SYMBOLCOMMON_NAMEaka. SYNONYMS
win.unidentified_076 (Back to overview)

Unidentified 076 (Higaisa LNK to Shellcode)

Actor(s): Higaisa


There is no description at this point.

References
2020-11-13Youtube (The Standoff)Alexey Zakharov, Positive Technologies
@online{zakharov:20201113:ff202eng:1d1222c, author = {Alexey Zakharov and Positive Technologies}, title = {{FF_202_Eng - From old Higaisa samples to new Winnti backdoors: The story of one research}}, date = {2020-11-13}, organization = {Youtube (The Standoff)}, url = {https://www.youtube.com/watch?v=8x-pGlWpIYI}, language = {English}, urldate = {2020-11-23} } FF_202_Eng - From old Higaisa samples to new Winnti backdoors: The story of one research
CROSSWALK Unidentified 076 (Higaisa LNK to Shellcode)
2020-06-14BushidoTokenBushidoToken
@online{bushidotoken:20200614:deepdive:3a375ca, author = {BushidoToken}, title = {{Deep-dive: The DarkHotel APT}}, date = {2020-06-14}, organization = {BushidoToken}, url = {https://blog.bushidotoken.net/2020/06/deep-dive-darkhotel-apt.html}, language = {English}, urldate = {2020-06-16} } Deep-dive: The DarkHotel APT
Asruex Ghost RAT Ramsay Retro Unidentified 076 (Higaisa LNK to Shellcode)
2020-06-11ZscalerSudeep Singh, Atinderpal Singh
@online{singh:20200611:return:3a58e44, author = {Sudeep Singh and Atinderpal Singh}, title = {{The Return of the Higaisa APT}}, date = {2020-06-11}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/research/return-higaisa-apt}, language = {English}, urldate = {2020-06-12} } The Return of the Higaisa APT
Unidentified 076 (Higaisa LNK to Shellcode)
Yara Rules
[TLP:WHITE] win_unidentified_076_auto (20221125 | Detects win.unidentified_076.)
rule win_unidentified_076_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.unidentified_076."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_076"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 416bc207 4103c1 99 83e207 03c2 c1f803 }
            // n = 6, score = 100
            //   416bc207             | dec                 esp
            //   4103c1               | mov                 eax, edi
            //   99                   | dec                 ecx
            //   83e207               | mov                 edx, edi
            //   03c2                 | dec                 eax
            //   c1f803               | mov                 ecx, edi

        $sequence_1 = { 488b87c8000000 418b5604 488bcb ff90f0070000 488b87c8000000 4d8bc7 33d2 }
            // n = 7, score = 100
            //   488b87c8000000       | mov                 ebx, 0x104
            //   418b5604             | dec                 eax
            //   488bcb               | mov                 ecx, ebx
            //   ff90f0070000         | call                dword ptr [eax + 0x610]
            //   488b87c8000000       | dec                 eax
            //   4d8bc7               | mov                 ebx, eax
            //   33d2                 | dec                 eax

        $sequence_2 = { 488b97c8000000 488d8f08070000 ff92f0070000 33d2 488bcf 448d4201 e8???????? }
            // n = 7, score = 100
            //   488b97c8000000       | mov                 eax, dword ptr [esi + 0xc8]
            //   488d8f08070000       | dec                 eax
            //   ff92f0070000         | lea                 edx, [esi + 0x974]
            //   33d2                 | dec                 eax
            //   488bcf               | mov                 ecx, edi
            //   448d4201             | call                dword ptr [eax + 0xc0]
            //   e8????????           |                     

        $sequence_3 = { 488bd8 4885c0 0f849d000000 488b87c8000000 4c634604 498bd7 488bcb }
            // n = 7, score = 100
            //   488bd8               | dec                 eax
            //   4885c0               | mov                 esi, dword ptr [esp + 0x70]
            //   0f849d000000         | dec                 eax
            //   488b87c8000000       | mov                 edi, dword ptr [esp + 0x78]
            //   4c634604             | dec                 eax
            //   498bd7               | lea                 ecx, [esp + 0x40]
            //   488bcb               | xor                 edx, edx

        $sequence_4 = { 85c0 0f8f53feffff 488b87c8000000 33db ff9050010000 41b86e1b0000 e9???????? }
            // n = 7, score = 100
            //   85c0                 | dec                 ecx
            //   0f8f53feffff         | mov                 edx, esp
            //   488b87c8000000       | jne                 0x3ce
            //   33db                 | dec                 eax
            //   ff9050010000         | mov                 ecx, dword ptr [ebx + 0xe0]
            //   41b86e1b0000         | mov                 edi, 0x8000
            //   e9????????           |                     

        $sequence_5 = { eb02 33c0 85c0 7f0b 41b903000000 e9???????? }
            // n = 6, score = 100
            //   eb02                 | dec                 eax
            //   33c0                 | sub                 esp, 0x20
            //   85c0                 | dec                 eax
            //   7f0b                 | mov                 eax, dword ptr [ecx + 0xc8]
            //   41b903000000         | dec                 esp
            //   e9????????           |                     

        $sequence_6 = { ff9290040000 8bc7 488b5c2458 4883c430 5f 5e 5d }
            // n = 7, score = 100
            //   ff9290040000         | dec                 eax
            //   8bc7                 | lea                 ebx, [ecx + 0x88]
            //   488b5c2458           | dec                 eax
            //   4883c430             | cmp                 ebx, dword ptr [ebx]
            //   5f                   | je                  0xe1f
            //   5e                   | test                eax, eax
            //   5d                   | inc                 ecx

        $sequence_7 = { 488b8108010000 453bc7 450f4cf8 33c9 41b800100000 448d4904 4103d7 }
            // n = 7, score = 100
            //   488b8108010000       | mov                 ecx, dword ptr [esi + 0xaa0]
            //   453bc7               | dec                 ecx
            //   450f4cf8             | mov                 edx, ebp
            //   33c9                 | call                dword ptr [eax + 0xc0]
            //   41b800100000         | dec                 eax
            //   448d4904             | mov                 eax, dword ptr [esi + 0xc8]
            //   4103d7               | inc                 ebp

        $sequence_8 = { 33ff 48217c2420 ebb3 418937 498bd4 397d68 7524 }
            // n = 7, score = 100
            //   33ff                 | dec                 ecx
            //   48217c2420           | mov                 ecx, esi
            //   ebb3                 | inc                 ecx
            //   418937               | call                dword ptr [eax + 0x7f0]
            //   498bd4               | inc                 esp
            //   397d68               | lea                 eax, [edx + 0x20]
            //   7524                 | call                dword ptr [eax + 0x720]

        $sequence_9 = { 33d2 41b808020000 488bcd ff9020070000 488b87c8000000 488b9424a0000000 488d9f5c060000 }
            // n = 7, score = 100
            //   33d2                 | dec                 eax
            //   41b808020000         | mov                 ecx, ebx
            //   488bcd               | dec                 eax
            //   ff9020070000         | mov                 dword ptr [ebx + 0x5c], esi
            //   488b87c8000000       | dec                 eax
            //   488b9424a0000000     | mov                 dword ptr [ebx + 0x64], esi
            //   488d9f5c060000       | mov                 dword ptr [ebx + 0xd0], esi

    condition:
        7 of them and filesize < 114688
}
Download all Yara Rules