Actor(s): Comment Crew
There is no description at this point.
rule win_webc2_greencat_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-12-22" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_greencat" malpedia_rule_date = "20201222" malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130" malpedia_version = "20201023" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 50 ff15???????? 8bf0 83c410 f7de 1bf6 } // n = 6, score = 100 // 50 | push eax // ff15???????? | // 8bf0 | mov esi, eax // 83c410 | add esp, 0x10 // f7de | neg esi // 1bf6 | sbb esi, esi $sequence_1 = { 59 7437 40 50 56 e8???????? 6a2e } // n = 7, score = 100 // 59 | pop ecx // 7437 | je 0x39 // 40 | inc eax // 50 | push eax // 56 | push esi // e8???????? | // 6a2e | push 0x2e $sequence_2 = { 8d859cfbffff 56 53 50 e8???????? 83c418 53 } // n = 7, score = 100 // 8d859cfbffff | lea eax, [ebp - 0x464] // 56 | push esi // 53 | push ebx // 50 | push eax // e8???????? | // 83c418 | add esp, 0x18 // 53 | push ebx $sequence_3 = { 6a04 53 53 ff15???????? 8bf8 3bfb 7507 } // n = 7, score = 100 // 6a04 | push 4 // 53 | push ebx // 53 | push ebx // ff15???????? | // 8bf8 | mov edi, eax // 3bfb | cmp edi, ebx // 7507 | jne 9 $sequence_4 = { 68000000a0 6aff 50 ff760c eb83 8b45f8 5f } // n = 7, score = 100 // 68000000a0 | push 0xa0000000 // 6aff | push -1 // 50 | push eax // ff760c | push dword ptr [esi + 0xc] // eb83 | jmp 0xffffff85 // 8b45f8 | mov eax, dword ptr [ebp - 8] // 5f | pop edi $sequence_5 = { 59 8d8598feffff 59 50 ff15???????? 56 68???????? } // n = 7, score = 100 // 59 | pop ecx // 8d8598feffff | lea eax, [ebp - 0x168] // 59 | pop ecx // 50 | push eax // ff15???????? | // 56 | push esi // 68???????? | $sequence_6 = { 83c414 03f0 8d45ec c745ec10000000 50 56 ff15???????? } // n = 7, score = 100 // 83c414 | add esp, 0x14 // 03f0 | add esi, eax // 8d45ec | lea eax, [ebp - 0x14] // c745ec10000000 | mov dword ptr [ebp - 0x14], 0x10 // 50 | push eax // 56 | push esi // ff15???????? | $sequence_7 = { 7506 80243e00 46 46 8d043e } // n = 5, score = 100 // 7506 | jne 8 // 80243e00 | and byte ptr [esi + edi], 0 // 46 | inc esi // 46 | inc esi // 8d043e | lea eax, [esi + edi] $sequence_8 = { ffd6 8b45e8 8d7801 57 e8???????? 3bc3 59 } // n = 7, score = 100 // ffd6 | call esi // 8b45e8 | mov eax, dword ptr [ebp - 0x18] // 8d7801 | lea edi, [eax + 1] // 57 | push edi // e8???????? | // 3bc3 | cmp eax, ebx // 59 | pop ecx $sequence_9 = { 53 53 53 53 8d85e0fdffff 6805010000 50 } // n = 7, score = 100 // 53 | push ebx // 53 | push ebx // 53 | push ebx // 53 | push ebx // 8d85e0fdffff | lea eax, [ebp - 0x220] // 6805010000 | push 0x105 // 50 | push eax condition: 7 of them and filesize < 57344 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY