Actor(s): Comment Crew
There is no description at this point.
rule win_webc2_rave_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-12-22" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.webc2_rave" malpedia_rule_date = "20201222" malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130" malpedia_version = "20201023" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { be???????? 8d8c241c010000 8a01 8ad0 3a06 } // n = 5, score = 100 // be???????? | // 8d8c241c010000 | lea ecx, [esp + 0x11c] // 8a01 | mov al, byte ptr [ecx] // 8ad0 | mov dl, al // 3a06 | cmp al, byte ptr [esi] $sequence_1 = { 83ec68 8d442410 50 e8???????? 8b4c2474 8b542470 } // n = 6, score = 100 // 83ec68 | sub esp, 0x68 // 8d442410 | lea eax, [esp + 0x10] // 50 | push eax // e8???????? | // 8b4c2474 | mov ecx, dword ptr [esp + 0x74] // 8b542470 | mov edx, dword ptr [esp + 0x70] $sequence_2 = { 3bdd 57 0f845d010000 8b7c2420 3bfd 0f8451010000 } // n = 6, score = 100 // 3bdd | cmp ebx, ebp // 57 | push edi // 0f845d010000 | je 0x163 // 8b7c2420 | mov edi, dword ptr [esp + 0x20] // 3bfd | cmp edi, ebp // 0f8451010000 | je 0x157 $sequence_3 = { 8a54340c 8854040b 884c340c 7cd5 } // n = 4, score = 100 // 8a54340c | mov dl, byte ptr [esp + esi + 0xc] // 8854040b | mov byte ptr [esp + eax + 0xb], dl // 884c340c | mov byte ptr [esp + esi + 0xc], cl // 7cd5 | jl 0xffffffd7 $sequence_4 = { 2bd5 85d2 7e15 8bca b83d3d3d3d 8bf1 c1e902 } // n = 7, score = 100 // 2bd5 | sub edx, ebp // 85d2 | test edx, edx // 7e15 | jle 0x17 // 8bca | mov ecx, edx // b83d3d3d3d | mov eax, 0x3d3d3d3d // 8bf1 | mov esi, ecx // c1e902 | shr ecx, 2 $sequence_5 = { 03d0 f6c301 8bca 750c 8bc6 be03000000 99 } // n = 7, score = 100 // 03d0 | add edx, eax // f6c301 | test bl, 1 // 8bca | mov ecx, edx // 750c | jne 0xe // 8bc6 | mov eax, esi // be03000000 | mov esi, 3 // 99 | cdq $sequence_6 = { f3ab aa 8d442420 33f6 } // n = 4, score = 100 // f3ab | rep stosd dword ptr es:[edi], eax // aa | stosb byte ptr es:[edi], al // 8d442420 | lea eax, [esp + 0x20] // 33f6 | xor esi, esi $sequence_7 = { 89742424 89742428 ff15???????? 3bc6 } // n = 4, score = 100 // 89742424 | mov dword ptr [esp + 0x24], esi // 89742428 | mov dword ptr [esp + 0x28], esi // ff15???????? | // 3bc6 | cmp eax, esi $sequence_8 = { 8b6c2428 83c404 8bf0 8b442418 } // n = 4, score = 100 // 8b6c2428 | mov ebp, dword ptr [esp + 0x28] // 83c404 | add esp, 4 // 8bf0 | mov esi, eax // 8b442418 | mov eax, dword ptr [esp + 0x18] $sequence_9 = { 8bcd 8bd0 c1ea1a 47 8a9230414000 } // n = 5, score = 100 // 8bcd | mov ecx, ebp // 8bd0 | mov edx, eax // c1ea1a | shr edx, 0x1a // 47 | inc edi // 8a9230414000 | mov dl, byte ptr [edx + 0x404130] condition: 7 of them and filesize < 57344 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY