Actor(s): IXESHE
There is no description at this point.
rule win_threebyte_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.threebyte." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.threebyte" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 83c201 8995f8feffff 8b85f4feffff 83c001 8985f4feffff eb8f 8d8dfcfeffff } // n = 7, score = 200 // 83c201 | add edx, 1 // 8995f8feffff | mov dword ptr [ebp - 0x108], edx // 8b85f4feffff | mov eax, dword ptr [ebp - 0x10c] // 83c001 | add eax, 1 // 8985f4feffff | mov dword ptr [ebp - 0x10c], eax // eb8f | jmp 0xffffff91 // 8d8dfcfeffff | lea ecx, [ebp - 0x104] $sequence_1 = { 8bec 81ec70060000 57 c685f0feffff00 b93f000000 33c0 8dbdf1feffff } // n = 7, score = 200 // 8bec | mov ebp, esp // 81ec70060000 | sub esp, 0x670 // 57 | push edi // c685f0feffff00 | mov byte ptr [ebp - 0x110], 0 // b93f000000 | mov ecx, 0x3f // 33c0 | xor eax, eax // 8dbdf1feffff | lea edi, [ebp - 0x10f] $sequence_2 = { c6854dffffff52 c6854effffff45 c6854fffffff41 c68550ffffff54 c68551ffffff45 c68552ffffff53 c68553ffffff20 } // n = 7, score = 200 // c6854dffffff52 | mov byte ptr [ebp - 0xb3], 0x52 // c6854effffff45 | mov byte ptr [ebp - 0xb2], 0x45 // c6854fffffff41 | mov byte ptr [ebp - 0xb1], 0x41 // c68550ffffff54 | mov byte ptr [ebp - 0xb0], 0x54 // c68551ffffff45 | mov byte ptr [ebp - 0xaf], 0x45 // c68552ffffff53 | mov byte ptr [ebp - 0xae], 0x53 // c68553ffffff20 | mov byte ptr [ebp - 0xad], 0x20 $sequence_3 = { 8985acfaffff 83bdacfaffffff 7516 68???????? 8d95e8fdffff } // n = 5, score = 200 // 8985acfaffff | mov dword ptr [ebp - 0x554], eax // 83bdacfaffffff | cmp dword ptr [ebp - 0x554], -1 // 7516 | jne 0x18 // 68???????? | // 8d95e8fdffff | lea edx, [ebp - 0x218] $sequence_4 = { ff520c 8b8574f7ffff 50 ff15???????? 8b4d14 51 ff15???????? } // n = 7, score = 200 // ff520c | call dword ptr [edx + 0xc] // 8b8574f7ffff | mov eax, dword ptr [ebp - 0x88c] // 50 | push eax // ff15???????? | // 8b4d14 | mov ecx, dword ptr [ebp + 0x14] // 51 | push ecx // ff15???????? | $sequence_5 = { ff500c 8b4df0 51 e8???????? 83c404 83c8ff e9???????? } // n = 7, score = 200 // ff500c | call dword ptr [eax + 0xc] // 8b4df0 | mov ecx, dword ptr [ebp - 0x10] // 51 | push ecx // e8???????? | // 83c404 | add esp, 4 // 83c8ff | or eax, 0xffffffff // e9???????? | $sequence_6 = { e9???????? 8d85ccf8ffff 50 ff15???????? 8b8d20f8ffff 51 ff15???????? } // n = 7, score = 200 // e9???????? | // 8d85ccf8ffff | lea eax, [ebp - 0x734] // 50 | push eax // ff15???????? | // 8b8d20f8ffff | mov ecx, dword ptr [ebp - 0x7e0] // 51 | push ecx // ff15???????? | $sequence_7 = { 83c40c 8d4d9c 51 e8???????? 83c404 5f } // n = 6, score = 200 // 83c40c | add esp, 0xc // 8d4d9c | lea ecx, [ebp - 0x64] // 51 | push ecx // e8???????? | // 83c404 | add esp, 4 // 5f | pop edi $sequence_8 = { 8b9564f2ffff 81c29c000000 52 e8???????? 83c408 } // n = 5, score = 200 // 8b9564f2ffff | mov edx, dword ptr [ebp - 0xd9c] // 81c29c000000 | add edx, 0x9c // 52 | push edx // e8???????? | // 83c408 | add esp, 8 $sequence_9 = { ff15???????? 8985ecfdffff 83bdecfdffff00 7d08 83c8ff e9???????? 8b4d0c } // n = 7, score = 200 // ff15???????? | // 8985ecfdffff | mov dword ptr [ebp - 0x214], eax // 83bdecfdffff00 | cmp dword ptr [ebp - 0x214], 0 // 7d08 | jge 0xa // 83c8ff | or eax, 0xffffffff // e9???????? | // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] condition: 7 of them and filesize < 180224 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY