Actor(s): Lazarus Group, Silent Chollima
There is no description at this point.
rule win_vsingle_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.vsingle." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.vsingle" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 83c408 8945ec 8b4dec 8b550c 8d440a01 89450c 8b4d0c } // n = 7, score = 700 // 83c408 | add esp, 8 // 8945ec | mov dword ptr [ebp - 0x14], eax // 8b4dec | mov ecx, dword ptr [ebp - 0x14] // 8b550c | mov edx, dword ptr [ebp + 0xc] // 8d440a01 | lea eax, [edx + ecx + 1] // 89450c | mov dword ptr [ebp + 0xc], eax // 8b4d0c | mov ecx, dword ptr [ebp + 0xc] $sequence_1 = { 8955b8 eb14 8b45c0 83c004 8945c0 8b4dbc 83c102 } // n = 7, score = 700 // 8955b8 | mov dword ptr [ebp - 0x48], edx // eb14 | jmp 0x16 // 8b45c0 | mov eax, dword ptr [ebp - 0x40] // 83c004 | add eax, 4 // 8945c0 | mov dword ptr [ebp - 0x40], eax // 8b4dbc | mov ecx, dword ptr [ebp - 0x44] // 83c102 | add ecx, 2 $sequence_2 = { 83c408 8985f0feffff 83bdf0feffff00 7507 33c0 e9???????? 8b95f0feffff } // n = 7, score = 700 // 83c408 | add esp, 8 // 8985f0feffff | mov dword ptr [ebp - 0x110], eax // 83bdf0feffff00 | cmp dword ptr [ebp - 0x110], 0 // 7507 | jne 9 // 33c0 | xor eax, eax // e9???????? | // 8b95f0feffff | mov edx, dword ptr [ebp - 0x110] $sequence_3 = { 52 680c030000 8b4508 50 } // n = 4, score = 700 // 52 | push edx // 680c030000 | push 0x30c // 8b4508 | mov eax, dword ptr [ebp + 8] // 50 | push eax $sequence_4 = { 83c408 8985f4eeffff 8b95f4eeffff 8995f0eeffff c745fc00000000 8b85f0eeffff } // n = 6, score = 700 // 83c408 | add esp, 8 // 8985f4eeffff | mov dword ptr [ebp - 0x110c], eax // 8b95f4eeffff | mov edx, dword ptr [ebp - 0x110c] // 8995f0eeffff | mov dword ptr [ebp - 0x1110], edx // c745fc00000000 | mov dword ptr [ebp - 4], 0 // 8b85f0eeffff | mov eax, dword ptr [ebp - 0x1110] $sequence_5 = { 8955b8 8b45d0 83c001 8945d0 837db803 7d0c 6a3d } // n = 7, score = 700 // 8955b8 | mov dword ptr [ebp - 0x48], edx // 8b45d0 | mov eax, dword ptr [ebp - 0x30] // 83c001 | add eax, 1 // 8945d0 | mov dword ptr [ebp - 0x30], eax // 837db803 | cmp dword ptr [ebp - 0x48], 3 // 7d0c | jge 0xe // 6a3d | push 0x3d $sequence_6 = { 83c408 898500efffff 83bd00efffffff 7529 8b9504efffff 52 8d8524f7ffff } // n = 7, score = 700 // 83c408 | add esp, 8 // 898500efffff | mov dword ptr [ebp - 0x1100], eax // 83bd00efffffff | cmp dword ptr [ebp - 0x1100], -1 // 7529 | jne 0x2b // 8b9504efffff | mov edx, dword ptr [ebp - 0x10fc] // 52 | push edx // 8d8524f7ffff | lea eax, [ebp - 0x8dc] $sequence_7 = { 33c0 8945e9 8945ed 8945f1 8945f5 8845f9 } // n = 6, score = 700 // 33c0 | xor eax, eax // 8945e9 | mov dword ptr [ebp - 0x17], eax // 8945ed | mov dword ptr [ebp - 0x13], eax // 8945f1 | mov dword ptr [ebp - 0xf], eax // 8945f5 | mov dword ptr [ebp - 0xb], eax // 8845f9 | mov byte ptr [ebp - 7], al $sequence_8 = { 50 b807752b15 81f0467f1fbf 81f08c7668e6 81e8d57c5c4c 8b0c28 } // n = 6, score = 100 // 50 | push eax // b807752b15 | mov eax, 0x152b7507 // 81f0467f1fbf | xor eax, 0xbf1f7f46 // 81f08c7668e6 | xor eax, 0xe668768c // 81e8d57c5c4c | sub eax, 0x4c5c7cd5 // 8b0c28 | mov ecx, dword ptr [eax + ebp] $sequence_9 = { 82e8ef e9???????? 52 53 bb4c969f2a 81f3b4d3bba6 81c3c02d0a2f } // n = 7, score = 100 // 82e8ef | sub al, 0xef // e9???????? | // 52 | push edx // 53 | push ebx // bb4c969f2a | mov ebx, 0x2a9f964c // 81f3b4d3bba6 | xor ebx, 0xa6bbd3b4 // 81c3c02d0a2f | add ebx, 0x2f0a2dc0 $sequence_10 = { 81c7745e2200 81c736b60a42 81c7b551a68d 81f7e7564bc6 897c2404 } // n = 5, score = 100 // 81c7745e2200 | add edi, 0x225e74 // 81c736b60a42 | add edi, 0x420ab636 // 81c7b551a68d | add edi, 0x8da651b5 // 81f7e7564bc6 | xor edi, 0xc64b56e7 // 897c2404 | mov dword ptr [esp + 4], edi $sequence_11 = { bbf93d64ba 81f345ba76fc 81f381c713f5 81f34d7b2ffd 81f346dc0990 81c33217d821 8b142b } // n = 7, score = 100 // bbf93d64ba | mov ebx, 0xba643df9 // 81f345ba76fc | xor ebx, 0xfc76ba45 // 81f381c713f5 | xor ebx, 0xf513c781 // 81f34d7b2ffd | xor ebx, 0xfd2f7b4d // 81f346dc0990 | xor ebx, 0x9009dc46 // 81c33217d821 | add ebx, 0x21d81732 // 8b142b | mov edx, dword ptr [ebx + ebp] $sequence_12 = { 5b 57 50 b86a45ae9f 81c07b6673f5 81f081118d0d } // n = 6, score = 100 // 5b | pop ebx // 57 | push edi // 50 | push eax // b86a45ae9f | mov eax, 0x9fae456a // 81c07b6673f5 | add eax, 0xf573667b // 81f081118d0d | xor eax, 0xd8d1181 $sequence_13 = { bb86d72160 e9???????? 59 51 b9cf4a22af } // n = 5, score = 100 // bb86d72160 | mov ebx, 0x6021d786 // e9???????? | // 59 | pop ecx // 51 | push ecx // b9cf4a22af | mov ecx, 0xaf224acf $sequence_14 = { 81eb96c3a483 668b0c18 5b 53 bbd7e0d126 81f3b7cf22ba 81c3282d094f } // n = 7, score = 100 // 81eb96c3a483 | sub ebx, 0x83a4c396 // 668b0c18 | mov cx, word ptr [eax + ebx] // 5b | pop ebx // 53 | push ebx // bbd7e0d126 | mov ebx, 0x26d1e0d7 // 81f3b7cf22ba | xor ebx, 0xba22cfb7 // 81c3282d094f | add ebx, 0x4f092d28 $sequence_15 = { e9???????? bf756ddf55 81f7960c0426 eb36 81c7745e2200 81c736b60a42 } // n = 6, score = 100 // e9???????? | // bf756ddf55 | mov edi, 0x55df6d75 // 81f7960c0426 | xor edi, 0x26040c96 // eb36 | jmp 0x38 // 81c7745e2200 | add edi, 0x225e74 // 81c736b60a42 | add edi, 0x420ab636 condition: 7 of them and filesize < 940032 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY