There is no description at this point.
rule win_waterminer_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-04-08" version = "1" description = "Detects win.waterminer." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.waterminer" malpedia_rule_date = "20220405" malpedia_hash = "ecd38294bd47d5589be5cd5490dc8bb4804afc2a" malpedia_version = "20220411" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 8b55fc 52 ff15???????? 3305???????? b904000000 6bc91c 898180434b00 } // n = 7, score = 100 // 8b55fc | mov edx, dword ptr [ebp - 4] // 52 | push edx // ff15???????? | // 3305???????? | // b904000000 | mov ecx, 4 // 6bc91c | imul ecx, ecx, 0x1c // 898180434b00 | mov dword ptr [ecx + 0x4b4380], eax $sequence_1 = { 03442410 4403e8 428b4405e7 418bd5 } // n = 4, score = 100 // 03442410 | mov edx, edx // 4403e8 | dec esp // 428b4405e7 | lea eax, dword ptr [0x55894] // 418bd5 | add eax, dword ptr [esp + 0xc] $sequence_2 = { 03bc24a8000000 488bcd 4c8d0d35cb0300 83e13f } // n = 4, score = 100 // 03bc24a8000000 | lea eax, dword ptr [0x55894] // 488bcd | inc ecx // 4c8d0d35cb0300 | xor edx, ebp // 83e13f | inc esp $sequence_3 = { 8b4dfc 89048da8064b00 ebd4 8be5 } // n = 4, score = 100 // 8b4dfc | mov ecx, dword ptr [ebp - 4] // 89048da8064b00 | mov dword ptr [ecx*4 + 0x4b06a8], eax // ebd4 | jmp 0xffffffd6 // 8be5 | mov esp, ebp $sequence_4 = { 02d0 49ffc3 418d4001 881418 } // n = 4, score = 100 // 02d0 | cmp al, 9 // 49ffc3 | add cl, al // 418d4001 | inc ecx // 881418 | mov byte ptr [eax + ebx], cl $sequence_5 = { 68???????? 64a100000000 50 81ec3c020000 53 56 57 } // n = 7, score = 100 // 68???????? | // 64a100000000 | mov eax, dword ptr fs:[0] // 50 | push eax // 81ec3c020000 | sub esp, 0x23c // 53 | push ebx // 56 | push esi // 57 | push edi $sequence_6 = { 03c0 2bc8 0f84ec040000 8d41ff 8b848288d20600 } // n = 5, score = 100 // 03c0 | inc esp // 2bc8 | add edx, eax // 0f84ec040000 | dec eax // 8d41ff | lea eax, dword ptr [0x5561a] // 8b848288d20600 | inc ecx $sequence_7 = { 0344240c 4403d0 488d051a560500 418b0400 } // n = 4, score = 100 // 0344240c | inc ebx // 4403d0 | inc ecx // 488d051a560500 | lea eax, dword ptr [eax + 1] // 418b0400 | mov byte ptr [eax + ebx], dl $sequence_8 = { 0344240c 4403d0 428b4405e7 418bd2 } // n = 4, score = 100 // 0344240c | inc ecx // 4403d0 | lea eax, dword ptr [eax + 1] // 428b4405e7 | mov byte ptr [eax + ebx], dl // 418bd2 | add dl, al $sequence_9 = { eb07 c745ecd8064b00 8b55ec 0fbe4204 83e020 7437 } // n = 6, score = 100 // eb07 | jmp 9 // c745ecd8064b00 | mov dword ptr [ebp - 0x14], 0x4b06d8 // 8b55ec | mov edx, dword ptr [ebp - 0x14] // 0fbe4204 | movsx eax, byte ptr [edx + 4] // 83e020 | and eax, 0x20 // 7437 | je 0x39 $sequence_10 = { 02c8 41880c18 418a03 240f } // n = 4, score = 100 // 02c8 | or byte ptr [ecx + edi + 0x3d], al // 41880c18 | lea eax, dword ptr [edx + edx] // 418a03 | dec eax // 240f | mov ebx, dword ptr [esp + 0x50] $sequence_11 = { 8b45fc 8b04c5a4044b00 eb37 ebd4 837d0813 720f } // n = 6, score = 100 // 8b45fc | mov eax, dword ptr [ebp - 4] // 8b04c5a4044b00 | mov eax, dword ptr [eax*8 + 0x4b04a4] // eb37 | jmp 0x39 // ebd4 | jmp 0xffffffd6 // 837d0813 | cmp dword ptr [ebp + 8], 0x13 // 720f | jb 0x11 $sequence_12 = { 0fb74dfc 83f92c 753d 6a00 6848040000 68???????? 68???????? } // n = 7, score = 100 // 0fb74dfc | movzx ecx, word ptr [ebp - 4] // 83f92c | cmp ecx, 0x2c // 753d | jne 0x3f // 6a00 | push 0 // 6848040000 | push 0x448 // 68???????? | // 68???????? | $sequence_13 = { 6bc00c 05???????? 8bf4 50 6a00 } // n = 5, score = 100 // 6bc00c | imul eax, eax, 0xc // 05???????? | // 8bf4 | mov esi, esp // 50 | push eax // 6a00 | push 0 $sequence_14 = { 02c0 0844393d 8d0412 488b5c2450 } // n = 4, score = 100 // 02c0 | add al, al // 0844393d | or byte ptr [ecx + edi + 0x3d], al // 8d0412 | lea eax, dword ptr [edx + edx] // 488b5c2450 | dec eax $sequence_15 = { 83e11f c1e106 030c85c02b4b00 898d84f5ffff } // n = 4, score = 100 // 83e11f | and ecx, 0x1f // c1e106 | shl ecx, 6 // 030c85c02b4b00 | add ecx, dword ptr [eax*4 + 0x4b2bc0] // 898d84f5ffff | mov dword ptr [ebp - 0xa7c], ecx condition: 7 of them and filesize < 1556480 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY