Actor(s): Lazarus Group
There is no description at this point.
rule win_volgmer_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2026-09-17" version = "1" description = "Detects win.volgmer." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.volgmer" malpedia_rule_date = "20260916" malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6" malpedia_version = "20260917" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { e8???????? 8bd7 c6843d1015000000 488d8d10150000 e8???????? 488d9510150000 488bce } // n = 7, score = 200 // e8???????? | // 8bd7 | add dword ptr [ebx + 0x14], edx // c6843d1015000000 | test eax, eax // 488d8d10150000 | jne 0xfffffd6b // e8???????? | // 488d9510150000 | test esi, esi // 488bce | jne 0xffffff8d $sequence_1 = { 448bc7 488d8da0070000 4c8bf0 e8???????? 8bd7 c6843da007000000 488d8da0070000 } // n = 7, score = 200 // 448bc7 | dec eax // 488d8da0070000 | mov ecx, dword ptr [ebx + 0x270] // 4c8bf0 | dec eax // e8???????? | // 8bd7 | mov ebp, dword ptr [ebx + 0x128] // c6843da007000000 | dec eax // 488d8da0070000 | test ecx, ecx $sequence_2 = { 84c0 75f0 488d542430 488d8dc0050000 ff542420 488bd8 } // n = 6, score = 200 // 84c0 | jmp 0x1f // 75f0 | lea eax, [esp + 0x10] // 488d542430 | push 0x10 // 488d8dc0050000 | push eax // ff542420 | push 0xff52 // 488bd8 | add esp, 8 $sequence_3 = { 8d4b41 888c24a0000000 488d8c24a0000000 41ffd6 8bcf } // n = 5, score = 200 // 8d4b41 | test esi, esi // 888c24a0000000 | jne 0xffffff8b // 488d8c24a0000000 | cmp dword ptr [ebp + 0x4c], edx // 41ffd6 | mov eax, dword ptr [ebx + 0x6c] // 8bcf | add dword ptr [esi + 0x14], edx $sequence_4 = { 4885c0 7419 33d2 488bc8 41ffd5 } // n = 5, score = 200 // 4885c0 | jle 0x29 // 7419 | add esi, eax // 33d2 | mov eax, dword ptr [ebp] // 488bc8 | push edi // 41ffd5 | push 0x104 $sequence_5 = { 4533c0 498bd5 33c9 c744242800000008 } // n = 4, score = 200 // 4533c0 | inc ebp // 498bd5 | xor eax, eax // 33c9 | dec ecx // c744242800000008 | mov edx, ebp $sequence_6 = { 33d2 0fb705???????? 41b8c1000000 0f1185d8090000 668985180a0000 0f2805???????? 0fb605???????? } // n = 7, score = 200 // 33d2 | test eax, eax // 0fb705???????? | // 41b8c1000000 | je 0x31 // 0f1185d8090000 | mov ecx, dword ptr [esp + 0x18] // 668985180a0000 | test eax, eax // 0f2805???????? | // 0fb605???????? | $sequence_7 = { 8d14c7 eb05 ba40000200 44894c2420 448bc6 } // n = 5, score = 200 // 8d14c7 | jne 0xffffff8d // eb05 | cmp dword ptr [ebp + 0x4c], edx // ba40000200 | add dword ptr [ebx + 0x14], edx // 44894c2420 | test eax, eax // 448bc6 | jne 0xfffffd69 $sequence_8 = { ff542468 488b4580 488d8da0040000 ffd0 } // n = 4, score = 200 // ff542468 | add dword ptr [ebx + 0x14], edx // 488b4580 | test eax, eax // 488d8da0040000 | jne 0xfffffd6b // ffd0 | test esi, esi $sequence_9 = { e8???????? e8???????? e8???????? c705????????04000000 } // n = 4, score = 200 // e8???????? | // e8???????? | // e8???????? | // c705????????04000000 | $sequence_10 = { 57 6804010000 6a40 ff15???????? 6800020000 } // n = 5, score = 100 // 57 | add dword ptr [ebx + 0x14], ecx // 6804010000 | cmp dword ptr [ebx + 0x48], esi // 6a40 | je 0x1d // ff15???????? | // 6800020000 | dec eax $sequence_11 = { 015314 85c0 0f8563fdffff 85f6 } // n = 4, score = 100 // 015314 | inc ecx // 85c0 | mov eax, edx // 0f8563fdffff | rol eax, 5 // 85f6 | add dword ptr [ecx + 8], eax $sequence_12 = { 3b4b3b 52 3b5e3b 6a3b } // n = 4, score = 100 // 3b4b3b | inc ecx // 52 | mov eax, 0xc1 // 3b5e3b | movups xmmword ptr [ebp + 0x9d8], xmm0 // 6a3b | mov word ptr [ebp + 0xa18], ax $sequence_13 = { 66a3???????? c705????????02000000 5d eb7e 6a00 6a00 } // n = 6, score = 100 // 66a3???????? | // c705????????02000000 | // 5d | cmp dword ptr [ebx + 0x48], esi // eb7e | je 0x15 // 6a00 | dec eax // 6a00 | mov ecx, ebx $sequence_14 = { eb1d 8b0d???????? 8d442410 6a10 50 6852ff0000 } // n = 6, score = 100 // eb1d | inc ecx // 8b0d???????? | // 8d442410 | add eax, ebp // 6a10 | add edi, esi // 50 | add dword ptr [ebx + 0x14], ecx // 6852ff0000 | cmp dword ptr [ebx + 0x48], esi $sequence_15 = { 8d45d0 8a10 3a11 751a 84d2 7412 } // n = 6, score = 100 // 8d45d0 | xor eax, eax // 8a10 | dec ecx // 3a11 | mov edx, ebp // 751a | xor ecx, ecx // 84d2 | mov dword ptr [esp + 0x28], 0x8000000 // 7412 | inc eax $sequence_16 = { 4053 4883ec20 488d0d7be50100 ff15???????? 488bd8 4885c0 } // n = 6, score = 100 // 4053 | push 0 // 4883ec20 | mov ebx, 5 // 488d0d7be50100 | mov byte ptr [ecx + 4], al // ff15???????? | // 488bd8 | jmp 0x40 // 4885c0 | mov ecx, dword ptr [esp + 0x24] $sequence_17 = { 008a01010000 488b4708 440fb68001010000 0fb69000010000 4803d0 } // n = 5, score = 100 // 008a01010000 | xor ecx, ecx // 488b4708 | mov dword ptr [esp + 0x28], 0x8000000 // 440fb68001010000 | add byte ptr [edx + 0x101], cl // 0fb69000010000 | dec eax // 4803d0 | mov eax, dword ptr [edi + 8] $sequence_18 = { 014108 448b4108 418bc2 c1c005 } // n = 4, score = 100 // 014108 | add edx, eax // 448b4108 | dec esp // 418bc2 | add eax, eax // c1c005 | movzx ecx, byte ptr [edx] $sequence_19 = { 448bc7 e8???????? 85c0 7447 807c243017 7540 b801030000 } // n = 7, score = 100 // 448bc7 | dec eax // e8???????? | // 85c0 | lea ecx, [esp + 0xa0] // 7447 | inc ecx // 807c243017 | call esi // 7540 | mov ecx, edi // b801030000 | inc esp $sequence_20 = { e8???????? eb32 53 e8???????? 83c404 } // n = 5, score = 100 // e8???????? | // eb32 | mov ecx, ebx // 53 | mov eax, dword ptr [ebx + 0x48] // e8???????? | // 83c404 | add dword ptr [ebx + 0x14], ecx $sequence_21 = { 85c0 7e25 03f0 8b4500 } // n = 4, score = 100 // 85c0 | cmp dword ptr [ebx + 0x48], esi // 7e25 | je 0x12 // 03f0 | dec eax // 8b4500 | mov ecx, ebx $sequence_22 = { 0f85d1010000 33ff 83c303 6a2f } // n = 4, score = 100 // 0f85d1010000 | lea ecx, [ebp + 0x7a0] // 33ff | test al, al // 83c303 | jne 0xfffffff4 // 6a2f | dec eax $sequence_23 = { 0f284da0 bb48000000 0f114702 0f114f12 0f2845b0 0f284dc0 } // n = 6, score = 100 // 0f284da0 | mov ecx, esi // bb48000000 | call dword ptr [esp + 0x68] // 0f114702 | dec eax // 0f114f12 | mov eax, dword ptr [ebp - 0x80] // 0f2845b0 | dec eax // 0f284dc0 | lea ecx, [ebp + 0x4a0] $sequence_24 = { 488d542470 448bcf e8???????? 4c8b35???????? } // n = 4, score = 100 // 488d542470 | add ecx, 4 // 448bcf | mov edx, edi // e8???????? | // 4c8b35???????? | $sequence_25 = { 0101 44015104 4c8b942498000000 8b01 } // n = 4, score = 100 // 0101 | inc esp // 44015104 | movzx eax, byte ptr [eax + 0x101] // 4c8b942498000000 | movzx edx, byte ptr [eax + 0x100] // 8b01 | dec eax $sequence_26 = { c1fb06 83e03f 6bd030 895de4 8b049d80f16e00 } // n = 5, score = 100 // c1fb06 | dec esp // 83e03f | sub eax, eax // 6bd030 | dec eax // 895de4 | test edx, edx // 8b049d80f16e00 | je 0x2b $sequence_27 = { eb7c c745e0e0ba6e00 ebbb d9e8 8b4510 dd18 } // n = 6, score = 100 // eb7c | movaps xmm1, xmmword ptr [ebp - 0x60] // c745e0e0ba6e00 | mov ebx, 0x48 // ebbb | movups xmmword ptr [edi + 2], xmm0 // d9e8 | movups xmmword ptr [edi + 0x12], xmm1 // 8b4510 | movaps xmm0, xmmword ptr [ebp - 0x50] // dd18 | movaps xmm1, xmmword ptr [ebp - 0x40] $sequence_28 = { e9???????? c745dc02000000 c745e0e4ba6e00 8b4508 8bcf } // n = 5, score = 100 // e9???????? | // c745dc02000000 | dec esp // c745e0e4ba6e00 | cmove eax, eax // 8b4508 | mov eax, dword ptr [ebx + 0x1c] // 8bcf | pop edi $sequence_29 = { 668945e8 8b45d4 886de5 8b148580f16e00 8a4c1a2d } // n = 5, score = 100 // 668945e8 | dec esp // 8b45d4 | add ecx, eax // 886de5 | dec eax // 8b148580f16e00 | lea eax, [0x11beb] // 8a4c1a2d | test edi, edi $sequence_30 = { c74048b8e46e00 8b4508 6689486c 8b4508 66898872010000 } // n = 5, score = 100 // c74048b8e46e00 | mov eax, edi // 8b4508 | test eax, eax // 6689486c | je 0x49 // 8b4508 | cmp byte ptr [esp + 0x30], 0x17 // 66898872010000 | jne 0x49 $sequence_31 = { 6a00 50 e8???????? 6800010000 8d8318030000 6a00 } // n = 6, score = 100 // 6a00 | movzx eax, byte ptr [ecx] // 50 | mov byte ptr [ecx + esi + 2], al // e8???????? | // 6800010000 | dec eax // 8d8318030000 | lea ecx, [ecx + 1] // 6a00 | inc ebp $sequence_32 = { 0fb68418240e0000 02c2 02f0 0fb6ce } // n = 4, score = 100 // 0fb68418240e0000 | dec eax // 02c2 | test eax, eax // 02f0 | je 0x1e // 0fb6ce | xor edx, edx $sequence_33 = { 014b14 397348 7410 488bcb } // n = 4, score = 100 // 014b14 | mov eax, dword ptr [ecx] // 397348 | mov ecx, dword ptr [ecx + 4] // 7410 | inc ebp // 488bcb | mov dword ptr [edx + 8], eax $sequence_34 = { 83c408 85c0 742f 8b4c2418 } // n = 4, score = 100 // 83c408 | je 0x15 // 85c0 | dec eax // 742f | mov ecx, ebx // 8b4c2418 | add dword ptr [ebx + 0x14], ecx $sequence_35 = { d9c9 d9f1 833d????????00 0f859c190000 8d0d90b86e00 } // n = 5, score = 100 // d9c9 | dec esp // d9f1 | lea eax, [0x104f5] // 833d????????00 | // 0f859c190000 | dec eax // 8d0d90b86e00 | lea edx, [ecx + edx + 0x7ffffbfe] $sequence_36 = { 5f 5e c3 0fb74c2449 48896c2440 } // n = 5, score = 100 // 5f | mov dword ptr [esp + 0x20], ecx // 5e | inc esp // c3 | mov eax, esi // 0fb74c2449 | lea ecx, [ebx + 0x41] // 48896c2440 | mov byte ptr [esp + 0xa0], cl $sequence_37 = { 39b139cf3909 3a10 3a17 3a31 3a9a3aa43ab2 3ab73ac33ad2 3ade } // n = 7, score = 100 // 39b139cf3909 | lea edx, [esp + 0x30] // 3a10 | dec eax // 3a17 | lea ecx, [ebp + 0x5c0] // 3a31 | call dword ptr [esp + 0x20] // 3a9a3aa43ab2 | dec eax // 3ab73ac33ad2 | mov ebx, eax // 3ade | xor edx, edx $sequence_38 = { c7430c00000000 57 c7430800000000 894314 e8???????? } // n = 5, score = 100 // c7430c00000000 | mov esi, eax // 57 | mov edx, edi // c7430800000000 | mov byte ptr [ebp + edi + 0x7a0], 0 // 894314 | dec eax // e8???????? | $sequence_39 = { 4c03c8 488d05eb1b0100 85ff 4c0f44c0 8b431c } // n = 5, score = 100 // 4c03c8 | call eax // 488d05eb1b0100 | lea edx, [edi + eax*8] // 85ff | jmp 0xa // 4c0f44c0 | mov edx, 0x20040 // 8b431c | inc esp $sequence_40 = { 8bc3 8d95f0fdffff c1e009 8d8870f66e00 2bd1 0f1f840000000000 } // n = 6, score = 100 // 8bc3 | pop esi // 8d95f0fdffff | ret // c1e009 | movzx ecx, word ptr [esp + 0x49] // 8d8870f66e00 | dec eax // 2bd1 | mov dword ptr [esp + 0x40], ebp // 0f1f840000000000 | inc esp $sequence_41 = { 83c8f0 40 8985c4f5ffff 8d95d0f9ffff c1e009 } // n = 5, score = 100 // 83c8f0 | dec eax // 40 | mov ecx, eax // 8985c4f5ffff | inc ecx // 8d95d0f9ffff | call ebp // c1e009 | nop dword ptr [eax + eax] $sequence_42 = { f30f7e0e 83e908 8d7608 660fd60f 8d7f08 8b048dd4926d00 } // n = 6, score = 100 // f30f7e0e | test eax, eax // 83e908 | dec eax // 8d7608 | lea edx, [esp + 0x70] // 660fd60f | inc esp // 8d7f08 | mov ecx, edi // 8b048dd4926d00 | je 0x39 $sequence_43 = { 7437 4c8d05f5040100 488d9411fefbff7f 4c2bc0 4885d2 741b } // n = 6, score = 100 // 7437 | mov byte ptr [ebp + edi + 0x1510], 0 // 4c8d05f5040100 | dec eax // 488d9411fefbff7f | lea ecx, [ebp + 0x1510] // 4c2bc0 | dec eax // 4885d2 | lea edx, [ebp + 0x1510] // 741b | dec eax condition: 7 of them and filesize < 393216 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY