Actor(s): Turla Group
There is no description at this point.
rule win_turla_rpc_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-05-16" version = "1" description = "Detects win.turla_rpc." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.turla_rpc" malpedia_rule_date = "20220513" malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26" malpedia_version = "20220516" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 660f6f05???????? 66c785ec0000000255 c785a0000000193a3431 c785a4000000193c3727 c785a800000034272c02 } // n = 5, score = 200 // 660f6f05???????? | // 66c785ec0000000255 | mov dword ptr [ebp + 0x118], 0x2630363a // c785a0000000193a3431 | mov word ptr [ebp + 0x11c], 0x226 // c785a4000000193c3727 | mov byte ptr [ebp + 0x11e], 0x55 // c785a800000034272c02 | mov dword ptr [ebp + 0x90], 0x34302716 $sequence_1 = { 4885c0 744e 4c8b4708 488b17 488bcb } // n = 5, score = 200 // 4885c0 | dec eax // 744e | test eax, eax // 4c8b4708 | je 0x50 // 488b17 | dec esp // 488bcb | mov eax, dword ptr [edi + 8] $sequence_2 = { 660f6f05???????? c7858000000012302101 c7858400000030382505 c7858800000034213d02 f30f7f8530010000 } // n = 5, score = 200 // 660f6f05???????? | // c7858000000012302101 | dec eax // c7858400000030382505 | mov edx, dword ptr [edi] // c7858800000034213d02 | dec eax // f30f7f8530010000 | mov ecx, ebx $sequence_3 = { c645bc55 c7854001000030163930 c78544010000343b2025 c6854801000055 c78560010000013c3830 c785640100003a202155 c785a8010000271c3367 } // n = 7, score = 200 // c645bc55 | mov byte ptr [ebp - 0x44], 0x55 // c7854001000030163930 | mov dword ptr [ebp + 0x140], 0x30391630 // c78544010000343b2025 | mov dword ptr [ebp + 0x144], 0x25203b34 // c6854801000055 | mov byte ptr [ebp + 0x148], 0x55 // c78560010000013c3830 | mov dword ptr [ebp + 0x160], 0x30383c01 // c785640100003a202155 | mov dword ptr [ebp + 0x164], 0x5521203a // c785a8010000271c3367 | mov dword ptr [ebp + 0x1a8], 0x67331c27 $sequence_4 = { c745b06970746f c745b472536163 66c745b86c00 ff15???????? } // n = 4, score = 200 // c745b06970746f | mov dword ptr [ebp - 0x50], 0x6f747069 // c745b472536163 | mov dword ptr [ebp - 0x4c], 0x63615372 // 66c745b86c00 | mov word ptr [ebp - 0x48], 0x6c // ff15???????? | $sequence_5 = { c785900100002130271c 66c785940100003355 c7857801000026302410 66c7857c0100002502 c6857e01000055 c7452038262336 } // n = 6, score = 200 // c785900100002130271c | mov dword ptr [ebp + 0x190], 0x1c273021 // 66c785940100003355 | mov word ptr [ebp + 0x194], 0x5533 // c7857801000026302410 | mov dword ptr [ebp + 0x178], 0x10243026 // 66c7857c0100002502 | mov word ptr [ebp + 0x17c], 0x225 // c6857e01000055 | mov byte ptr [ebp + 0x17e], 0x55 // c7452038262336 | mov dword ptr [ebp + 0x20], 0x36232638 $sequence_6 = { 66c745082133 c6450a55 c745980a22333a c7459c25303b55 } // n = 4, score = 200 // 66c745082133 | mov dword ptr [ebp + 0xe0], 0x3213012 // c6450a55 | mov dword ptr [ebp + 0xe4], 0x3c262730 // c745980a22333a | mov dword ptr [ebp + 0xe8], 0x2d103b3a // c7459c25303b55 | movdqu xmmword ptr [ebp + 0x1e0], xmm0 $sequence_7 = { c7851001000016273034 c7851401000021300527 c785180100003a363026 66c7851c0100002602 c6851e01000055 c7859000000016273034 } // n = 6, score = 200 // c7851001000016273034 | mov dword ptr [ebp + 0x80], 0x1213012 // c7851401000021300527 | mov dword ptr [ebp + 0x84], 0x5253830 // c785180100003a363026 | mov dword ptr [ebp + 0x88], 0x23d2134 // 66c7851c0100002602 | movdqu xmmword ptr [ebp + 0x130], xmm0 // c6851e01000055 | mov dword ptr [ebp + 0x110], 0x34302716 // c7859000000016273034 | mov dword ptr [ebp + 0x114], 0x27053021 $sequence_8 = { c785e000000012302103 c785e40000003027263c c785e80000003a3b102d f30f7f85e0010000 660f6f05???????? } // n = 5, score = 200 // c785e000000012302103 | mov dword ptr [ebp + 0xe0], 0x3213012 // c785e40000003027263c | mov dword ptr [ebp + 0xe4], 0x3c262730 // c785e80000003a3b102d | mov dword ptr [ebp + 0xe8], 0x2d103b3a // f30f7f85e0010000 | movdqu xmmword ptr [ebp + 0x1e0], xmm0 // 660f6f05???????? | $sequence_9 = { 83e11f c1e106 83c10c 8b0485d8860110 } // n = 4, score = 100 // 83e11f | and ecx, 0x1f // c1e106 | shl ecx, 6 // 83c10c | add ecx, 0xc // 8b0485d8860110 | mov eax, dword ptr [eax*4 + 0x100186d8] $sequence_10 = { 40 83f80b 72f5 c78528feffff5f736e70 } // n = 4, score = 100 // 40 | inc eax // 83f80b | cmp eax, 0xb // 72f5 | jb 0xfffffff7 // c78528feffff5f736e70 | mov dword ptr [ebp - 0x1d8], 0x706e735f $sequence_11 = { 50 e8???????? 818da0fdffff01010000 0f57c0 33c0 c78574fdffff44000000 53 } // n = 7, score = 100 // 50 | push eax // e8???????? | // 818da0fdffff01010000 | or dword ptr [ebp - 0x260], 0x101 // 0f57c0 | xorps xmm0, xmm0 // 33c0 | xor eax, eax // c78574fdffff44000000 | mov dword ptr [ebp - 0x28c], 0x44 // 53 | push ebx $sequence_12 = { c745e870006500 c745ec5c006100 c745f074006300 c745f474006c00 } // n = 4, score = 100 // c745e870006500 | mov dword ptr [ebp - 0x18], 0x650070 // c745ec5c006100 | mov dword ptr [ebp - 0x14], 0x61005c // c745f074006300 | mov dword ptr [ebp - 0x10], 0x630074 // c745f474006c00 | mov dword ptr [ebp - 0xc], 0x6c0074 $sequence_13 = { 6a00 68???????? ff15???????? 8b4dfc b801000000 33cd } // n = 6, score = 100 // 6a00 | push 0 // 68???????? | // ff15???????? | // 8b4dfc | mov ecx, dword ptr [ebp - 4] // b801000000 | mov eax, 1 // 33cd | xor ecx, ebp $sequence_14 = { ff9570fdffff 8987a8000000 8d45ec 50 53 8b9d70fdffff ffd3 } // n = 7, score = 100 // ff9570fdffff | call dword ptr [ebp - 0x290] // 8987a8000000 | mov dword ptr [edi + 0xa8], eax // 8d45ec | lea eax, [ebp - 0x14] // 50 | push eax // 53 | push ebx // 8b9d70fdffff | mov ebx, dword ptr [ebp - 0x290] // ffd3 | call ebx $sequence_15 = { 8d8578ffffff 50 53 ff9570fdffff 898784000000 } // n = 5, score = 100 // 8d8578ffffff | lea eax, [ebp - 0x88] // 50 | push eax // 53 | push ebx // ff9570fdffff | call dword ptr [ebp - 0x290] // 898784000000 | mov dword ptr [edi + 0x84], eax condition: 7 of them and filesize < 311296 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY