win.trickbot (Back to overview)

TrickBot

aka: Trickster, TheTrick, TrickLoader

Actor(s): WIZARD SPIDER

URLhaus      

A financial Trojan believed to be a derivative of Dyre: the bot uses very similar code, web injects, and operational tactics. Has multiple modules including VNC and Socks5 Proxy. Uses SSL for C2 communication.

- Q4 2016 - Detected in wild
Oct 2016 - 1st Report
Jan 2018 - Use XMRIG (Monero) miner
Feb 2018 - Theft Bitcoin
Mar 2018 - Unfinished ransomware module

Infection Vector
1. Phish > Link MS Office > Macro Enabled > Downloader > Trickbot
2. Phish > Attached MS Office > Marco Enabled > Downloader > Trickbot
3. Phish > Attached MS Office > Marco enabled > Trickbot installed

References
http://blog.fortinet.com/2016/12/06/deep-analysis-of-the-online-banking-botnet-trickbot
http://www.malware-traffic-analysis.net/2018/02/01/
http://www.peppermalware.com/2019/03/quick-analysis-of-trickbot-sample-with.html
http://www.pwc.co.uk/issues/cyber-security-data-privacy/research/trickbots-bag-of-tricks.html
http://www.vkremez.com/2017/11/lets-learn-trickbot-socks5-backconnect.html
http://www.vkremez.com/2017/12/lets-learn-introducing-new-trickbot.html
http://www.vkremez.com/2018/04/lets-learn-trickbot-implements-network.html
https://blog.fraudwatchinternational.com/malware/trickbot-malware-works
https://blog.malwarebytes.com/threat-analysis/2016/10/trick-bot-dyrezas-successor/
https://blog.malwarebytes.com/threat-analysis/2017/08/trickbot-comes-with-new-tricks-attacking-outlook-and-browsing-data/
https://blog.malwarebytes.com/threat-analysis/malware-threat-analysis/2018/11/whats-new-trickbot-deobfuscating-elements/
https://blog.talosintelligence.com/2018/07/smoking-guns-smoke-loader-learned-new.html
https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-adds-remote-application-credential-grabbing-capabilities-to-its-repertoire/
https://blog.trendmicro.com/trendlabs-security-intelligence/trickbot-shows-off-new-trick-password-grabber-module
https://blogs.forcepoint.com/security-labs/trickbot-spread-necurs-botnet-adds-nordic-countries-its-targets
https://escinsecurity.blogspot.de/2018/01/weekly-trickbot-analysis-end-of-wc-22.html
https://f5.com/labs/articles/threat-intelligence/malware/little-trickbot-growing-up-new-campaign-24412
https://f5.com/labs/articles/threat-intelligence/malware/trickbot-expands-global-targets-beyond-banks-and-payment-processors-to-crms
https://github.com/JR0driguezB/malware_configs/tree/master/TrickBot
https://inquest.net/blog/2019/08/26/TrickBot-Memory-Analysis
https://labs.vipre.com/trickbots-tricks/
https://qmemcpy.github.io/post/reverse-engineering-malware-trickbot-part-1-packer
https://qmemcpy.io/post/reverse-engineering-malware-trickbot-part-2-loader
https://qmemcpy.io/post/reverse-engineering-malware-trickbot-part-3-core
https://securityintelligence.com/trickbot-takes-to-latin-america-continues-to-expand-its-global-reach/
https://securityintelligence.com/trickbots-cryptocurrency-hunger-tricking-the-bitcoin-out-of-wallets/
https://securityintelligence.com/tricks-of-the-trade-a-deeper-look-into-trickbots-machinations/
https://sysopfb.github.io/malware/2018/04/16/trickbot-uacme.html
https://technical.nttsecurity.com/post/102fnog/targeted-trickbot-activity-drops-powerbrace-backdoor
https://unit42.paloaltonetworks.com/wireshark-tutorial-examining-trickbot-infections/
https://www.arbornetworks.com/blog/asert/trickbot-banker-insights/
https://www.blueliv.com/research/trickbot-banking-trojan-using-eflags-as-an-anti-hook-technique/
https://www.botconf.eu/wp-content/uploads/2016/11/2016-LT09-TrickBot-Adams.pdf
https://www.cert.pl/en/news/single/detricking-trickbot-loader/
https://www.crowdstrike.com/blog/sin-ful-spiders-wizard-spider-and-lunar-spider-sharing-the-same-web/
https://www.cyberbit.com/blog/endpoint-security/latest-trickbot-variant-has-new-tricks-up-its-sleeve/
https://www.cybereason.com/blog/triple-threat-emotet-deploys-trickbot-to-steal-data-spread-ryuk-ransomware
https://www.fidelissecurity.com/threatgeek/2016/10/trickbot-we-missed-you-dyre
https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html
https://www.flashpoint-intel.com/blog/new-version-trickbot-adds-worm-propagation-module/
https://www.flashpoint-intel.com/blog/trickbot-account-checking-hybrid-attack-model/
https://www.fortinet.com/blog/threat-research/deep-analysis-of-trickbot-new-module-pwgrab.html
https://www.govcert.admin.ch/blog/36/severe-ransomware-attacks-against-swiss-smes
https://www.govcert.ch/blog/37/trickbot-an-analysis-of-data-collected-from-the-botnet
https://www.heise.de/security/artikel/Emotet-Trickbot-Ryuk-ein-explosiver-Malware-Cocktail-4573848.html
https://www.ringzerolabs.com/2017/07/trickbot-banking-trojan-doc00039217doc.html
https://www.secdata.com/the-trickbot-and-mikrotik/
https://www.secureworks.com/blog/trickbot-modifications-target-us-mobile-users
https://www.securityartwork.es/wp-content/uploads/2017/06/Informe_Evoluci%C3%B3n_Trickbot.pdf
https://www.slideshare.net/proidea_conferences/inside-cybercrime-groups-harvesting-active-directory-for-fun-and-profit-vitali-kremez
https://www.sneakymonkey.net/2019/05/22/trickbot-analysis/
https://www.sneakymonkey.net/2019/10/29/trickbot-analysis-part-ii/
https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/evolving-trickbot-adds-detection-evasion-and-screen-locking-features
https://www.trustwave.com/Resources/SpiderLabs-Blog/Tale-of-the-Two-Payloads-%E2%80%93-TrickBot-and-Nitol/
https://www.vkremez.com/2018/11/lets-learn-introducing-latest-trickbot.html
https://www.webroot.com/blog/2018/03/21/trickbot-banking-trojan-adapts-new-module/
https://www.youtube.com/watch?v=EdchPEHnohw
https://www.youtube.com/watch?v=KMcSAlS9zGE
https://www.youtube.com/watch?v=lTywPmZEU1A
Yara Rules
[TLP:WHITE] win_trickbot_auto (20190620 | autogenerated rule brought to you by yara-signator)
rule win_trickbot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2019-07-05"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator 0.2a"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot"
        malpedia_version = "20190620"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */

    strings:
        $sequence_0 = { 1bc0 83e070 83c010 eb?? }
            // n = 4, score = 4800
            //   1bc0                 | sbb                 eax, eax
            //   83e070               | and                 eax, 0x70
            //   83c010               | add                 eax, 0x10
            //   eb??                 |                     

        $sequence_1 = { f7d8 1bc0 83e070 83c010 eb?? }
            // n = 5, score = 4800
            //   f7d8                 | neg                 eax
            //   1bc0                 | sbb                 eax, eax
            //   83e070               | and                 eax, 0x70
            //   83c010               | add                 eax, 0x10
            //   eb??                 |                     

        $sequence_2 = { f7d8 1bc0 83e070 83c010 }
            // n = 4, score = 4800
            //   f7d8                 | neg                 eax
            //   1bc0                 | sbb                 eax, eax
            //   83e070               | and                 eax, 0x70
            //   83c010               | add                 eax, 0x10

        $sequence_3 = { 75?? ff15???????? 3de7010000 0f8????????? }
            // n = 4, score = 4500
            //   75??                 |                     
            //   ff15????????         |                     
            //   3de7010000           | cmp                 eax, 0x1e7
            //   0f8?????????         |                     

        $sequence_4 = { eb?? 2500000080 f7d8 1bc0 83e007 40 }
            // n = 6, score = 4500
            //   eb??                 |                     
            //   2500000080           | and                 eax, 0x80000000
            //   f7d8                 | neg                 eax
            //   1bc0                 | sbb                 eax, eax
            //   83e007               | and                 eax, 7
            //   40                   | inc                 eax

        $sequence_5 = { 83e070 83c010 eb?? a900000040 74?? 2500000080 f7d8 }
            // n = 7, score = 4500
            //   83e070               | and                 eax, 0x70
            //   83c010               | add                 eax, 0x10
            //   eb??                 |                     
            //   a900000040           | test                eax, 0x40000000
            //   74??                 |                     
            //   2500000080           | and                 eax, 0x80000000
            //   f7d8                 | neg                 eax

        $sequence_6 = { 2500000080 f7d8 1bc0 83e070 83c010 eb?? a900000040 }
            // n = 7, score = 4500
            //   2500000080           | and                 eax, 0x80000000
            //   f7d8                 | neg                 eax
            //   1bc0                 | sbb                 eax, eax
            //   83e070               | and                 eax, 0x70
            //   83c010               | add                 eax, 0x10
            //   eb??                 |                     
            //   a900000040           | test                eax, 0x40000000

        $sequence_7 = { f7d8 1bc0 83e070 83c010 eb?? a900000040 }
            // n = 6, score = 4500
            //   f7d8                 | neg                 eax
            //   1bc0                 | sbb                 eax, eax
            //   83e070               | and                 eax, 0x70
            //   83c010               | add                 eax, 0x10
            //   eb??                 |                     
            //   a900000040           | test                eax, 0x40000000

        $sequence_8 = { f7d8 1bc0 83e020 83c020 eb?? 2500000080 f7d8 }
            // n = 7, score = 4500
            //   f7d8                 | neg                 eax
            //   1bc0                 | sbb                 eax, eax
            //   83e020               | and                 eax, 0x20
            //   83c020               | add                 eax, 0x20
            //   eb??                 |                     
            //   2500000080           | and                 eax, 0x80000000
            //   f7d8                 | neg                 eax

        $sequence_9 = { 6683380d 75?? 668378020a 75?? }
            // n = 4, score = 3700
            //   6683380d             | cmp                 word ptr [eax], 0xd
            //   75??                 |                     
            //   668378020a           | cmp                 word ptr [eax + 2], 0xa
            //   75??                 |                     

        $sequence_10 = { 0f8????????? 85c0 74?? 0fb616 }
            // n = 4, score = 3500
            //   0f8?????????         |                     
            //   85c0                 | mov                 eax, dword ptr [ecx + 0x40]
            //   74??                 |                     
            //   0fb616               | dec                 eax

        $sequence_11 = { 50 ff15???????? 8b45f8 3bc3 }
            // n = 4, score = 3400
            //   50                   | mov                 ebp, esp
            //   ff15????????         |                     
            //   8b45f8               | sub                 esp, 0xb8c
            //   3bc3                 | push                ebx

        $sequence_12 = { 74?? 50 ff15???????? 8b45f8 3bc3 74?? }
            // n = 6, score = 3400
            //   74??                 |                     
            //   50                   | test                ebx, ebx
            //   ff15????????         |                     
            //   8b45f8               | mov                 esi, 1
            //   3bc3                 | mov                 eax, dword ptr [ebp - 8]
            //   74??                 |                     

        $sequence_13 = { 50 ff15???????? 8b45f8 3bc3 74?? 50 ff15???????? }
            // n = 7, score = 3400
            //   50                   | push                esi
            //   ff15????????         |                     
            //   8b45f8               | push                edi
            //   3bc3                 | xor                 edi, edi
            //   74??                 |                     
            //   50                   | push                ebp
            //   ff15????????         |                     

        $sequence_14 = { ff15???????? 8b45f8 3bc3 74?? 50 ff15???????? }
            // n = 6, score = 3400
            //   ff15????????         |                     
            //   8b45f8               | push                esi
            //   3bc3                 | push                edi
            //   74??                 |                     
            //   50                   | xor                 edi, edi
            //   ff15????????         |                     

        $sequence_15 = { 50 ff15???????? 8b45f8 3bc3 74?? }
            // n = 5, score = 3400
            //   50                   | push                esi
            //   ff15????????         |                     
            //   8b45f8               | push                edi
            //   3bc3                 | xor                 edi, edi
            //   74??                 |                     

        $sequence_16 = { 3bc3 74?? 50 ff15???????? 8b45f8 3bc3 }
            // n = 6, score = 3400
            //   3bc3                 | lea                 edx, [ebp - 0x18]
            //   74??                 |                     
            //   50                   | push                edx
            //   ff15????????         |                     
            //   8b45f8               | mov                 ecx, 0x100044e0
            //   3bc3                 | push                eax

        $sequence_17 = { 74?? 50 ff15???????? 8b45f8 3bc3 }
            // n = 5, score = 3400
            //   74??                 |                     
            //   50                   | mov                 ebp, esp
            //   ff15????????         |                     
            //   8b45f8               | sub                 esp, 0xb8c
            //   3bc3                 | push                ebx

        $sequence_18 = { 3bc3 74?? 50 ff15???????? 8b45f8 3bc3 74?? }
            // n = 7, score = 3400
            //   3bc3                 | pop                 ebp
            //   74??                 |                     
            //   50                   | ret                 
            //   ff15????????         |                     
            //   8b45f8               | sub                 esp, 0xb8c
            //   3bc3                 | push                ebx
            //   74??                 |                     

        $sequence_19 = { 83c404 a3???????? 8915???????? 5f }
            // n = 4, score = 2600
            //   83c404               | dec                 esp
            //   a3????????           |                     
            //   8915????????         |                     
            //   5f                   | mov                 ecx, dword ptr [ecx + 0x28]

        $sequence_20 = { 81fb93010000 74?? 81fb94010000 74?? }
            // n = 4, score = 2300
            //   81fb93010000         | cmp                 ebx, 0x193
            //   74??                 |                     
            //   81fb94010000         | cmp                 ebx, 0x194
            //   74??                 |                     

        $sequence_21 = { ff15???????? 85c0 0f8????????? e8???????? e8???????? 85c0 0f8????????? }
            // n = 7, score = 2200
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   0f8?????????         |                     
            //   e8????????           |                     
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   0f8?????????         |                     

        $sequence_22 = { ff15???????? 85c0 0f8????????? e8???????? e8???????? 85c0 }
            // n = 6, score = 2200
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   0f8?????????         |                     
            //   e8????????           |                     
            //   e8????????           |                     
            //   85c0                 | test                eax, eax

        $sequence_23 = { 85c0 74?? 50 e8???????? 83c404 8945ec }
            // n = 6, score = 1900
            //   85c0                 | mov                 edx, dword ptr [ecx + 0x18]
            //   74??                 |                     
            //   50                   | dec                 eax
            //   e8????????           |                     
            //   83c404               | mov                 dword ptr [esp + 0x38], eax
            //   8945ec               | dec                 eax

        $sequence_24 = { 74?? 50 e8???????? 83c404 8945ec }
            // n = 5, score = 1900
            //   74??                 |                     
            //   50                   | dec                 esp
            //   e8????????           |                     
            //   83c404               | mov                 eax, dword ptr [ecx + 0x20]
            //   8945ec               | dec                 eax

        $sequence_25 = { 81ffc8000000 74?? 81ff93010000 74?? 81ff94010000 }
            // n = 5, score = 1800
            //   81ffc8000000         | cmp                 edi, 0xc8
            //   74??                 |                     
            //   81ff93010000         | cmp                 edi, 0x193
            //   74??                 |                     
            //   81ff94010000         | cmp                 edi, 0x194

        $sequence_26 = { 81ffc8000000 74?? 81ff93010000 74?? 81ff94010000 74?? }
            // n = 6, score = 1800
            //   81ffc8000000         | cmp                 edi, 0xc8
            //   74??                 |                     
            //   81ff93010000         | cmp                 edi, 0x193
            //   74??                 |                     
            //   81ff94010000         | cmp                 edi, 0x194
            //   74??                 |                     

        $sequence_27 = { 74?? 81ff93010000 74?? 81ff94010000 }
            // n = 4, score = 1800
            //   74??                 |                     
            //   81ff93010000         | cmp                 edi, 0x193
            //   74??                 |                     
            //   81ff94010000         | cmp                 edi, 0x194

        $sequence_28 = { 0f8????????? b84d5a0000 663902 0f8????????? }
            // n = 4, score = 1700
            //   0f8?????????         |                     
            //   b84d5a0000           | and                 edx, 0xffffffbf
            //   663902               | sub                 eax, 4
            //   0f8?????????         |                     

        $sequence_29 = { 0f8????????? b84d5a0000 663902 0f8????????? }
            // n = 4, score = 1700
            //   0f8?????????         |                     
            //   b84d5a0000           | mov                 eax, 0x5a4d
            //   663902               | cmp                 word ptr [edx], ax
            //   0f8?????????         |                     

        $sequence_30 = { 4c8b4928 4c8b4120 488b5118 4889442438 488b4140 }
            // n = 5, score = 1200
            //   4c8b4928             | dec                 eax
            //   4c8b4120             | mov                 dword ptr [esp + 0x38], eax
            //   488b5118             | dec                 eax
            //   4889442438           | mov                 edx, dword ptr [ecx + 0x18]
            //   488b4140             | dec                 eax

        $sequence_31 = { 75?? 488b4148 4c8b11 4c8b4928 4c8b4120 488b5118 4889442438 }
            // n = 7, score = 1200
            //   75??                 |                     
            //   488b4148             | dec                 eax
            //   4c8b11               | mov                 eax, dword ptr [ecx + 0x48]
            //   4c8b4928             | dec                 eax
            //   4c8b4120             | mov                 dword ptr [esp + 0x38], eax
            //   488b5118             | dec                 eax
            //   4889442438           | mov                 eax, dword ptr [ecx + 0x40]

        $sequence_32 = { 4889442438 488b4140 4889442430 488b4138 }
            // n = 4, score = 1200
            //   4889442438           | dec                 esp
            //   488b4140             | mov                 eax, dword ptr [ecx + 0x20]
            //   4889442430           | dec                 eax
            //   488b4138             | mov                 edx, dword ptr [ecx + 0x18]

        $sequence_33 = { 4889442440 488b4148 4889442438 488b4140 4889442430 488b4138 }
            // n = 6, score = 1200
            //   4889442440           | dec                 esp
            //   488b4148             | mov                 ecx, dword ptr [ecx + 0x28]
            //   4889442438           | dec                 esp
            //   488b4140             | mov                 eax, dword ptr [ecx + 0x20]
            //   4889442430           | dec                 eax
            //   488b4138             | mov                 dword ptr [esp + 0x40], eax

        $sequence_34 = { 75?? 488b4148 4c8b11 4c8b4928 4c8b4120 488b5118 }
            // n = 6, score = 1200
            //   75??                 |                     
            //   488b4148             | mov                 eax, dword ptr [ecx + 0x48]
            //   4c8b11               | dec                 esp
            //   4c8b4928             | mov                 edx, dword ptr [ecx]
            //   4c8b4120             | dec                 esp
            //   488b5118             | mov                 ecx, dword ptr [ecx + 0x28]

        $sequence_35 = { 488b5118 4889442440 488b4148 4889442438 488b4140 }
            // n = 5, score = 1200
            //   488b5118             | dec                 eax
            //   4889442440           | mov                 dword ptr [esp + 0x30], eax
            //   488b4148             | dec                 eax
            //   4889442438           | mov                 eax, dword ptr [ecx + 0x38]
            //   488b4140             | dec                 eax

        $sequence_36 = { 85c0 74?? 3bc1 72?? 2bc1 }
            // n = 5, score = 1200
            //   85c0                 | test                eax, eax
            //   74??                 |                     
            //   3bc1                 | cmp                 eax, ecx
            //   72??                 |                     
            //   2bc1                 | sub                 eax, ecx

        $sequence_37 = { eb?? 83f809 75?? 488b4150 4c8b11 4c8b4928 4c8b4120 }
            // n = 7, score = 1200
            //   eb??                 |                     
            //   83f809               | cmp                 eax, 9
            //   75??                 |                     
            //   488b4150             | dec                 eax
            //   4c8b11               | mov                 eax, dword ptr [ecx + 0x50]
            //   4c8b4928             | dec                 esp
            //   4c8b4120             | mov                 edx, dword ptr [ecx]

        $sequence_38 = { 8b03 0fbae01d 73?? 0fbae01e 73?? 0fbae01f }
            // n = 6, score = 1100
            //   8b03                 | and                 eax, 0xfffffffb
            //   0fbae01d             | mov                 eax, dword ptr [ebp + 0x1c]
            //   73??                 |                     
            //   0fbae01e             | mov                 eax, dword ptr [ebp + 0x20]
            //   73??                 |                     
            //   0fbae01f             | test                ecx, ecx

        $sequence_39 = { 73?? 0fbae01e 73?? 0fbae01f }
            // n = 4, score = 1100
            //   73??                 |                     
            //   0fbae01e             | dec                 eax
            //   73??                 |                     
            //   0fbae01f             | mov                 eax, dword ptr [ecx]

        $sequence_40 = { 8b03 0fbae01d 73?? 0fbae01e 73?? }
            // n = 5, score = 1100
            //   8b03                 | mov                 eax, dword ptr [esp + 0x28]
            //   0fbae01d             | lea                 edx, [eax - 0x40]
            //   73??                 |                     
            //   0fbae01e             | and                 edx, 0xffffffbf
            //   73??                 |                     

        $sequence_41 = { 0fbae01d 73?? 0fbae01e 73?? 0fbae01f }
            // n = 5, score = 1100
            //   0fbae01d             | mov                 dword ptr [esp + 0x24], eax
            //   73??                 |                     
            //   0fbae01e             | cmp                 dword ptr [esp + 0xb0], 4
            //   73??                 |                     
            //   0fbae01f             | mov                 dword ptr [esp + 0x4c], 1

        $sequence_42 = { 0fbae01d 73?? 0fbae01e 73?? }
            // n = 4, score = 1100
            //   0fbae01d             | call                dword ptr [eax + 0x80]
            //   73??                 |                     
            //   0fbae01e             | mov                 ebx, eax
            //   73??                 |                     

        $sequence_43 = { 8b03 0fbae01d 73?? 0fbae01e }
            // n = 4, score = 1100
            //   8b03                 | mov                 eax, dword ptr [esp + 0x44]
            //   0fbae01d             | mov                 dword ptr [esp + 0x38], 0x20
            //   73??                 |                     
            //   0fbae01e             | add                 eax, 0x31

        $sequence_44 = { 85c0 78?? 488b4c2440 33d2 488b01 ff90f8010000 }
            // n = 6, score = 1000
            //   85c0                 | push                dword ptr fs:[eax]
            //   78??                 |                     
            //   488b4c2440           | mov                 dword ptr fs:[eax], esp
            //   33d2                 | mov                 dword ptr [ebp - 0x10], 0xffffffff
            //   488b01               | mov                 dword ptr [ebp - 0xc], 4
            //   ff90f8010000         | lea                 eax, [ebp - 0x14]

        $sequence_45 = { 488b01 ff9020020000 488b4c2440 33d2 488b01 ff9030020000 }
            // n = 6, score = 1000
            //   488b01               | mov                 byte ptr [ebp - 0x82], 0xda
            //   ff9020020000         | mov                 byte ptr [ebp - 0x81], 0xc2
            //   488b4c2440           | mov                 byte ptr [ebp - 0x80], 0x83
            //   33d2                 | mov                 byte ptr [ebp - 0x7f], 0xc1
            //   488b01               | mov                 byte ptr [ebp - 0x7e], 0x94
            //   ff9030020000         | mov                 byte ptr [ebp - 0x7d], 0x82

        $sequence_46 = { 488b01 ff5068 85c0 0f8????????? 83f801 }
            // n = 5, score = 1000
            //   488b01               | add                 ecx, dword ptr [edx + 0xc]
            //   ff5068               | cmp                 eax, ecx
            //   85c0                 | mov                 edx, dword ptr [edx]
            //   0f8?????????         |                     
            //   83f801               | cmp                 edx, 0x407610

        $sequence_47 = { 488b01 ff90f8010000 488b4c2440 33d2 }
            // n = 4, score = 1000
            //   488b01               | int3                
            //   ff90f8010000         | mov                 eax, 0x10025e94
            //   488b4c2440           | sub                 esp, 0x8c
            //   33d2                 | push                dword ptr [ebp + 8]

        $sequence_48 = { 488bd7 ff15???????? 85c0 78?? 4898 }
            // n = 5, score = 1000
            //   488bd7               | push                dword ptr fs:[edx]
            //   ff15????????         |                     
            //   85c0                 | mov                 dword ptr fs:[edx], esp
            //   78??                 |                     
            //   4898                 | push                0x404563

        $sequence_49 = { 488b4c2440 33d2 488b01 ff90f8010000 488b4c2440 33d2 }
            // n = 6, score = 1000
            //   488b4c2440           | mov                 byte ptr [ebp - 0x7c], 0x95
            //   33d2                 | push                0x800
            //   488b01               | push                esi
            //   ff90f8010000         | push                0x1002c480
            //   488b4c2440           | mov                 edi, eax
            //   33d2                 | push                eax

        $sequence_50 = { ffd3 50 ff15???????? 8bf0 3bf7 74?? }
            // n = 6, score = 900
            //   ffd3                 | call                ebx
            //   50                   | push                eax
            //   ff15????????         |                     
            //   8bf0                 | mov                 esi, eax
            //   3bf7                 | cmp                 esi, edi
            //   74??                 |                     

        $sequence_51 = { 53 6aff 50 6a00 6a00 ff15???????? }
            // n = 6, score = 900
            //   53                   | dec                 eax
            //   6aff                 | dec                 eax
            //   50                   | test                eax, eax
            //   6a00                 | dec                 eax
            //   6a00                 | lea                 ecx, [ebp - 0x18]
            //   ff15????????         |                     

        $sequence_52 = { ffd3 50 ff15???????? 8bf0 3bf7 }
            // n = 5, score = 900
            //   ffd3                 | call                ebx
            //   50                   | push                eax
            //   ff15????????         |                     
            //   8bf0                 | mov                 esi, eax
            //   3bf7                 | cmp                 esi, edi

        $sequence_53 = { 8b01 59 03d0 52 eb?? 89450c }
            // n = 6, score = 800
            //   8b01                 | mov                 eax, dword ptr [ecx]
            //   59                   | pop                 ecx
            //   03d0                 | add                 edx, eax
            //   52                   | push                edx
            //   eb??                 |                     
            //   89450c               | mov                 dword ptr [ebp + 0xc], eax

        $sequence_54 = { 03d0 52 eb?? 89450c }
            // n = 4, score = 800
            //   03d0                 | add                 edx, eax
            //   52                   | push                edx
            //   eb??                 |                     
            //   89450c               | mov                 dword ptr [ebp + 0xc], eax

        $sequence_55 = { 8bc1 66ad 85c0 74?? 3bc1 72?? }
            // n = 6, score = 800
            //   8bc1                 | mov                 eax, ecx
            //   66ad                 | lodsw               ax, word ptr [esi]
            //   85c0                 | test                eax, eax
            //   74??                 |                     
            //   3bc1                 | cmp                 eax, ecx
            //   72??                 |                     

        $sequence_56 = { 59 03d0 52 eb?? 89450c 8bc5 }
            // n = 6, score = 800
            //   59                   | pop                 ecx
            //   03d0                 | add                 edx, eax
            //   52                   | push                edx
            //   eb??                 |                     
            //   89450c               | mov                 dword ptr [ebp + 0xc], eax
            //   8bc5                 | mov                 eax, ebp

        $sequence_57 = { 66ad 85c0 74?? 3bc1 }
            // n = 4, score = 800
            //   66ad                 | lodsw               ax, word ptr [esi]
            //   85c0                 | test                eax, eax
            //   74??                 |                     
            //   3bc1                 | cmp                 eax, ecx

        $sequence_58 = { 8bc1 66ad 85c0 74?? }
            // n = 4, score = 800
            //   8bc1                 | mov                 eax, ecx
            //   66ad                 | lodsw               ax, word ptr [esi]
            //   85c0                 | test                eax, eax
            //   74??                 |                     

        $sequence_59 = { 59 03d0 52 eb?? 89450c }
            // n = 5, score = 800
            //   59                   | pop                 ecx
            //   03d0                 | add                 edx, eax
            //   52                   | push                edx
            //   eb??                 |                     
            //   89450c               | mov                 dword ptr [ebp + 0xc], eax

        $sequence_60 = { 488b01 ff9080000000 8bd8 85c0 }
            // n = 4, score = 700
            //   488b01               | mov                 eax, dword ptr [ebp - 8]
            //   ff9080000000         | cmp                 eax, ebx
            //   8bd8                 | push                eax
            //   85c0                 | push                eax

        $sequence_61 = { 53 57 33ff 897df8 897df0 }
            // n = 5, score = 700
            //   53                   | push                ebx
            //   57                   | push                edi
            //   33ff                 | xor                 edi, edi
            //   897df8               | mov                 dword ptr [ebp - 8], edi
            //   897df0               | mov                 dword ptr [ebp - 0x10], edi

        $sequence_62 = { 85c0 0f8????????? 66837dc8ff 0f8????????? }
            // n = 4, score = 700
            //   85c0                 | dec                 eax
            //   0f8?????????         |                     
            //   66837dc8ff           | lea                 ecx, [esp + 0x20]
            //   0f8?????????         |                     

        $sequence_63 = { 53 56 57 33f6 ff15???????? }
            // n = 5, score = 700
            //   53                   | dec                 eax
            //   56                   | test                eax, eax
            //   57                   | mov                 ecx, 0xcc
            //   33f6                 | dec                 eax
            //   ff15????????         |                     

        $sequence_64 = { 57 33ff 897df8 897df0 }
            // n = 4, score = 700
            //   57                   | push                edi
            //   33ff                 | xor                 edi, edi
            //   897df8               | mov                 dword ptr [ebp - 8], edi
            //   897df0               | mov                 dword ptr [ebp - 0x10], edi

        $sequence_65 = { 895df0 895dfc 895df8 895dec }
            // n = 4, score = 700
            //   895df0               | mov                 dword ptr [ebp - 0x10], ebx
            //   895dfc               | mov                 dword ptr [ebp - 4], ebx
            //   895df8               | mov                 dword ptr [ebp - 8], ebx
            //   895dec               | mov                 dword ptr [ebp - 0x14], ebx

        $sequence_66 = { eb?? b857000780 85c0 78?? }
            // n = 4, score = 600
            //   eb??                 |                     
            //   b857000780           | mov                 eax, 0x80070057
            //   85c0                 | test                eax, eax
            //   78??                 |                     

        $sequence_67 = { ff36 ff15???????? 33c0 5e 5d c3 55 }
            // n = 7, score = 600
            //   ff36                 | cmp                 eax, 0xe7
            //   ff15????????         |                     
            //   33c0                 | dec                 eax
            //   5e                   | dec                 eax
            //   5d                   | lea                 ecx, [esp + 0x20]
            //   c3                   | push                ebx
            //   55                   | push                -1

        $sequence_68 = { 74?? 488bcf e8???????? 488bcf ff15???????? }
            // n = 5, score = 600
            //   74??                 |                     
            //   488bcf               | mov                 eax, dword ptr [ebp - 8]
            //   e8????????           |                     
            //   488bcf               | cmp                 eax, ebx
            //   ff15????????         |                     

        $sequence_69 = { 8bc6 f7d0 03d7 0bc2 33c7 05c3595b65 }
            // n = 6, score = 600
            //   8bc6                 | mov                 ecx, dword ptr [ebx]
            //   f7d0                 | dec                 eax
            //   03d7                 | dec                 eax
            //   0bc2                 | dec                 eax
            //   33c7                 | mov                 edx, esi
            //   05c3595b65           | dec                 eax

        $sequence_70 = { e8???????? 59 5b 5f 5e 5d }
            // n = 6, score = 600
            //   e8????????           |                     
            //   59                   | mov                 ecx, ebx
            //   5b                   | add                 esp, 4
            //   5f                   | pop                 edi
            //   5e                   | push                eax
            //   5d                   | add                 esp, 4

        $sequence_71 = { 74?? 803f00 75?? 48 }
            // n = 4, score = 600
            //   74??                 |                     
            //   803f00               | dec                 eax
            //   75??                 |                     
            //   48                   | dec                 eax

        $sequence_72 = { 85c0 78?? 8b4dfc 8b4508 }
            // n = 4, score = 600
            //   85c0                 | test                eax, eax
            //   78??                 |                     
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]

        $sequence_73 = { e8???????? 59 5b 5f 5e 5d c3 }
            // n = 7, score = 600
            //   e8????????           |                     
            //   59                   | test                eax, eax
            //   5b                   | movzx               edx, byte ptr [esi]
            //   5f                   | test                eax, eax
            //   5e                   | cmp                 word ptr [ebp - 0x38], -1
            //   5d                   | cmp                 byte ptr [edi], 0
            //   c3                   | dec                 eax

        $sequence_74 = { ff36 ff15???????? 33c0 5e 5d c3 }
            // n = 6, score = 600
            //   ff36                 | push                eax
            //   ff15????????         |                     
            //   33c0                 | push                0
            //   5e                   | push                0
            //   5d                   | push                ebx
            //   c3                   | push                esi

        $sequence_75 = { 4885ff 74?? 488bcf e8???????? 488bcf ff15???????? }
            // n = 6, score = 600
            //   4885ff               | cmp                 eax, ebx
            //   74??                 |                     
            //   488bcf               | push                eax
            //   e8????????           |                     
            //   488bcf               | mov                 eax, dword ptr [ebp - 8]
            //   ff15????????         |                     

        $sequence_76 = { f7d0 03d7 0bc2 33c7 05c3595b65 }
            // n = 5, score = 600
            //   f7d0                 | mov                 dword ptr [ebp - 0x14], eax
            //   03d7                 | test                eax, eax
            //   0bc2                 | push                eax
            //   33c7                 | add                 esp, 4
            //   05c3595b65           | mov                 dword ptr [ebp - 0x14], eax

        $sequence_77 = { 4885f6 74?? 488bce e8???????? 488bce ff15???????? }
            // n = 6, score = 500
            //   4885f6               | cmp                 eax, ebx
            //   74??                 |                     
            //   488bce               | test                edx, edx
            //   e8????????           |                     
            //   488bce               | sub                 edx, 1
            //   ff15????????         |                     

        $sequence_78 = { e8???????? 488b4db0 4885c9 74?? }
            // n = 4, score = 500
            //   e8????????           |                     
            //   488b4db0             | sub                 eax, 4
            //   4885c9               | lea                 edx, [eax - 0x40]
            //   74??                 |                     

        $sequence_79 = { 74?? 488b4d7f 4885c9 74?? }
            // n = 4, score = 500
            //   74??                 |                     
            //   488b4d7f             | sub                 eax, 4
            //   4885c9               | and                 eax, 0xfffffffb
            //   74??                 |                     

        $sequence_80 = { 74?? 488bce e8???????? 488bce ff15???????? }
            // n = 5, score = 500
            //   74??                 |                     
            //   488bce               | xor                 esi, esi
            //   e8????????           |                     
            //   488bce               | and                 edx, 0xffffffbf
            //   ff15????????         |                     

        $sequence_81 = { 75?? ff15???????? 3de7000000 74?? }
            // n = 4, score = 500
            //   75??                 |                     
            //   ff15????????         |                     
            //   3de7000000           | lea                 ecx, [esp + 0x20]
            //   74??                 |                     

        $sequence_82 = { 8bec 81ec8c0b0000 53 56 57 33ff }
            // n = 6, score = 500
            //   8bec                 | or                  eax, edx
            //   81ec8c0b0000         | xor                 eax, edi
            //   53                   | add                 eax, 0x655b59c3
            //   56                   | pop                 ecx
            //   57                   | pop                 ebx
            //   33ff                 | pop                 edi

        $sequence_83 = { 55 8bec 81ec8c0b0000 53 56 57 33ff }
            // n = 7, score = 500
            //   55                   | pop                 esi
            //   8bec                 | pop                 ebp
            //   81ec8c0b0000         | not                 eax
            //   53                   | add                 edx, edi
            //   56                   | or                  eax, edx
            //   57                   | xor                 eax, edi
            //   33ff                 | add                 eax, 0x655b59c3

        $sequence_84 = { 81ec8c0b0000 53 56 57 33ff }
            // n = 5, score = 500
            //   81ec8c0b0000         | push                edi
            //   53                   | xor                 esi, esi
            //   56                   | mov                 eax, esi
            //   57                   | not                 eax
            //   33ff                 | add                 edx, edi

        $sequence_85 = { 488d4dc0 ff15???????? 488d4dd8 ff15???????? }
            // n = 4, score = 500
            //   488d4dc0             | lea                 edx, [eax - 0x40]
            //   ff15????????         |                     
            //   488d4dd8             | and                 edx, 0xffffffbf
            //   ff15????????         |                     

        $sequence_86 = { e8???????? 48 8b15???????? 48 8d4c2420 }
            // n = 5, score = 400
            //   e8????????           |                     
            //   48                   | dec                 eax
            //   8b15????????         |                     
            //   48                   | dec                 eax
            //   8d4c2420             | lea                 ecx, [esp + 0x20]

        $sequence_87 = { e8???????? 48 8b15???????? 48 8d4c2420 }
            // n = 5, score = 400
            //   e8????????           |                     
            //   48                   | mov                 dword ptr [esp + 0x40], eax
            //   8b15????????         |                     
            //   48                   | dec                 eax
            //   8d4c2420             | mov                 eax, dword ptr [ecx + 0x48]

        $sequence_88 = { 48 8b15???????? 48 8d4c2420 e8???????? }
            // n = 5, score = 300
            //   48                   | mov                 eax, dword ptr [ecx + 0x40]
            //   8b15????????         |                     
            //   48                   | dec                 eax
            //   8d4c2420             | mov                 eax, dword ptr [ecx + 0x48]
            //   e8????????           |                     

        $sequence_89 = { e8???????? 48 8b15???????? 48 8d4c2420 e8???????? }
            // n = 6, score = 300
            //   e8????????           |                     
            //   48                   | dec                 eax
            //   8b15????????         |                     
            //   48                   | mov                 dword ptr [esp + 0x38], eax
            //   8d4c2420             | dec                 eax
            //   e8????????           |                     

        $sequence_90 = { 50 897df0 e8???????? 8bf0 85f6 }
            // n = 5, score = 300
            //   50                   | push                eax
            //   897df0               | mov                 dword ptr [ebp - 0x10], edi
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   85f6                 | test                esi, esi

        $sequence_91 = { e8???????? 48 8d4de8 e8???????? }
            // n = 4, score = 200
            //   e8????????           |                     
            //   48                   | mov                 ecx, dword ptr [ecx + 0x28]
            //   8d4de8               | dec                 esp
            //   e8????????           |                     

        $sequence_92 = { 48 8b0b e8???????? 48 8b05???????? 48 }
            // n = 6, score = 200
            //   48                   | dec                 eax
            //   8b0b                 | mov                 dword ptr [esp + 0x38], eax
            //   e8????????           |                     
            //   48                   | dec                 eax
            //   8b05????????         |                     
            //   48                   | mov                 eax, dword ptr [ecx + 0x40]

        $sequence_93 = { 85d2 7e?? 83ea01 31f6 }
            // n = 4, score = 200
            //   85d2                 | push                0x1000477c
            //   7e??                 |                     
            //   83ea01               | and                 esp, 0xfffffff8
            //   31f6                 | sub                 esp, 0x190

        $sequence_94 = { 8b451c a3???????? 8b4520 a3???????? }
            // n = 4, score = 200
            //   8b451c               | mov                 eax, dword ptr [ebp - 8]
            //   a3????????           |                     
            //   8b4520               | cmp                 eax, ebx
            //   a3????????           |                     

        $sequence_95 = { 48 85c0 74?? b9cc000000 }
            // n = 4, score = 200
            //   48                   | mov                 eax, dword ptr [ecx + 0x20]
            //   85c0                 | dec                 eax
            //   74??                 |                     
            //   b9cc000000           | mov                 edx, dword ptr [ecx + 0x18]

        $sequence_97 = { 85db 0f8????????? be01000000 eb?? }
            // n = 4, score = 200
            //   85db                 | pop                 ecx
            //   0f8?????????         |                     
            //   be01000000           | pop                 ebx
            //   eb??                 |                     

        $sequence_98 = { 7e?? 48 8b05???????? 48 85c0 }
            // n = 5, score = 200
            //   7e??                 |                     
            //   48                   | dec                 esp
            //   8b05????????         |                     
            //   48                   | mov                 edx, dword ptr [ecx]
            //   85c0                 | dec                 esp


        $sequence_100 = { 8b451c a3???????? 8b4520 a3???????? }
            // n = 4, score = 200
            //   8b451c               | mov                 eax, 0x5a4d
            //   a3????????           |                     
            //   8b4520               | cmp                 word ptr [edx], ax
            //   a3????????           |                     

        $sequence_102 = { 8d50c0 83e2bf 74?? 83e804 83e0fb }
            // n = 5, score = 200
            //   8d50c0               | push                eax
            //   83e2bf               | mov                 eax, dword ptr [ebp - 8]
            //   74??                 |                     
            //   83e804               | cmp                 eax, ebx
            //   83e0fb               | push                eax

        $sequence_104 = { c745dce8c20001 8b4d08 dd01 8b7510 dd1e e9???????? }
            // n = 6, score = 100
            //   c745dce8c20001       | mov                 ecx, esi
            //   8b4d08               | dec                 eax
            //   dd01                 | mov                 ecx, esi
            //   8b7510               | dec                 eax
            //   dd1e                 | mov                 ecx, esi
            //   e9????????           |                     

        $sequence_105 = { ff15???????? 8b45f8 8d55e8 52 }
            // n = 4, score = 100
            //   ff15????????         |                     
            //   8b45f8               | pop                 edi
            //   8d55e8               | pop                 esi
            //   52                   | pop                 ebp

        $sequence_106 = { 3bc8 75?? 837d0800 74?? f7c100000040 75?? 6818e20001 }
            // n = 7, score = 100
            //   3bc8                 | lea                 ecx, [ebp - 0x40]
            //   75??                 |                     
            //   837d0800             | dec                 eax
            //   74??                 |                     
            //   f7c100000040         | lea                 ecx, [ebp - 0x28]
            //   75??                 |                     
            //   6818e20001           | dec                 eax

        $sequence_107 = { 51 c645ff00 897010 e8???????? 8d0c06 8d45ff e8???????? }
            // n = 7, score = 100
            //   51                   | dec                 eax
            //   c645ff00             | mov                 ecx, dword ptr [ebp + 0x7f]
            //   897010               | dec                 eax
            //   e8????????           |                     
            //   8d0c06               | test                ecx, ecx
            //   8d45ff               | dec                 eax
            //   e8????????           |                     

        $sequence_108 = { 687cf00001 57 8bcb e8???????? e9???????? }
            // n = 5, score = 100
            //   687cf00001           | mov                 ecx, edi
            //   57                   | dec                 eax
            //   8bcb                 | mov                 ecx, edi
            //   e8????????           |                     
            //   e9????????           |                     

        $sequence_109 = { 8945fc 33d2 55 68f43e4000 64ff32 648922 }
            // n = 6, score = 100
            //   8945fc               | bt                  eax, 0x1e
            //   33d2                 | bt                  eax, 0x1f
            //   55                   | bt                  eax, 0x1d
            //   68f43e4000           | bt                  eax, 0x1e
            //   64ff32               | push                0x100b828
            //   648922               | pop                 ecx

        $sequence_110 = { 0f8????????? 6800080000 56 6880c40210 ff15???????? 8bf8 }
            // n = 6, score = 100
            //   0f8?????????         |                     
            //   6800080000           | mov                 esi, dword ptr [ebp + 0x10]
            //   56                   | fstp                qword ptr [esi]
            //   6880c40210           | push                ecx
            //   ff15????????         |                     
            //   8bf8                 | mov                 byte ptr [ebp - 1], 0

        $sequence_111 = { 686c4e4000 8d9528efffff 8b45c8 e8???????? ffb528efffff }
            // n = 5, score = 100
            //   686c4e4000           | mov                 eax, dword ptr [ebx]
            //   8d9528efffff         | bt                  eax, 0x1d
            //   8b45c8               | bt                  eax, 0x1e
            //   e8????????           |                     
            //   ffb528efffff         | bt                  eax, 0x1f

        $sequence_112 = { 74?? 8b442428 8d50c0 83e2bf }
            // n = 4, score = 100
            //   74??                 |                     
            //   8b442428             | push                eax
            //   8d50c0               | mov                 eax, dword ptr [ebp - 8]
            //   83e2bf               | cmp                 eax, ebx

        $sequence_113 = { b9e0440010 e8???????? 50 687c470010 }
            // n = 4, score = 100
            //   b9e0440010           | ret                 
            //   e8????????           |                     
            //   50                   | push                dword ptr [esi]
            //   687c470010           | xor                 eax, eax

        $sequence_114 = { 034a0c 3bc1 72?? 8b12 81fa10764000 75?? c705???????????????? }
            // n = 7, score = 100
            //   034a0c               | mov                 edi, eax
            //   3bc1                 | cmp                 eax, esi
            //   72??                 |                     
            //   8b12                 | mov                 eax, dword ptr [edi]
            //   81fa10764000         | cmp                 dword ptr [eax + 0x1000074], 0xe
            //   75??                 |                     
            //   c705????????????????     |     

        $sequence_115 = { 83e4f8 81ec90010000 e8???????? 85c0 75?? }
            // n = 5, score = 100
            //   83e4f8               | pop                 esi
            //   81ec90010000         | pop                 ebp
            //   e8????????           |                     
            //   85c0                 | ret                 
            //   75??                 |                     

        $sequence_116 = { 0f8????????? 85c9 7e?? 8b442444 c744243820000000 83c031 89442424 }
            // n = 7, score = 100
            //   0f8?????????         |                     
            //   85c9                 | push                eax
            //   7e??                 |                     
            //   8b442444             | mov                 eax, dword ptr [ebp - 8]
            //   c744243820000000     | cmp                 eax, ebx
            //   83c031               | push                eax
            //   89442424             | mov                 eax, dword ptr [ebp - 8]

        $sequence_117 = { c3 b844fe0210 e9???????? 8b45f0 83e001 0f8????????? 8365f0fe }
            // n = 7, score = 100
            //   c3                   | test                ecx, 0x40000000
            //   b844fe0210           | push                0x100e218
            //   e9????????           |                     
            //   8b45f0               | push                ebx
            //   83e001               | mov                 esi, eax
            //   0f8?????????         |                     
            //   8365f0fe             | cmp                 eax, 0x12d4cb

        $sequence_118 = { b9204a0310 e9???????? b90c4a0310 e9???????? b9544a0310 }
            // n = 5, score = 100
            //   b9204a0310           | mov                 eax, dword ptr [ebp + 0x1c]
            //   e9????????           |                     
            //   b90c4a0310           | mov                 eax, dword ptr [ebp + 0x20]
            //   e9????????           |                     
            //   b9544a0310           | push                0x404e6c

        $sequence_119 = { ff15???????? 53 8bf0 ff15???????? ff15???????? 3dcbd41200 75?? }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   53                   | mov                 ecx, dword ptr [ebp - 0x50]
            //   8bf0                 | dec                 eax
            //   ff15????????         |                     
            //   ff15????????         |                     
            //   3dcbd41200           | test                ecx, ecx
            //   75??                 |                     

        $sequence_120 = { 8b04f510530310 8945e0 8b1cf514530310 3bc7 0f8????????? c745fc00000000 }
            // n = 6, score = 100
            //   8b04f510530310       | push                eax
            //   8945e0               | push                dword ptr [ebp - 4]
            //   8b1cf514530310       | push                0x404d80
            //   3bc7                 | mov                 eax, ebx
            //   0f8?????????         |                     
            //   c745fc00000000       | lea                 ecx, [esp + 4]

        $sequence_121 = { 8bc3 e8???????? 8d4c2404 8bd7 b8e4754000 e8???????? }
            // n = 6, score = 100
            //   8bc3                 | bt                  eax, 0x1f
            //   e8????????           |                     
            //   8d4c2404             | mov                 eax, dword ptr [ebx]
            //   8bd7                 | bt                  eax, 0x1d
            //   b8e4754000           | bt                  eax, 0x1e
            //   e8????????           |                     

        $sequence_122 = { 6863454000 64ff30 648920 c745f0ffffffff c745f404000000 8d45ec }
            // n = 6, score = 100
            //   6863454000           | push                0x100f07c
            //   64ff30               | push                edi
            //   648920               | mov                 ecx, ebx
            //   c745f0ffffffff       | mov                 eax, 0x100e568
            //   c745f404000000       | mov                 esi, 0x100e568
            //   8d45ec               | push                edi

        $sequence_123 = { ffd6 68e4400010 57 a3???????? ffd6 }
            // n = 5, score = 100
            //   ffd6                 | push                ebp
            //   68e4400010           | push                dword ptr [esi]
            //   57                   | xor                 eax, eax
            //   a3????????           |                     
            //   ffd6                 | pop                 esi

        $sequence_124 = { e8???????? 6828b80001 8935???????? e8???????? 59 }
            // n = 5, score = 100
            //   e8????????           |                     
            //   6828b80001           | test                eax, eax
            //   8935????????         |                     
            //   e8????????           |                     
            //   59                   | dec                 eax

        $sequence_125 = { 68f4960210 6814030000 be584b0310 56 e8???????? 83c40c 85c0 }
            // n = 7, score = 100
            //   68f4960210           | mov                 edx, edi
            //   6814030000           | mov                 eax, 0x4075e4
            //   be584b0310           | mov                 dword ptr [ebp - 4], eax
            //   56                   | xor                 edx, edx
            //   e8????????           |                     
            //   83c40c               | push                ebp
            //   85c0                 | push                0x403ef4

        $sequence_126 = { 5a e8???????? 8d45d8 50 ff75fc 68804d4000 }
            // n = 6, score = 100
            //   5a                   | mov                 eax, dword ptr [ebx]
            //   e8????????           |                     
            //   8d45d8               | bt                  eax, 0x1d
            //   50                   | bt                  eax, 0x1e
            //   ff75fc               | bt                  eax, 0x1d
            //   68804d4000           | bt                  eax, 0x1e

        $sequence_127 = { 50 e8???????? cc b8945e0210 e8???????? 81ec8c000000 ff7508 }
            // n = 7, score = 100
            //   50                   | mov                 dword ptr [eax + 0x10], esi
            //   e8????????           |                     
            //   cc                   | lea                 ecx, [esi + eax]
            //   b8945e0210           | lea                 eax, [ebp - 1]
            //   e8????????           |                     
            //   81ec8c000000         | cmp                 ecx, eax
            //   ff7508               | cmp                 dword ptr [ebp + 8], 0

        $sequence_128 = { 83b8740000010e 76?? 33c9 39b0e8000001 0f95c1 894de4 }
            // n = 6, score = 100
            //   83b8740000010e       | dec                 eax
            //   76??                 |                     
            //   33c9                 | test                esi, esi
            //   39b0e8000001         | dec                 eax
            //   0f95c1               | mov                 ecx, esi
            //   894de4               | dec                 eax

        $sequence_129 = { b868e50001 be68e50001 57 8bf8 3bc6 73?? 8b07 }
            // n = 7, score = 100
            //   b868e50001           | dec                 eax
            //   be68e50001           | test                edi, edi
            //   57                   | dec                 eax
            //   8bf8                 | mov                 ecx, edi
            //   3bc6                 | dec                 eax
            //   73??                 |                     
            //   8b07                 | mov                 ecx, edi

        $sequence_130 = { c6857effffffda c6857fffffffc2 c6458083 c64581c1 c6458294 c6458382 c6458495 }
            // n = 7, score = 100
            //   c6857effffffda       | xor                 ecx, ecx
            //   c6857fffffffc2       | cmp                 dword ptr [eax + 0x10000e8], esi
            //   c6458083             | setne               cl
            //   c64581c1             | mov                 dword ptr [ebp - 0x1c], ecx
            //   c6458294             | mov                 dword ptr [ebp - 0x24], 0x100c2e8
            //   c6458382             | mov                 ecx, dword ptr [ebp + 8]
            //   c6458495             | fld                 qword ptr [ecx]

        $sequence_131 = { 336833 803390 339433a433a833 b833bc33c0 33c4 }
            // n = 5, score = 100
            //   336833               | lea                 edx, [ebp - 0x10d8]
            //   803390               | mov                 eax, dword ptr [ebp - 0x38]
            //   339433a433a833       | push                dword ptr [ebp - 0x10d8]
            //   b833bc33c0           | pop                 edx
            //   33c4                 | lea                 eax, [ebp - 0x28]

    condition:
        7 of them
}
[TLP:WHITE] win_trickbot_w0   (20170613 | Detects mailsearcher module from Trickbot Trojan)
rule win_trickbot_w0 {
    meta:
        author = "Marc Salinas @Bondey_m"
        description = "Detects mailsearcher module from Trickbot Trojan"
        reference = "https://www.securityartwork.es/wp-content/uploads/2017/06/Informe_Evoluci%C3%B3n_Trickbot.pdf"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot"
        malpedia_version = "20170613"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $str_mails_01 = "mailsearcher"
        $str_mails_02 = "handler"
        $str_mails_03 = "conf"
        $str_mails_04 = "ctl"
        $str_mails_05 = "SetConf"
        $str_mails_06 = "file"
        $str_mails_07 = "needinfo"
        $str_mails_08 = "mailconf"
    condition:
        all of ($str_mails_*)
}
[TLP:WHITE] win_trickbot_w1   (20171214 | Trickbot Socks5 bckconnect module)
rule win_trickbot_w1 {
    meta:
        description = "Trickbot Socks5 bckconnect module"
        author = "@VK_Intel"
        reference = "Detects the unpacked Trickbot backconnect in memory"
        date = "2017-11-19"
        hash = "f2428d5ff8c93500da92f90154eebdf0"
        source = "http://www.vkremez.com/2017/11/lets-learn-trickbot-socks5-backconnect.html"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.trickbot"
        malpedia_version = "20171214"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $s0 = "socks5dll.dll" fullword ascii
        $s1 = "auth_login" fullword ascii
        $s2 = "auth_ip" fullword ascii
        $s3 = "connect" fullword ascii
        $s4 = "auth_ip" fullword ascii
        $s5 = "auth_pass" fullword ascii
        $s6 = "thread.entry_event" fullword ascii
        $s7 = "thread.exit_event" fullword ascii
        $s8 = "</moduleconfig>" fullword ascii
        $s9 = "<moduleconfig>" fullword ascii
        $s10 = "<autostart>yes</autostart>" fullword ascii
    condition:
        all of them
}
Download all Yara Rules