SYMBOLCOMMON_NAMEaka. SYNONYMS
win.unidentified_076 (Back to overview)

Unidentified 076 (Higaisa LNK to Shellcode)

Actor(s): Higaisa


There is no description at this point.

References
2020-06-14BushidoTokenBushidoToken
@online{bushidotoken:20200614:deepdive:3a375ca, author = {BushidoToken}, title = {{Deep-dive: The DarkHotel APT}}, date = {2020-06-14}, organization = {BushidoToken}, url = {https://blog.bushidotoken.net/2020/06/deep-dive-darkhotel-apt.html}, language = {English}, urldate = {2020-06-16} } Deep-dive: The DarkHotel APT
Asruex Ghost RAT Ramsay Retro Unidentified 076 (Higaisa LNK to Shellcode)
2020-06-11ZscalerSudeep Singh, Atinderpal Singh
@online{singh:20200611:return:3a58e44, author = {Sudeep Singh and Atinderpal Singh}, title = {{The Return of the Higaisa APT}}, date = {2020-06-11}, organization = {Zscaler}, url = {https://www.zscaler.com/blogs/research/return-higaisa-apt}, language = {English}, urldate = {2020-06-12} } The Return of the Higaisa APT
Unidentified 076 (Higaisa LNK to Shellcode)
Yara Rules
[TLP:WHITE] win_unidentified_076_auto (20201014 | autogenerated rule brought to you by yara-signator)
rule win_unidentified_076_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-10-14"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.5.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_076"
        malpedia_rule_date = "20201014"
        malpedia_hash = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
        malpedia_version = "20201014"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 418d8640ffffff 488d97c0000000 4c63c0 85c0 7e1f 4c635738 488bcb }
            // n = 7, score = 100
            //   418d8640ffffff       | mov                 edx, dword ptr [eax + 0x2d8]
            //   488d97c0000000       | dec                 esp
            //   4c63c0               | mov                 ecx, esi
            //   85c0                 | inc                 ebp
            //   7e1f                 | xor                 eax, eax
            //   4c635738             | inc                 esp
            //   488bcb               | mov                 ecx, eax

        $sequence_1 = { 488b87c8000000 8b9068050000 ebb7 488b0e 4c8d8c2440010000 4c8d442430 }
            // n = 6, score = 100
            //   488b87c8000000       | mov                 word ptr [ebx + 0x8b0], dx
            //   8b9068050000         | mov                 word ptr [ebx + 0x8b2], cx
            //   ebb7                 | mov                 ecx, dword ptr [ebx + 0xaf0]
            //   488b0e               | inc                 ecx
            //   4c8d8c2440010000     | cmp                 ecx, esp
            //   4c8d442430           | jne                 0x1766

        $sequence_2 = { 4156 4157 4883ec20 4c8bea 488bf9 4885c9 }
            // n = 6, score = 100
            //   4156                 | mov                 eax, dword ptr [ebx + 0x108]
            //   4157                 | dec                 eax
            //   4883ec20             | mov                 ecx, dword ptr [ebx + 0xe0]
            //   4c8bea               | mov                 dword ptr [ebx + 4], 0x1405
            //   488bf9               | mov                 dword ptr [ebx + 8], 0x13ed
            //   4885c9               | dec                 eax

        $sequence_3 = { 448bce 448bc5 33c9 ff97f8000000 48898718020000 4885c0 0f8424010000 }
            // n = 7, score = 100
            //   448bce               | dec                 eax
            //   448bc5               | mov                 eax, dword ptr [edi + 0xc8]
            //   33c9                 | call                dword ptr [eax + 0x30]
            //   ff97f8000000         | dec                 eax
            //   48898718020000       | mov                 dword ptr [edi + 0x298], esi
            //   4885c0               | dec                 eax
            //   0f8424010000         | mov                 eax, dword ptr [edi + 0xc8]

        $sequence_4 = { 894628 452bc6 4103c8 3b4b04 7e11 498bd6 }
            // n = 6, score = 100
            //   894628               | inc                 ecx
            //   452bc6               | mov                 eax, 0x1405
            //   4103c8               | dec                 eax
            //   3b4b04               | mov                 ecx, esi
            //   7e11                 | call                dword ptr [eax + 0x260]
            //   498bd6               | dec                 eax

        $sequence_5 = { 4889736c 89b3f4000000 c7432402000000 4889b3e8000000 c7437c14000000 4889b3f8000000 4889b300010000 }
            // n = 7, score = 100
            //   4889736c             | je                  0x18e2
            //   89b3f4000000         | dec                 eax
            //   c7432402000000       | mov                 eax, dword ptr [ebp + 0xc8]
            //   4889b3e8000000       | dec                 eax
            //   c7437c14000000       | mov                 ecx, dword ptr [ebp + 0x1c0]
            //   4889b3f8000000       | call                dword ptr [edx + 0x7f0]
            //   4889b300010000       | dec                 eax

        $sequence_6 = { 488d0cc7 ff9280010000 ffc3 4863c3 4883f804 72dc 488bcf }
            // n = 7, score = 100
            //   488d0cc7             | jl                  0x1bc6
            //   ff9280010000         | jmp                 0x1bf3
            //   ffc3                 | dec                 ecx
            //   4863c3               | add                 ecx, esp
            //   4883f804             | dec                 eax
            //   72dc                 | mov                 edx, ebp
            //   488bcf               | inc                 ecx

        $sequence_7 = { 0f8825010000 81fd05140000 7e0a b8fdffffff e9???????? 8b473c 33c9 }
            // n = 7, score = 100
            //   0f8825010000         | dec                 eax
            //   81fd05140000         | mov                 ecx, edi
            //   7e0a                 | mov                 dword ptr [esp + 0x28], esi
            //   b8fdffffff           | mov                 dword ptr [esp + 0x20], esi
            //   e9????????           |                     
            //   8b473c               | inc                 ecx
            //   33c9                 | lea                 ebx, [ecx + 1]

        $sequence_8 = { 480180a0000000 488b4618 395864 7e21 488bd3 488b4618 4503c5 }
            // n = 7, score = 100
            //   480180a0000000       | mov                 dword ptr [eax + 0x20], edi
            //   488b4618             | inc                 ecx
            //   395864               | push                esp
            //   7e21                 | inc                 ecx
            //   488bd3               | push                esi
            //   488b4618             | inc                 ecx
            //   4503c5               | push                edi

        $sequence_9 = { 4489ad30150000 eb18 33d2 41b800800000 488bce }
            // n = 5, score = 100
            //   4489ad30150000       | mov                 dword ptr [ebx + 0x80], eax
            //   eb18                 | dec                 eax
            //   33d2                 | add                 esp, 0x38
            //   41b800800000         | inc                 ecx
            //   488bce               | pop                 edi

    condition:
        7 of them and filesize < 114688
}
Download all Yara Rules