Actor(s): APT29
There is no description at this point.
rule win_unidentified_098_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.unidentified_098." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.unidentified_098" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 664183f907 0fb6c0 410f94c3 6685c0 7459 41f6c301 7453 } // n = 7, score = 300 // 664183f907 | mov dword ptr [ebx + 0x160], edx // 0fb6c0 | mov eax, 1 // 410f94c3 | dec esp // 6685c0 | lea esi, [ecx + 0xd0] // 7459 | dec esp // 41f6c301 | lea ebp, [ecx + 0x110] // 7453 | dec esp $sequence_1 = { e8???????? 488b05???????? 8b00 85c0 752a 418b47f8 8d50ff } // n = 7, score = 300 // e8???????? | // 488b05???????? | // 8b00 | mov dword ptr [ecx], eax // 85c0 | dec ecx // 752a | mov dword ptr [esp + 0x10], eax // 418b47f8 | dec eax // 8d50ff | add esp, 0x28 $sequence_2 = { 4c89fa 4d85ed 4c0f48e8 e8???????? 8b4318 4883ec40 488d742440 } // n = 7, score = 300 // 4c89fa | dec eax // 4d85ed | lea ebp, [ecx + 0x10] // 4c0f48e8 | dec eax // e8???????? | // 8b4318 | mov dword ptr [ecx + 0x10], eax // 4883ec40 | dec eax // 488d742440 | mov edi, edx $sequence_3 = { 7406 e8???????? 90 4883c448 5b 415c c3 } // n = 7, score = 300 // 7406 | dec esp // e8???????? | // 90 | lea ebp, [esp + 0xa0] // 4883c448 | dec esp // 5b | mov ecx, esi // 415c | dec eax // c3 | lea edx, [0xb7e04] $sequence_4 = { 8b41f8 8d50ff 8951f8 85c0 7e58 8b13 488b4c2430 } // n = 7, score = 300 // 8b41f8 | mov eax, 0x4945 // 8d50ff | dec eax // 8951f8 | lea ecx, [0x2609c] // 85c0 | call ebp // 7e58 | inc ecx // 8b13 | movzx eax, byte ptr [esp + 0x40] // 488b4c2430 | mov edx, eax $sequence_5 = { ff5028 488b442428 488b68e8 488d4d01 e8???????? 4531c9 4989e8 } // n = 7, score = 300 // ff5028 | add esp, 0x38 // 488b442428 | ret // 488b68e8 | mov dword ptr [esp + 0x2c], 0x77cd4c6 // 488d4d01 | test al, al // e8???????? | // 4531c9 | je 0x138 // 4989e8 | dec eax $sequence_6 = { 83f8fe 0f847e000000 39c7 0f829e000000 8903 488b442438 4883c304 } // n = 7, score = 300 // 83f8fe | test si, si // 0f847e000000 | jne 0xc52 // 39c7 | inc ecx // 0f829e000000 | movzx ecx, byte ptr [ebp + 0x62] // 8903 | inc cx // 488b442438 | or dword ptr [ebp + 0x60], eax // 4883c304 | or edx, ecx $sequence_7 = { e8???????? db6df0 448b45d0 4d89f9 48894518 488d742440 4c89e9 } // n = 7, score = 300 // e8???????? | // db6df0 | lea eax, [0x160d9e] // 448b45d0 | dec eax // 4d89f9 | add esp, 0x48 // 48894518 | pop esi // 488d742440 | vmovups xmmword ptr [esp + 0x20], xmm0 // 4c89e9 | test al, al $sequence_8 = { 85d2 0f88d5000000 4c8d5904 4189d2 4c8d4910 83fa0f 7e33 } // n = 7, score = 300 // 85d2 | lea ecx, [0x16824e] // 0f88d5000000 | je 0x1943 // 4c8d5904 | dec eax // 4189d2 | lea eax, [0x16a864] // 4c8d4910 | dec eax // 83fa0f | add esp, 0x38 // 7e33 | pop esi $sequence_9 = { 8d70d0 83fe09 0f874d020000 c1e60c c5c9d44320 807b1800 c5f8114320 } // n = 7, score = 300 // 8d70d0 | dec eax // 83fe09 | add ebx, 0x10 // 0f874d020000 | dec eax // c1e60c | dec esi // c5c9d44320 | jle 0x2e6 // 807b1800 | nop // c5f8114320 | dec eax condition: 7 of them and filesize < 3345408 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY