Ransomware written in Nim.
rule win_unidentified_088_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.unidentified_088." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_088" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8b430c 0f85bd000000 e9???????? 8b07 85c0 7ee8 8d50ff } // n = 7, score = 100 // 8b430c | mov eax, dword ptr [ebx + 0xc] // 0f85bd000000 | jne 0xc3 // e9???????? | // 8b07 | mov eax, dword ptr [edi] // 85c0 | test eax, eax // 7ee8 | jle 0xffffffea // 8d50ff | lea edx, [eax - 1] $sequence_1 = { 8d4dd0 ba01000000 0fb63c38 8b45ac c1e710 e8???????? 84c0 } // n = 7, score = 100 // 8d4dd0 | lea ecx, [ebp - 0x30] // ba01000000 | mov edx, 1 // 0fb63c38 | movzx edi, byte ptr [eax + edi] // 8b45ac | mov eax, dword ptr [ebp - 0x54] // c1e710 | shl edi, 0x10 // e8???????? | // 84c0 | test al, al $sequence_2 = { e8???????? 51 51 8b06 39c7 0f848b000000 85c0 } // n = 7, score = 100 // e8???????? | // 51 | push ecx // 51 | push ecx // 8b06 | mov eax, dword ptr [esi] // 39c7 | cmp edi, eax // 0f848b000000 | je 0x91 // 85c0 | test eax, eax $sequence_3 = { d9c9 dbe9 7a02 7438 dce9 d9ee dbf2 } // n = 7, score = 100 // d9c9 | fxch st(1) // dbe9 | fucomi st(1) // 7a02 | jp 4 // 7438 | je 0x3a // dce9 | fsub st(1), st(0) // d9ee | fldz // dbf2 | fcomi st(2) $sequence_4 = { c705????????00ae4200 c705????????fa5b4100 c705????????00000000 c705????????01000000 c705????????01000000 66c705????????0e03 8b0c8540e94100 } // n = 7, score = 100 // c705????????00ae4200 | // c705????????fa5b4100 | // c705????????00000000 | // c705????????01000000 | // c705????????01000000 | // 66c705????????0e03 | // 8b0c8540e94100 | mov ecx, dword ptr [eax*4 + 0x41e940] $sequence_5 = { e8???????? 8975d4 eb2d 807dcf00 8b75e4 740a 8b4b68 } // n = 7, score = 100 // e8???????? | // 8975d4 | mov dword ptr [ebp - 0x2c], esi // eb2d | jmp 0x2f // 807dcf00 | cmp byte ptr [ebp - 0x31], 0 // 8b75e4 | mov esi, dword ptr [ebp - 0x1c] // 740a | je 0xc // 8b4b68 | mov ecx, dword ptr [ebx + 0x68] $sequence_6 = { 31d2 e8???????? c7442408d8030000 ba???????? 89d9 c7442404???????? c70424???????? } // n = 7, score = 100 // 31d2 | xor edx, edx // e8???????? | // c7442408d8030000 | mov dword ptr [esp + 8], 0x3d8 // ba???????? | // 89d9 | mov ecx, ebx // c7442404???????? | // c70424???????? | $sequence_7 = { c605????????02 c705????????40004200 c705????????f0004200 c705????????04000000 c705????????04000000 c605????????18 c705????????808b4200 } // n = 7, score = 100 // c605????????02 | // c705????????40004200 | // c705????????f0004200 | // c705????????04000000 | // c705????????04000000 | // c605????????18 | // c705????????808b4200 | $sequence_8 = { 0f8591000000 8b5310 8b430c 85d2 740e 8b12 85d2 } // n = 7, score = 100 // 0f8591000000 | jne 0x97 // 8b5310 | mov edx, dword ptr [ebx + 0x10] // 8b430c | mov eax, dword ptr [ebx + 0xc] // 85d2 | test edx, edx // 740e | je 0x10 // 8b12 | mov edx, dword ptr [edx] // 85d2 | test edx, edx $sequence_9 = { 2345d0 8945d4 8b03 85c0 740a 8b00 } // n = 6, score = 100 // 2345d0 | and eax, dword ptr [ebp - 0x30] // 8945d4 | mov dword ptr [ebp - 0x2c], eax // 8b03 | mov eax, dword ptr [ebx] // 85c0 | test eax, eax // 740a | je 0xc // 8b00 | mov eax, dword ptr [eax] condition: 7 of them and filesize < 919552 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY