SYMBOLCOMMON_NAMEaka. SYNONYMS
win.winnti (Back to overview)

Winnti

aka: BleDoor, JUMPALL, RbDoor, Pasteboy

Actor(s): APT17

VTCollection    

There is no description at this point.

References
2024-03-01 ⋅ HarfangLab ⋅ HarfangLab CTR
A Comprehensive Analysis of i-SOON’s Commercial Offering
ShadowPad Winnti
2023-01-14 ⋅ YouTube (CODE BLUE) ⋅ Takahiro Haruyama
[CB22]Tracking the Entire Iceberg - Long-term APT Malware C2 Protocol Emulation and Scanning
ShadowPad Winnti
2022-10-25 ⋅ VMware Threat Analysis Unit ⋅ Takahiro Haruyama
Tracking the entire iceberg: long-term APT malware C2 protocol emulation and scanning
ShadowPad Winnti
2022-09-26 ⋅ Youtube (Virus Bulletin) ⋅ Takahiro Haruyama
Tracking the entire iceberg long term APT malware C2 protocol emulation and scanning
ShadowPad Winnti
2022-09-19 ⋅ Virus Bulletin ⋅ Takahiro Haruyama
Tracking the entire iceberg - long-term APT malware C2 protocol emulation and scanning
ShadowPad Winnti
2022-05-12 ⋅ TEAMT5 ⋅ Leon Chang, Silvia Yeh
The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT (slides)
KEYPLUG Cobalt Strike CROSSWALK FunnySwitch PlugX ShadowPad Winnti SLIME29 TianWu
2022-05-04 ⋅ Cybereason ⋅ Akihiro Tomita, Assaf Dahan, Chen Erlich, Daniel Frank, Fusao Tanida, Niv Yona, Ofir Ozer
Operation CuckooBees: A Winnti Malware Arsenal Deep-Dive
PRIVATELOG Spyder STASHLOG Winnti
2022-05-04 ⋅ Cybereason ⋅ Akihiro Tomita, Assaf Dahan, Chen Erlich, Daniel Frank, Fusao Tanida, Niv Yona, Ofir Ozer
Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques
PRIVATELOG Spyder STASHLOG Winnti
2022-05-01 ⋅ BushidoToken ⋅ BushidoToken
Gamer Cheater Hacker Spy
Egregor HelloKitty NetfilterRootkit RagnarLocker Winnti
2022-03-31 ⋅ Recorded Future ⋅ Insikt Group
China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware
Winnti TAG-28
2022-01-17 ⋅ Trend Micro ⋅ Cedric Pernet, Daniel Lunghi, Gloria Chen, Jaromír Hořejší, Joseph Chen, Kenney Lu
Delving Deep: An Analysis of Earth Lusca’s Operations
BIOPASS Cobalt Strike FunnySwitch JuicyPotato ShadowPad Winnti Earth Lusca
2021-11-16 ⋅ vmware ⋅ Takahiro Haruyama
Monitoring Winnti 4.0 C2 Servers for Two Years
Winnti
2021-09-28 ⋅ Recorded Future ⋅ Insikt Group®
4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan
PlugX Winnti
2021-09-21 ⋅ Recorded Future ⋅ Insikt Group®
China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware
Winnti
2021-09-14 ⋅ McAfee ⋅ Christiaan Beek
Operation ‘Harvest’: A Deep Dive into a Long-term Campaign
MimiKatz PlugX Winnti
2021-07-08 ⋅ ⋅ PTSecurity ⋅ Denis Kuvshinov
How winnti APT grouping works
Korlia ShadowPad Winnti
2021-07-08 ⋅ ⋅ YouTube (PT Product Update) ⋅ Denis Kuvshinov
How winnti APT grouping works
Korlia ShadowPad Winnti
2021-07-08 ⋅ Recorded Future ⋅ Insikt Group®
Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling
ShadowPad Spyder Winnti
2021-06-05 ⋅ Prevailion ⋅ Danny Adamitis
The Gh0st remain the same
Winnti
2021-04-29 ⋅ NTT ⋅ Threat Detection NTT Ltd.
The Operations of Winnti group
Cobalt Strike ShadowPad Spyder Winnti Earth Lusca
2021-03-10 ⋅ ESET Research ⋅ Mathieu Tartare, Matthieu Faou, Thomas Dupuy
Exchange servers under siege from at least 10 APT groups
Microcin MimiKatz PlugX Winnti APT27 APT41 Calypso Tick ToddyCat Tonto Team Vicious Panda
2021-02-28 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team
2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-01-20 ⋅ FireEye ⋅ Andrew Davis
Emulation of Kernel Mode Rootkits With Speakeasy
Winnti
2020-12-24 ⋅ IronNet ⋅ Adam Hlavek
China cyber attacks: the current threat landscape
PLEAD TSCookie FlowCloud Lookback PLEAD PlugX Quasar RAT Winnti
2020-11-03 ⋅ Kaspersky Labs ⋅ GReAT
APT trends report Q3 2020
WellMail EVILNUM Janicab Poet RAT AsyncRAT Ave Maria Cobalt Strike Crimson RAT CROSSWALK Dtrack LODEINFO MoriAgent Okrum PlugX POISONPLUG Rover ShadowPad SoreFang Winnti
2020-10-30 ⋅ YouTube (Kaspersky Tech) ⋅ Kris McConkey
Around the world in 80 days 4.2bn packets
Cobalt Strike Derusbi HyperBro Poison Ivy ShadowPad Winnti
2020-10-12 ⋅ Malwarebytes Labs ⋅ Hossein Jazi, Jérôme Segura, Malwarebytes Threat Intelligence Team, Roberto Santos
Winnti APT group docks in Sri Lanka for new campaign
DBoxAgent SerialVlogger Winnti
2020-09-22 ⋅ vmware ⋅ Omar Elgebaly, Takahiro Haruyama
Detecting Threats in Real-time With Active C2 Information
Agent.BTZ Cobalt Strike Dacls NetWire RC PoshC2 Winnti
2020-09-18 ⋅ Symantec ⋅ Threat Hunter Team
APT41: Indictments Put Chinese Espionage Group in the Spotlight
CROSSWALK PlugX POISONPLUG ShadowPad Winnti
2020-08-06 ⋅ Wired ⋅ Andy Greenberg
Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry
Cobalt Strike MimiKatz Winnti Red Charon
2020-08-04 ⋅ BlackHat ⋅ Chung-Kuan Chen, Inndy Lin, Shang-De Jiang
Operation Chimera - APT Operation Targets Semiconductor Vendors
Cobalt Strike MimiKatz Winnti Red Charon
2020-04-20 ⋅ QuoScient ⋅ QuoIntelligence
WINNTI GROUP: Insights From the Past
Winnti
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-03-03 ⋅ GIthub (superkhung) ⋅ superkhung
GitHub Repository: winnti-sniff
Winnti
2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle
2020-02-20 ⋅ Carbon Black ⋅ Takahiro Haruyama
Threat Analysis: Active C2 Discovery Using Protocol Emulation Part2 (Winnti 4.0)
Winnti
2020-01-31 ⋅ ⋅ Tagesschau ⋅ Jan Lukas Strozyk
Deutsches Chemieunternehmen gehackt
Winnti
2020-01-31 ⋅ ESET Research ⋅ Mathieu Tartare
Winnti Group targeting universities in Hong Kong
ShadowPad Winnti
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
BRONZE ATLAS
Speculoos Winnti ACEHASH CCleaner Backdoor CHINACHOPPER Empire Downloader HTran MimiKatz PlugX Winnti APT41
2019-10-01 ⋅ CrowdStrike ⋅ Karl Scheuerman, Piotr Wojtyla
Don't miss the forest for the trees gleaning hunting value from too much intrusion data
Winnti
2019-09-30 ⋅ Lastline ⋅ Jason Zhang, Stefano Ortolani
HELO Winnti: Attack or Scan?
Winnti
2019-09-23 ⋅ MITRE ⋅ MITRE ATT&CK
APT41
Derusbi MESSAGETAP Winnti ASPXSpy BLACKCOFFEE CHINACHOPPER Cobalt Strike Derusbi Empire Downloader Ghost RAT MimiKatz NjRAT PlugX ShadowPad Winnti ZXShell APT41
2019-09-04 ⋅ CarbonBlack ⋅ Takahiro Haruyama
CB TAU Threat Intelligence Notification: Winnti Malware 4.0
Winnti
2019-09-04 ⋅ FireEye ⋅ FireEye
APT41: Double Dragon APT41, a dual espionage and cyber crime operation
EASYNIGHT Winnti
2019-08-09 ⋅ FireEye ⋅ FireEye
Double Dragon APT41, a dual espionage and cyber crime operation
CLASSFON crackshot CROSSWALK GEARSHIFT HIGHNOON HIGHNOON.BIN JUMPALL POISONPLUG Winnti
2019-07-24 ⋅ Bayerischer Rundfunk ⋅ Hakan Tanriverdi, Jan Strozyk, Maximilian Zierer, Rebecca Ciesielski, Svea Eckert
Attacking the Heart of the German Industry
Winnti
2019-07-24 ⋅ Github (br-data) ⋅ Hakan Tanriverdi, Jan Strozyk, Maximilian Zierer, Rebecca Ciesielski, Svea Eckert
Winnti analysis
Winnti
2019-04-22 ⋅ Trend Micro ⋅ Mohamad Mokbel
C/C++ Runtime Library Code Tampering in Supply Chain
shadowhammer ShadowPad Winnti
2018-10-01 ⋅ ⋅ Macnica Networks ⋅ Macnica Networks
Trends in cyber espionage (targeted attacks) targeting Japan | First half of 2018
Anel Cobalt Strike Datper FlawedAmmyy Quasar RAT RedLeaves taidoor Winnti xxmm
2018-05-22 ⋅ Github (TKCERT) ⋅ thyssenkrupp CERT
Nmap Script to scan for Winnti infections
Winnti
2018-03-05 ⋅ Github (TKCERT) ⋅ TKCERT
Suricata rules to detect Winnti communication
Winnti
2017-04-19 ⋅ Trend Micro ⋅ Trendmicro
Of Pigs and Malware: Examining a Possible Member of the Winnti Group
Winnti
2017-03-22 ⋅ Trend Micro ⋅ Cedric Pernet
Winnti Abuses GitHub for C&C Communications
Winnti
2016-03-06 ⋅ Github (TKCERT) ⋅ thyssenkrupp CERT
Network detector for Winnti malware
Winnti
2015-06-22 ⋅ Kaspersky Labs ⋅ Dmitry Tarakanov
Games are over: Winnti is now targeting pharmaceutical companies
Winnti APT41
2015-04-06 ⋅ Novetta ⋅ Novetta
WINNTI ANALYSIS
Winnti
2015-01-01 ⋅ Ruxcon ⋅ Matt McCormack
WHY ATTACKER TOOLSETS DO WHAT THEY DO
Winnti
2013-04-01 ⋅ Kaspersky Labs ⋅ GReAT
Winnti - More than just a game
portless Winnti
Yara Rules
[TLP:WHITE] win_winnti_auto (20241030 | Detects win.winnti.)
rule win_winnti_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.winnti."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83c408 e9???????? 8b44241c 8bce 50 e8???????? }
            // n = 6, score = 200
            //   83c408               | add                 esp, 8
            //   e9????????           |                     
            //   8b44241c             | mov                 eax, dword ptr [esp + 0x1c]
            //   8bce                 | mov                 ecx, esi
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_1 = { 8b0d???????? 85c9 746f 8b0d???????? 85c9 }
            // n = 5, score = 200
            //   8b0d????????         |                     
            //   85c9                 | test                ecx, ecx
            //   746f                 | je                  0x71
            //   8b0d????????         |                     
            //   85c9                 | test                ecx, ecx

        $sequence_2 = { 50 e8???????? 83c404 c7430c00000000 83c8ff }
            // n = 5, score = 200
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   c7430c00000000       | mov                 dword ptr [ebx + 0xc], 0
            //   83c8ff               | or                  eax, 0xffffffff

        $sequence_3 = { f7d1 49 81f904010000 0f83e9010000 53 }
            // n = 5, score = 200
            //   f7d1                 | not                 ecx
            //   49                   | dec                 ecx
            //   81f904010000         | cmp                 ecx, 0x104
            //   0f83e9010000         | jae                 0x1ef
            //   53                   | push                ebx

        $sequence_4 = { 3d10a00000 0f8ff4010000 0f84e2010000 051f60ffff 83f82e 0f8700010000 33d2 }
            // n = 7, score = 200
            //   3d10a00000           | cmp                 eax, 0xa010
            //   0f8ff4010000         | jg                  0x1fa
            //   0f84e2010000         | je                  0x1e8
            //   051f60ffff           | add                 eax, 0xffff601f
            //   83f82e               | cmp                 eax, 0x2e
            //   0f8700010000         | ja                  0x106
            //   33d2                 | xor                 edx, edx

        $sequence_5 = { 8d4c2413 c1e206 51 6a02 }
            // n = 4, score = 200
            //   8d4c2413             | lea                 ecx, [esp + 0x13]
            //   c1e206               | shl                 edx, 6
            //   51                   | push                ecx
            //   6a02                 | push                2

        $sequence_6 = { 3c02 7519 8b4c2430 8b442424 8d53ec }
            // n = 5, score = 200
            //   3c02                 | cmp                 al, 2
            //   7519                 | jne                 0x1b
            //   8b4c2430             | mov                 ecx, dword ptr [esp + 0x30]
            //   8b442424             | mov                 eax, dword ptr [esp + 0x24]
            //   8d53ec               | lea                 edx, [ebx - 0x14]

        $sequence_7 = { e8???????? 85c0 7e24 8b54241c 83c201 83d700 }
            // n = 6, score = 200
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7e24                 | jle                 0x26
            //   8b54241c             | mov                 edx, dword ptr [esp + 0x1c]
            //   83c201               | add                 edx, 1
            //   83d700               | adc                 edi, 0

        $sequence_8 = { 72e2 eb04 8b6c1f02 488b742460 4863cd 8bd7 }
            // n = 6, score = 100
            //   72e2                 | inc                 ecx
            //   eb04                 | pop                 edi
            //   8b6c1f02             | inc                 ebp
            //   488b742460           | xor                 eax, eax
            //   4863cd               | dec                 eax
            //   8bd7                 | mov                 ecx, eax

        $sequence_9 = { 488bc7 4c8d9c24d0000000 498b5b20 498b7328 498be3 415f }
            // n = 6, score = 100
            //   488bc7               | dec                 eax
            //   4c8d9c24d0000000     | mov                 eax, edi
            //   498b5b20             | dec                 esp
            //   498b7328             | lea                 ebx, [esp + 0xd0]
            //   498be3               | dec                 ecx
            //   415f                 | mov                 ebx, dword ptr [ebx + 0x20]

        $sequence_10 = { ff15???????? 488d15af4b0100 488bcb 488905???????? ff15???????? 488d15884b0100 }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   488d15af4b0100       | inc                 esp
            //   488bcb               | mov                 eax, ebx
            //   488905????????       |                     
            //   ff15????????         |                     
            //   488d15884b0100       | xor                 edx, edx

        $sequence_11 = { 488d0d33f1ffff 4885c0 7422 8930 488d7808 }
            // n = 5, score = 100
            //   488d0d33f1ffff       | je                  0xb
            //   4885c0               | nop                 
            //   7422                 | dec                 eax
            //   8930                 | inc                 eax
            //   488d7808             | inc                 eax

        $sequence_12 = { e8???????? 488bd8 488d05d03b0100 4885db 488d4f38 480f44d8 488bd3 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488bd8               | cmp                 byte ptr [eax], dh
            //   488d05d03b0100       | mov                 ebx, dword ptr [esp + 0x40]
            //   4885db               | dec                 eax
            //   488d4f38             | mov                 ecx, eax
            //   480f44d8             | inc                 ecx
            //   488bd3               | mov                 ecx, 0x3000

        $sequence_13 = { 4533c0 488bc8 488bd3 ff15???????? 4d85ff }
            // n = 5, score = 100
            //   4533c0               | dec                 ecx
            //   488bc8               | mov                 esi, dword ptr [ebx + 0x28]
            //   488bd3               | dec                 ecx
            //   ff15????????         |                     
            //   4d85ff               | mov                 esp, ebx

        $sequence_14 = { eb02 33ff 488bd7 488d4d9f e8???????? }
            // n = 5, score = 100
            //   eb02                 | mov                 esi, eax
            //   33ff                 | jl                  0xffffffe9
            //   488bd7               | pop                 ebp
            //   488d4d9f             | pop                 ebx
            //   e8????????           |                     

        $sequence_15 = { 4533db 488d2d7d1c0000 8b7320 448b7324 }
            // n = 4, score = 100
            //   4533db               | mov                 edx, edi
            //   488d2d7d1c0000       | dec                 eax
            //   8b7320               | mov                 esi, dword ptr [ebp + 0x3c8]
            //   448b7324             | inc                 esp

        $sequence_16 = { 4889842400020000 8b4108 4c8bc2 4533c9 41894004 4889542420 33d2 }
            // n = 7, score = 100
            //   4889842400020000     | dec                 eax
            //   8b4108               | mov                 ecx, ebx
            //   4c8bc2               | dec                 eax
            //   4533c9               | cmp                 dword ptr [ebp + 0xf], 0x10
            //   41894004             | jb                  0x1a
            //   4889542420           | dec                 esp
            //   33d2                 | lea                 esp, [0xf1b6]

        $sequence_17 = { 4c8d25b6f10000 498b0c24 4d8bc5 488bd3 e8???????? }
            // n = 5, score = 100
            //   4c8d25b6f10000       | nop                 
            //   498b0c24             | dec                 eax
            //   4d8bc5               | lea                 ecx, [ebp + 0x80]
            //   488bd3               | nop                 
            //   e8????????           |                     

        $sequence_18 = { 488b8d00010000 ff15???????? 90 488d8d80000000 ff15???????? 90 }
            // n = 6, score = 100
            //   488b8d00010000       | mov                 eax, eax
            //   ff15????????         |                     
            //   90                   | inc                 ebp
            //   488d8d80000000       | test                eax, eax
            //   ff15????????         |                     
            //   90                   | je                  0xd6

        $sequence_19 = { 4c8bc0 488d155d520100 488bcb e8???????? 48837d0f10 7209 }
            // n = 6, score = 100
            //   4c8bc0               | mov                 esi, dword ptr [ebx + 0x20]
            //   488d155d520100       | inc                 esp
            //   488bcb               | mov                 esi, dword ptr [ebx + 0x24]
            //   e8????????           |                     
            //   48837d0f10           | dec                 eax
            //   7209                 | mov                 ecx, dword ptr [ebp + 0x100]

        $sequence_20 = { 41c6400701 eb0f 4080fe05 7509 41800880 41c6400704 410fb64807 }
            // n = 7, score = 100
            //   41c6400701           | jb                  0xffffffe4
            //   eb0f                 | jmp                 8
            //   4080fe05             | mov                 ebp, dword ptr [edi + ebx + 2]
            //   7509                 | dec                 eax
            //   41800880             | mov                 esi, dword ptr [esp + 0x60]
            //   41c6400704           | dec                 eax
            //   410fb64807           | arpl                bp, cx

        $sequence_21 = { 7409 90 48ffc0 403830 }
            // n = 4, score = 100
            //   7409                 | inc                 ecx
            //   90                   | mov                 byte ptr [eax + 7], 1
            //   48ffc0               | jmp                 0x11
            //   403830               | inc                 eax

        $sequence_22 = { 83feff 7423 83fefe 741e 488bce 488bc6 488d15f8ba0a00 }
            // n = 7, score = 100
            //   83feff               | pop                 edi
            //   7423                 | pop                 esi
            //   83fefe               | ret                 
            //   741e                 | dec                 esp
            //   488bce               | mov                 eax, eax
            //   488bc6               | dec                 eax
            //   488d15f8ba0a00       | lea                 edx, [0x1525d]

        $sequence_23 = { 488bb5c8030000 448bc0 4585c0 0f84ca000000 }
            // n = 4, score = 100
            //   488bb5c8030000       | dec                 eax
            //   448bc0               | mov                 edx, ebx
            //   4585c0               | dec                 ebp
            //   0f84ca000000         | test                edi, edi

    condition:
        7 of them and filesize < 1581056
}
[TLP:WHITE] win_winnti_w0   (20190822 | rules used for retrohunting by BR Data.)
rule win_winnti_w0 {
    meta:
        author = "BR Data"
        source = "https://github.com/br-data/2019-winnti-analyse/"
        date = "2019-07-24"
        description = "rules used for retrohunting by BR Data."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20190822"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $load_magic = { C7 44 ?? ?? FF D8 FF E0 }
        $iter = { E9 EA EB EC ED EE EF F0 }
        $jpeg = { FF D8 FF E0 00 00 00 00 00 00 }

    condition:
        uint16(0) == 0x5a4d and
        $jpeg and
        ($load_magic or $iter in (@jpeg[1]..@jpeg[1]+200)) and
        for any i in (1..#jpeg): ( uint8(@jpeg[i] + 11) != 0 )
}
[TLP:WHITE] win_winnti_w1   (20190822 | rules used for retrohunting by BR Data.)
rule win_winnti_w1 {
    meta:
        author = "BR Data"
        source = "https://github.com/br-data/2019-winnti-analyse/"
        date = "2019-07-24"
        description = "rules used for retrohunting by BR Data."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20190822"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $cooper = "Cooper"
        $pattern = { e9 ea eb ec ed ee ef f0}
    condition:
        uint16(0) == 0x5a4d and $cooper and ($pattern in (@cooper[1]..@cooper[1]+100))
}
[TLP:WHITE] win_winnti_w2   (20191207 | No description)
rule win_winnti_w2 {
    meta:
        author = "Bundesamt fuer Verfassungsschutz"
        source = "https://www.verfassungsschutz.de/download/anlage-2019-12-bfv-cyber-brief-2019-01.txt"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20191207"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
        $e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
        $e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
        $e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
        $e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase
    condition:
        (any of ($e*))
}
[TLP:WHITE] win_winnti_w3   (20191207 | No description)
rule win_winnti_w3 {
    meta:
        author = "Bundesamt fuer Verfassungsschutz"
        source = "https://www.verfassungsschutz.de/download/anlage-2019-12-bfv-cyber-brief-2019-01.txt"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20191207"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $a1 = "IPSecMiniPort" wide fullword
        $a2 = "ndis6fw" wide fullword
        $a3 = "TCPIP" wide fullword
        $a4 = "NDIS.SYS" ascii fullword
        $a5 = "ntoskrnl.exe" ascii fullword
        $a6 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
        $a7 = "\\Device\\Null" wide
        $a8 = "\\Device" wide
        $a9 = "\\Driver" wide
        $b1 = { 66 81 7? ?? 70 17 }
        $b2 = { 81 7? ?? 07 E0 15 00 }
        $b3 = { 8B 46 18 3D 03 60 15 00 }
    condition:
        (6 of ($a*)) and (2 of ($b*))
}
Download all Yara Rules