SYMBOLCOMMON_NAMEaka. SYNONYMS
win.threebyte (Back to overview)

ThreeByte

Actor(s): IXESHE


There is no description at this point.

References
2014-09-03FireEyeNed Moran, Mike Oppenheim
@online{moran:20140903:darwins:1b05935, author = {Ned Moran and Mike Oppenheim}, title = {{Darwin’s Favorite APT Group}}, date = {2014-09-03}, organization = {FireEye}, url = {https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html}, language = {English}, urldate = {2019-12-20} } Darwin’s Favorite APT Group
EtumBot ThreeByte WaterSpout IXESHE
Yara Rules
[TLP:WHITE] win_threebyte_auto (20211008 | Detects win.threebyte.)
rule win_threebyte_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.threebyte."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.threebyte"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 894df0 837df002 7e0a b8eeffffff e9???????? 8b5508 }
            // n = 6, score = 200
            //   894df0               | mov                 dword ptr [ebp - 0x10], ecx
            //   837df002             | cmp                 dword ptr [ebp - 0x10], 2
            //   7e0a                 | jle                 0xc
            //   b8eeffffff           | mov                 eax, 0xffffffee
            //   e9????????           |                     
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]

        $sequence_1 = { 7541 8b8544f7ffff 50 8b8d10f7ffff ff510c 8b9564f7ffff 52 }
            // n = 7, score = 200
            //   7541                 | jne                 0x43
            //   8b8544f7ffff         | mov                 eax, dword ptr [ebp - 0x8bc]
            //   50                   | push                eax
            //   8b8d10f7ffff         | mov                 ecx, dword ptr [ebp - 0x8f0]
            //   ff510c               | call                dword ptr [ecx + 0xc]
            //   8b9564f7ffff         | mov                 edx, dword ptr [ebp - 0x89c]
            //   52                   | push                edx

        $sequence_2 = { 83c8ff eb44 8b8d24f7ffff 038d14f7ffff 898d24f7ffff 8b9518f7ffff }
            // n = 6, score = 200
            //   83c8ff               | or                  eax, 0xffffffff
            //   eb44                 | jmp                 0x46
            //   8b8d24f7ffff         | mov                 ecx, dword ptr [ebp - 0x8dc]
            //   038d14f7ffff         | add                 ecx, dword ptr [ebp - 0x8ec]
            //   898d24f7ffff         | mov                 dword ptr [ebp - 0x8dc], ecx
            //   8b9518f7ffff         | mov                 edx, dword ptr [ebp - 0x8e8]

        $sequence_3 = { c68525ffffff53 c68526ffffff53 c68527ffffff20 c68528ffffff45 }
            // n = 4, score = 200
            //   c68525ffffff53       | mov                 byte ptr [ebp - 0xdb], 0x53
            //   c68526ffffff53       | mov                 byte ptr [ebp - 0xda], 0x53
            //   c68527ffffff20       | mov                 byte ptr [ebp - 0xd9], 0x20
            //   c68528ffffff45       | mov                 byte ptr [ebp - 0xd8], 0x45

        $sequence_4 = { 83c404 50 8d8570feffff 50 }
            // n = 4, score = 200
            //   83c404               | add                 esp, 4
            //   50                   | push                eax
            //   8d8570feffff         | lea                 eax, dword ptr [ebp - 0x190]
            //   50                   | push                eax

        $sequence_5 = { 898df0feffff 8b95f4feffff 8a8415fcfeffff 8885f8feffff 8b8df4feffff 8b95f0feffff 8a8415fcfeffff }
            // n = 7, score = 200
            //   898df0feffff         | mov                 dword ptr [ebp - 0x110], ecx
            //   8b95f4feffff         | mov                 edx, dword ptr [ebp - 0x10c]
            //   8a8415fcfeffff       | mov                 al, byte ptr [ebp + edx - 0x104]
            //   8885f8feffff         | mov                 byte ptr [ebp - 0x108], al
            //   8b8df4feffff         | mov                 ecx, dword ptr [ebp - 0x10c]
            //   8b95f0feffff         | mov                 edx, dword ptr [ebp - 0x110]
            //   8a8415fcfeffff       | mov                 al, byte ptr [ebp + edx - 0x104]

        $sequence_6 = { 8d957cf7ffff 52 6805000020 8b859cf7ffff 50 }
            // n = 5, score = 200
            //   8d957cf7ffff         | lea                 edx, dword ptr [ebp - 0x884]
            //   52                   | push                edx
            //   6805000020           | push                0x20000005
            //   8b859cf7ffff         | mov                 eax, dword ptr [ebp - 0x864]
            //   50                   | push                eax

        $sequence_7 = { c68532ffffff0a c68533ffffff0d c68534ffffff0a c68535ffffff00 ff15???????? 50 8b5508 }
            // n = 7, score = 200
            //   c68532ffffff0a       | mov                 byte ptr [ebp - 0xce], 0xa
            //   c68533ffffff0d       | mov                 byte ptr [ebp - 0xcd], 0xd
            //   c68534ffffff0a       | mov                 byte ptr [ebp - 0xcc], 0xa
            //   c68535ffffff00       | mov                 byte ptr [ebp - 0xcb], 0
            //   ff15????????         |                     
            //   50                   | push                eax
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]

        $sequence_8 = { 8d4dfc 51 68???????? 8b95f0fdffff }
            // n = 4, score = 200
            //   8d4dfc               | lea                 ecx, dword ptr [ebp - 4]
            //   51                   | push                ecx
            //   68????????           |                     
            //   8b95f0fdffff         | mov                 edx, dword ptr [ebp - 0x210]

        $sequence_9 = { c685c0feffff56 c685c1feffff58 c685c2feffff55 c685c3feffff58 c685c4feffff57 c685c5feffff51 }
            // n = 6, score = 200
            //   c685c0feffff56       | mov                 byte ptr [ebp - 0x140], 0x56
            //   c685c1feffff58       | mov                 byte ptr [ebp - 0x13f], 0x58
            //   c685c2feffff55       | mov                 byte ptr [ebp - 0x13e], 0x55
            //   c685c3feffff58       | mov                 byte ptr [ebp - 0x13d], 0x58
            //   c685c4feffff57       | mov                 byte ptr [ebp - 0x13c], 0x57
            //   c685c5feffff51       | mov                 byte ptr [ebp - 0x13b], 0x51

    condition:
        7 of them and filesize < 180224
}
Download all Yara Rules