c             | mov                 dword ptr [esp + 0xc], eax
            //   8d4608               | lea                 eax, [esi + 8]

        $sequence_6 = { 83ec14 8b742424 8b5c2420 893424 e8???????? 83c001 89742404 }
            // n = 7, score = 100
            //   83ec14               | sub                 esp, 0x14
            //   8b742424             | mov                 esi, dword ptr [esp + 0x24]
            //   8b5c2420             | mov                 ebx, dword ptr [esp + 0x20]
            //   893424               | mov                 dword ptr [esp], esi
            //   e8????????           |                     
            //   83c001               | add                 eax, 1
            //   89742404             | mov                 dword ptr [esp + 4], esi

        $sequence_7 = { 0fb7442454 d3ee 807c243c00 8b4c2424 8991c41b0000 894140 0f859f000000 }
            // n = 7, score = 100
            //   0fb7442454           | movzx               eax, word ptr [esp + 0x54]
            //   d3ee                 | shr                 esi, cl
            //   807c243c00           | cmp                 byte ptr [esp + 0x3c], 0
            //   8b4c2424             | mov                 ecx, dword ptr [esp + 0x24]
            //   8991c41b0000         | mov                 dword ptr [ecx + 0x1bc4], edx
            //   894140               | mov                 dword ptr [ecx + 0x40], eax
            //   0f859f000000         | jne                 0xa5

        $sequence_8 = { 8b6c2414 f7e9 0fb7742418 c1ed10 8d041a 89da c1fa1f }
            // n = 7, score = 100
            //   8b6c2414             | mov                 ebp, dword ptr [esp + 0x14]
            //   f7e9                 | imul                ecx
            //   0fb7742418           | movzx               esi, word ptr [esp + 0x18]
            //   c1ed10               | shr                 ebp, 0x10
            //   8d041a               | lea                 eax, [edx + ebx]
            //   89da                 | mov                 edx, ebx
            //   c1fa1f               | sar                 edx, 0x1f

        $sequence_9 = { 0f84f0feffff 8d842410200000 897c2404 c70424???????? }
            // n = 4, score = 100
            //   0f84f0feffff         | je                  0xfffffef6
            //   8d842410200000       | lea                 eax, [esp + 0x2010]
            //   897c2404             | mov                 dword ptr [esp + 4], edi
            //   c70424????????       |                     

    condition:
        7 of them and filesize < 393216
}
Download all Yara Rules