SYMBOLCOMMON_NAMEaka. SYNONYMS
win.winnti (Back to overview)

Winnti

aka: BleDoor, JUMPALL, RbDoor, Pasteboy

Actor(s): APT17

VTCollection    

There is no description at this point.

References
2024-03-01 ⋅ HarfangLab ⋅ HarfangLab CTI
A Comprehensive Analysis of i-SOON’s Commercial Offering
ShadowPad Winnti
2022-10-25 ⋅ VMware Threat Analysis Unit ⋅ Takahiro Haruyama
Tracking the entire iceberg: long-term APT malware C2 protocol emulation and scanning
ShadowPad Winnti
2022-09-26 ⋅ Youtube (Virus Bulletin) ⋅ Takahiro Haruyama
Tracking the entire iceberg long term APT malware C2 protocol emulation and scanning
ShadowPad Winnti
2022-09-19 ⋅ Virus Bulletin ⋅ Takahiro Haruyama
Tracking the entire iceberg - long-term APT malware C2 protocol emulation and scanning
ShadowPad Winnti
2022-05-12 ⋅ TEAMT5 ⋅ Leon Chang, Silvia Yeh
The Next Gen PlugX/ShadowPad? A Dive into the Emerging China-Nexus Modular Trojan, Pangolin8RAT (slides)
KEYPLUG Cobalt Strike CROSSWALK FunnySwitch PlugX ShadowPad Winnti SLIME29 TianWu
2022-05-04 ⋅ Cybereason ⋅ Akihiro Tomita, Assaf Dahan, Chen Erlich, Daniel Frank, Fusao Tanida, Niv Yona, Ofir Ozer
Operation CuckooBees: Deep-Dive into Stealthy Winnti Techniques
PRIVATELOG Spyder STASHLOG Winnti
2022-05-04 ⋅ Cybereason ⋅ Akihiro Tomita, Assaf Dahan, Chen Erlich, Daniel Frank, Fusao Tanida, Niv Yona, Ofir Ozer
Operation CuckooBees: A Winnti Malware Arsenal Deep-Dive
PRIVATELOG Spyder STASHLOG Winnti
2022-05-01 ⋅ BushidoToken ⋅ BushidoToken
Gamer Cheater Hacker Spy
Egregor HelloKitty NetfilterRootkit RagnarLocker Winnti
2022-03-31 ⋅ Recorded Future ⋅ Insikt Group
China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware
Winnti TAG-28
2022-01-17 ⋅ Trend Micro ⋅ Cedric Pernet, Daniel Lunghi, Gloria Chen, Jaromír Hořejší, Joseph Chen, Kenney Lu
Delving Deep: An Analysis of Earth Lusca’s Operations
BIOPASS Cobalt Strike FunnySwitch JuicyPotato ShadowPad Winnti Earth Lusca
2021-11-16 ⋅ vmware ⋅ Takahiro Haruyama
Monitoring Winnti 4.0 C2 Servers for Two Years
Winnti
2021-09-28 ⋅ Recorded Future ⋅ Insikt Group®
4 Chinese APT Groups Identified Targeting Mail Server of Afghan Telecommunications Firm Roshan
PlugX Winnti
2021-09-21 ⋅ Recorded Future ⋅ Insikt Group®
China-Linked Group TAG-28 Targets India’s “The Times Group” and UIDAI (Aadhaar) Government Agency With Winnti Malware
Winnti
2021-09-14 ⋅ McAfee ⋅ Christiaan Beek
Operation ‘Harvest’: A Deep Dive into a Long-term Campaign
MimiKatz PlugX Winnti
2021-07-08 ⋅ ⋅ PTSecurity ⋅ Denis Kuvshinov
How winnti APT grouping works
Korlia ShadowPad Winnti
2021-07-08 ⋅ ⋅ YouTube (PT Product Update) ⋅ Denis Kuvshinov
How winnti APT grouping works
Korlia ShadowPad Winnti
2021-07-08 ⋅ Recorded Future ⋅ Insikt Group®
Chinese State-Sponsored Activity Group TAG-22 Targets Nepal, the Philippines, and Taiwan Using Winnti and Other Tooling
ShadowPad Spyder Winnti
2021-04-29 ⋅ NTT ⋅ Threat Detection NTT Ltd.
The Operations of Winnti group
Cobalt Strike ShadowPad Spyder Winnti Earth Lusca
2021-03-10 ⋅ ESET Research ⋅ Mathieu Tartare, Matthieu Faou, Thomas Dupuy
Exchange servers under siege from at least 10 APT groups
Microcin MimiKatz PlugX Winnti APT27 APT41 Calypso Tick ToddyCat Tonto Team Vicious Panda
2021-02-28 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2020: A Year in Retrospect
elf.wellmess FlowerPower PowGoop 8.t Dropper Agent.BTZ Agent Tesla Appleseed Ave Maria Bankshot BazarBackdoor BLINDINGCAN Chinoxy Conti Cotx RAT Crimson RAT DUSTMAN Emotet FriedEx FunnyDream Hakbit Mailto Maze METALJACK Nefilim Oblique RAT Pay2Key PlugX QakBot REvil Ryuk StoneDrill StrongPity SUNBURST SUPERNOVA TrickBot TurlaRPC Turla SilentMoon WastedLocker WellMess Winnti ZeroCleare APT10 APT23 APT27 APT31 APT41 BlackTech BRONZE EDGEWOOD Inception Framework MUSTANG PANDA Red Charon Red Nue Sea Turtle Tonto Team
2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-01-20 ⋅ FireEye ⋅ Andrew Davis
Emulation of Kernel Mode Rootkits With Speakeasy
Winnti
2020-12-24 ⋅ IronNet ⋅ Adam Hlavek
China cyber attacks: the current threat landscape
PLEAD TSCookie FlowCloud Lookback PLEAD PlugX Quasar RAT Winnti
2020-11-03 ⋅ Kaspersky Labs ⋅ GReAT
APT trends report Q3 2020
WellMail EVILNUM Janicab Poet RAT AsyncRAT Ave Maria Cobalt Strike Crimson RAT CROSSWALK Dtrack LODEINFO MoriAgent Okrum PlugX poisonplug Rover ShadowPad SoreFang Winnti
2020-10-30 ⋅ YouTube (Kaspersky Tech) ⋅ Kris McConkey
Around the world in 80 days 4.2bn packets
Cobalt Strike Derusbi HyperBro Poison Ivy ShadowPad Winnti
2020-10-12 ⋅ Malwarebytes Labs ⋅ Hossein Jazi, Jérôme Segura, Malwarebytes Threat Intelligence Team, Roberto Santos
Winnti APT group docks in Sri Lanka for new campaign
DBoxAgent SerialVlogger Winnti
2020-09-18 ⋅ Symantec ⋅ Threat Hunter Team
APT41: Indictments Put Chinese Espionage Group in the Spotlight
CROSSWALK PlugX poisonplug ShadowPad Winnti
2020-08-06 ⋅ Wired ⋅ Andy Greenberg
Chinese Hackers Have Pillaged Taiwan's Semiconductor Industry
Cobalt Strike MimiKatz Winnti Red Charon
2020-08-04 ⋅ BlackHat ⋅ Chung-Kuan Chen, Inndy Lin, Shang-De Jiang
Operation Chimera - APT Operation Targets Semiconductor Vendors
Cobalt Strike MimiKatz Winnti Red Charon
2020-04-20 ⋅ QuoScient ⋅ QuoIntelligence
WINNTI GROUP: Insights From the Past
Winnti
2020-03-04 ⋅ CrowdStrike ⋅ CrowdStrike
2020 CrowdStrike Global Threat Report
MESSAGETAP More_eggs 8.t Dropper Anchor BabyShark BadNews Clop Cobalt Strike CobInt Cobra Carbon System Cutwail DanaBot Dharma DoppelDridex DoppelPaymer Dridex Emotet FlawedAmmyy FriedEx Gandcrab Get2 IcedID ISFB KerrDown LightNeuron LockerGoga Maze MECHANICAL Necurs Nokki Outlook Backdoor Phobos Predator The Thief QakBot REvil RobinHood Ryuk SDBbot Skipper SmokeLoader TerraRecon TerraStealer TerraTV TinyLoader TrickBot Vidar Winnti ANTHROPOID SPIDER APT23 APT31 APT39 APT40 BlackTech BuhTrap Charming Kitten CLOCKWORK SPIDER DOPPEL SPIDER FIN7 Gamaredon Group GOBLIN PANDA MONTY SPIDER MUSTANG PANDA NARWHAL SPIDER NOCTURNAL SPIDER PINCHY SPIDER SALTY SPIDER SCULLY SPIDER SMOKY SPIDER Thrip VENOM SPIDER VICEROY TIGER
2020-03-03 ⋅ GIthub (superkhung) ⋅ superkhung
GitHub Repository: winnti-sniff
Winnti
2020-03-03 ⋅ PWC UK ⋅ PWC UK
Cyber Threats 2019:A Year in Retrospect
KevDroid MESSAGETAP magecart AndroMut Cobalt Strike CobInt Crimson RAT DNSpionage Dridex Dtrack Emotet FlawedAmmyy FlawedGrace FriedEx Gandcrab Get2 GlobeImposter Grateful POS ISFB Kazuar LockerGoga Nokki QakBot Ramnit REvil Rifdoor RokRAT Ryuk shadowhammer ShadowPad Shifu Skipper StoneDrill Stuxnet TrickBot Winnti ZeroCleare APT41 MUSTANG PANDA Sea Turtle
2020-02-20 ⋅ Carbon Black ⋅ Takahiro Haruyama
Threat Analysis: Active C2 Discovery Using Protocol Emulation Part2 (Winnti 4.0)
Winnti
2020-01-31 ⋅ ⋅ Tagesschau ⋅ Jan Lukas Strozyk
Deutsches Chemieunternehmen gehackt
Winnti
2020-01-31 ⋅ ESET Research ⋅ Mathieu Tartare
Winnti Group targeting universities in Hong Kong
ShadowPad Winnti
2020-01-01 ⋅ Secureworks ⋅ SecureWorks
BRONZE ATLAS
Speculoos Winnti ACEHASH CCleaner Backdoor CHINACHOPPER Empire Downloader HTran MimiKatz PlugX Winnti APT41
2019-10-01 ⋅ CrowdStrike ⋅ Karl Scheuerman, Piotr Wojtyla
Don't miss the forest for the trees gleaning hunting value from too much intrusion data
Winnti
2019-09-30 ⋅ Lastline ⋅ Jason Zhang, Stefano Ortolani
HELO Winnti: Attack or Scan?
Winnti
2019-09-23 ⋅ MITRE ⋅ MITRE ATT&CK
APT41
Derusbi MESSAGETAP Winnti ASPXSpy BLACKCOFFEE CHINACHOPPER Cobalt Strike Derusbi Empire Downloader Ghost RAT MimiKatz NjRAT PlugX ShadowPad Winnti ZXShell APT41
2019-09-04 ⋅ CarbonBlack ⋅ Takahiro Haruyama
CB TAU Threat Intelligence Notification: Winnti Malware 4.0
Winnti
2019-09-04 ⋅ FireEye ⋅ FireEye
APT41: Double Dragon APT41, a dual espionage and cyber crime operation
EASYNIGHT Winnti
2019-08-09 ⋅ FireEye ⋅ FireEye
Double Dragon APT41, a dual espionage and cyber crime operation
CLASSFON crackshot CROSSWALK GEARSHIFT HIGHNOON HIGHNOON.BIN JUMPALL poisonplug Winnti
2019-07-24 ⋅ Github (br-data) ⋅ Hakan Tanriverdi, Jan Strozyk, Maximilian Zierer, Rebecca Ciesielski, Svea Eckert
Winnti analysis
Winnti
2019-07-24 ⋅ Bayerischer Rundfunk ⋅ Hakan Tanriverdi, Jan Strozyk, Maximilian Zierer, Rebecca Ciesielski, Svea Eckert
Attacking the Heart of the German Industry
Winnti
2019-04-22 ⋅ Trend Micro ⋅ Mohamad Mokbel
C/C++ Runtime Library Code Tampering in Supply Chain
shadowhammer ShadowPad Winnti
2018-10-01 ⋅ ⋅ Macnica Networks ⋅ Macnica Networks
Trends in cyber espionage (targeted attacks) targeting Japan | First half of 2018
Anel Cobalt Strike Datper FlawedAmmyy Quasar RAT RedLeaves taidoor Winnti xxmm
2018-05-22 ⋅ Github (TKCERT) ⋅ thyssenkrupp CERT
Nmap Script to scan for Winnti infections
Winnti
2018-03-05 ⋅ Github (TKCERT) ⋅ TKCERT
Suricata rules to detect Winnti communication
Winnti
2017-04-19 ⋅ Trend Micro ⋅ Trendmicro
Of Pigs and Malware: Examining a Possible Member of the Winnti Group
Winnti
2017-03-22 ⋅ Trend Micro ⋅ Cedric Pernet
Winnti Abuses GitHub for C&C Communications
Winnti
2016-03-06 ⋅ Github (TKCERT) ⋅ thyssenkrupp CERT
Network detector for Winnti malware
Winnti
2015-06-22 ⋅ Kaspersky Labs ⋅ Dmitry Tarakanov
Games are over: Winnti is now targeting pharmaceutical companies
Winnti APT41
2015-04-06 ⋅ Novetta ⋅ Novetta
WINNTI ANALYSIS
Winnti
2015-01-01 ⋅ Ruxcon ⋅ Matt McCormack
WHY ATTACKER TOOLSETS DO WHAT THEY DO
Winnti
2013-04-01 ⋅ Kaspersky Labs ⋅ GReAT
Winnti - More than just a game
portless Winnti
Yara Rules
[TLP:WHITE] win_winnti_auto (20230808 | Detects win.winnti.)
rule win_winnti_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.winnti."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 51 52 8bce e8???????? 53 8bf8 ff15???????? }
            // n = 7, score = 200
            //   51                   | mov                 esi, eax
            //   52                   | add                 esp, 4
            //   8bce                 | test                esi, esi
            //   e8????????           |                     
            //   53                   | jne                 0x12
            //   8bf8                 | pop                 edi
            //   ff15????????         |                     

        $sequence_1 = { ff15???????? 663dffff 747b 663dfeff 7475 8b942494020000 83c9ff }
            // n = 7, score = 200
            //   ff15????????         |                     
            //   663dffff             | pop                 esi
            //   747b                 | or                  eax, 0xffffffff
            //   663dfeff             | push                1
            //   7475                 | push                edx
            //   8b942494020000       | push                2
            //   83c9ff               | mov                 dword ptr [esp + 0x3c], esi

        $sequence_2 = { c22000 8b4d00 56 6a03 68c8000000 51 ff15???????? }
            // n = 7, score = 200
            //   c22000               | mov                 eax, dword ptr [esi + 0x3c]
            //   8b4d00               | xor                 edx, edx
            //   56                   | add                 esp, 4
            //   6a03                 | test                ebx, ebx
            //   68c8000000           | je                  0xe2
            //   51                   | push                ebp
            //   ff15????????         |                     

        $sequence_3 = { 8bf0 83c404 85f6 7509 5f 5e 83c8ff }
            // n = 7, score = 200
            //   8bf0                 | lea                 edx, [0x16e1]
            //   83c404               | mov                 cl, 0x2e
            //   85f6                 | dec                 eax
            //   7509                 | sub                 edx, eax
            //   5f                   | dec                 esp
            //   5e                   | sub                 eax, ecx
            //   83c8ff               | nop                 dword ptr [eax]

        $sequence_4 = { 807a025c 75bf 83c203 8a0a 56 33f6 b801000000 }
            // n = 7, score = 200
            //   807a025c             | mov                 ebp, dword ptr [esp + 0x30]
            //   75bf                 | push                esi
            //   83c203               | push                edi
            //   8a0a                 | mov                 dword ptr [esi + 8], ebx
            //   56                   | mov                 dword ptr [esi + 0xc], ebx
            //   33f6                 | call                edi
            //   b801000000           | push                eax

        $sequence_5 = { 895e08 895e0c ffd7 50 }
            // n = 4, score = 200
            //   895e08               | inc                 edi
            //   895e0c               | lea                 ecx, [edx + ebx]
            //   ffd7                 | jne                 0xfffffffa
            //   50                   | dec                 eax

        $sequence_6 = { 83c404 85db 0f84da000000 55 8b6c2430 56 57 }
            // n = 7, score = 200
            //   83c404               | dec                 eax
            //   85db                 | add                 esi, edi
            //   0f84da000000         | dec                 esp
            //   55                   | add                 esi, edi
            //   8b6c2430             | inc                 ecx
            //   56                   | dec                 edx
            //   57                   | nop                 word ptr [eax + eax]

        $sequence_7 = { 6a01 52 6a02 8974243c 89742430 c644244800 ff15???????? }
            // n = 7, score = 200
            //   6a01                 | inc                 ecx
            //   52                   | movzx               eax, byte ptr [eax + ecx + 1]
            //   6a02                 | mov                 byte ptr [ecx], dl
            //   8974243c             | ret                 
            //   89742430             | mov                 ecx, dword ptr [esi + 0x54]
            //   c644244800           | inc                 esp
            //   ff15????????         |                     

        $sequence_8 = { 488d8a40000000 e9???????? 488b8a40000000 4883c108 e9???????? 488b8a80000000 e9???????? }
            // n = 7, score = 100
            //   488d8a40000000       | push                ebx
            //   e9????????           |                     
            //   488b8a40000000       | mov                 edi, eax
            //   4883c108             | cmp                 ax, 0xffff
            //   e9????????           |                     
            //   488b8a80000000       | je                  0x81
            //   e9????????           |                     

        $sequence_9 = { 48037c2470 48897c2478 488b8c2400010000 4885c9 741f 4183fe01 7513 }
            // n = 7, score = 100
            //   48037c2470           | inc                 ecx
            //   48897c2478           | push                edi
            //   488b8c2400010000     | dec                 eax
            //   4885c9               | sub                 esp, 0x30
            //   741f                 | dec                 esp
            //   4183fe01             | mov                 esi, ecx
            //   7513                 | xor                 edi, edi

        $sequence_10 = { 4c8d25b6f10000 498b0c24 4d8bc5 488bd3 e8???????? 85c0 }
            // n = 6, score = 100
            //   4c8d25b6f10000       | inc                 esp
            //   498b0c24             | mov                 dword ptr [ecx + edi + 0x1c], ebx
            //   4d8bc5               | dec                 ecx
            //   488bd3               | arpl                bx, cx
            //   e8????????           |                     
            //   85c0                 | dec                 eax

        $sequence_11 = { 4803f7 4c03f7 41ffca 660f1f840000000000 478d0c1a }
            // n = 5, score = 100
            //   4803f7               | inc                 ecx
            //   4c03f7               | cmp                 esi, 1
            //   41ffca               | jne                 0x2b
            //   660f1f840000000000     | dec    eax
            //   478d0c1a             | lea                 edx, [esp + 0x50]

        $sequence_12 = { 75f8 488d15e1160000 b12e 482bd0 }
            // n = 4, score = 100
            //   75f8                 | inc                 esp
            //   488d15e1160000       | cmp                 byte ptr [esp + 0x50], dh
            //   b12e                 | je                  0xc
            //   482bd0               | nop                 

        $sequence_13 = { 4963f9 48897db7 453bc5 0f8e4f020000 418bc0 412bc5 448be0 }
            // n = 7, score = 100
            //   4963f9               | cmp                 ax, 0xfffe
            //   48897db7             | je                  0x81
            //   453bc5               | mov                 edx, dword ptr [esp + 0x294]
            //   0f8e4f020000         | or                  ecx, 0xffffffff
            //   418bc0               | rep movsd           dword ptr es:[edi], dword ptr [esi]
            //   412bc5               | mov                 eax, dword ptr [esp + 0x164]
            //   448be0               | mov                 ecx, edx

        $sequence_14 = { 3918 0f4c18 3bcb 0f8d87000000 488d3d979c0a00 ba58000000 488bcd }
            // n = 7, score = 100
            //   3918                 | and                 ecx, 3
            //   0f4c18               | push                eax
            //   3bcb                 | rep movsb           byte ptr es:[edi], byte ptr [esi]
            //   0f8d87000000         | mov                 ecx, dword ptr [esp + 0x164]
            //   488d3d979c0a00       | dec                 eax
            //   ba58000000           | lea                 ebx, [0xadeb]
            //   488bcd               | dec                 eax

        $sequence_15 = { 4c2bc1 0f1f00 410fb6440801 8811 }
            // n = 4, score = 100
            //   4c2bc1               | dec                 eax
            //   0f1f00               | inc                 edx
            //   410fb6440801         | dec                 eax
            //   8811                 | mov                 dword ptr [esp + 0x10], edx

        $sequence_16 = { 4d85ed 7429 488d15fcd70a00 498bcd }
            // n = 4, score = 100
            //   4d85ed               | mov                 edx, ecx
            //   7429                 | dec                 eax
            //   488d15fcd70a00       | sar                 edx, 0x10
            //   498bcd               | dec                 ecx

        $sequence_17 = { 4c8bc7 48894768 488d4567 ba18822200 }
            // n = 4, score = 100
            //   4c8bc7               | dec                 esp
            //   48894768             | mov                 eax, edi
            //   488d4567             | dec                 eax
            //   ba18822200           | mov                 dword ptr [edi + 0x68], eax

        $sequence_18 = { 4889542410 53 4881ecb0000000 33db }
            // n = 4, score = 100
            //   4889542410           | mov                 ecx, dword ptr [esp + 0x100]
            //   53                   | dec                 eax
            //   4881ecb0000000       | test                ecx, ecx
            //   33db                 | je                  0x31

        $sequence_19 = { 488d542450 4438742450 740a 6690 48ffc2 }
            // n = 5, score = 100
            //   488d542450           | dec                 eax
            //   4438742450           | add                 edi, dword ptr [esp + 0x70]
            //   740a                 | dec                 eax
            //   6690                 | mov                 dword ptr [esp + 0x78], edi
            //   48ffc2               | dec                 eax

        $sequence_20 = { 488d1debad0000 488d3d64ae0000 eb0e 488b03 4885c0 7402 }
            // n = 6, score = 100
            //   488d1debad0000       | push                ecx
            //   488d3d64ae0000       | cmp                 byte ptr [edx + 2], 0x5c
            //   eb0e                 | jne                 0xffffffc1
            //   488b03               | add                 edx, 3
            //   4885c0               | mov                 cl, byte ptr [edx]
            //   7402                 | push                esi

        $sequence_21 = { 8a45d9 4b8b8cf800a20b00 88443139 4b8b84f800a20b00 8854303a eb4c 493bde }
            // n = 7, score = 100
            //   8a45d9               | lea                 edi, [0xae64]
            //   4b8b8cf800a20b00     | jmp                 0x17
            //   88443139             | dec                 eax
            //   4b8b84f800a20b00     | mov                 eax, dword ptr [ebx]
            //   8854303a             | dec                 eax
            //   eb4c                 | test                eax, eax
            //   493bde               | je                  0x13

        $sequence_22 = { 57 4156 4157 4883ec30 4c8bf1 33ff }
            // n = 6, score = 100
            //   57                   | dec                 eax
            //   4156                 | lea                 eax, [ebp + 0x67]
            //   4157                 | mov                 edx, 0x228218
            //   4883ec30             | push                edi
            //   4c8bf1               | inc                 ecx
            //   33ff                 | push                esi

        $sequence_23 = { 44895c391c 4963cb 488bd1 48c1fa10 498b8680000000 }
            // n = 5, score = 100
            //   44895c391c           | xor                 esi, esi
            //   4963cb               | mov                 eax, 1
            //   488bd1               | push                ecx
            //   48c1fa10             | push                edx
            //   498b8680000000       | mov                 ecx, esi

    condition:
        7 of them and filesize < 1581056
}
[TLP:WHITE] win_winnti_w0   (20190822 | rules used for retrohunting by BR Data.)
rule win_winnti_w0 {
    meta:
        author = "BR Data"
        source = "https://github.com/br-data/2019-winnti-analyse/"
        date = "2019-07-24"
        description = "rules used for retrohunting by BR Data."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20190822"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    strings:
        $load_magic = { C7 44 ?? ?? FF D8 FF E0 }
        $iter = { E9 EA EB EC ED EE EF F0 }
        $jpeg = { FF D8 FF E0 00 00 00 00 00 00 }

    condition:
        uint16(0) == 0x5a4d and
        $jpeg and
        ($load_magic or $iter in (@jpeg[1]..@jpeg[1]+200)) and
        for any i in (1..#jpeg): ( uint8(@jpeg[i] + 11) != 0 )
}
[TLP:WHITE] win_winnti_w1   (20190822 | rules used for retrohunting by BR Data.)
rule win_winnti_w1 {
    meta:
        author = "BR Data"
        source = "https://github.com/br-data/2019-winnti-analyse/"
        date = "2019-07-24"
        description = "rules used for retrohunting by BR Data."
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20190822"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $cooper = "Cooper"
        $pattern = { e9 ea eb ec ed ee ef f0}
    condition:
        uint16(0) == 0x5a4d and $cooper and ($pattern in (@cooper[1]..@cooper[1]+100))
}
[TLP:WHITE] win_winnti_w2   (20191207 | No description)
rule win_winnti_w2 {
    meta:
        author = "Bundesamt fuer Verfassungsschutz"
        source = "https://www.verfassungsschutz.de/download/anlage-2019-12-bfv-cyber-brief-2019-01.txt"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20191207"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $e1 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411015}" ascii nocase
        $e2 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411014}" ascii nocase
        $e3 = "Global\\BFE_Notify_Event_{65a097fe-6102-446a-9f9c-55dfc3f411016}" ascii nocase
        $e4 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
        $e5 = "BFE_Notify_Event_{7D00FA3C-FBDC-4A8D-AEEB-3F55A4890D2A}" nocase
    condition:
        (any of ($e*))
}
[TLP:WHITE] win_winnti_w3   (20191207 | No description)
rule win_winnti_w3 {
    meta:
        author = "Bundesamt fuer Verfassungsschutz"
        source = "https://www.verfassungsschutz.de/download/anlage-2019-12-bfv-cyber-brief-2019-01.txt"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.winnti"
        malpedia_version = "20191207"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $a1 = "IPSecMiniPort" wide fullword
        $a2 = "ndis6fw" wide fullword
        $a3 = "TCPIP" wide fullword
        $a4 = "NDIS.SYS" ascii fullword
        $a5 = "ntoskrnl.exe" ascii fullword
        $a6 = "\\BaseNamedObjects\\{B2B87CCA-66BC-4C24-89B2-C23C9EAC2A66}" wide
        $a7 = "\\Device\\Null" wide
        $a8 = "\\Device" wide
        $a9 = "\\Driver" wide
        $b1 = { 66 81 7? ?? 70 17 }
        $b2 = { 81 7? ?? 07 E0 15 00 }
        $b3 = { 8B 46 18 3D 03 60 15 00 }
    condition:
        (6 of ($a*)) and (2 of ($b*))
}
Download all Yara Rules