SYMBOLCOMMON_NAMEaka. SYNONYMS
win.woodyrat (Back to overview)

Woody RAT


There is no description at this point.

References
2022-08-03MalwarebytesAnkur Saini, Hossein Jazi
@online{saini:20220803:woody:0b4bbb8, author = {Ankur Saini and Hossein Jazi}, title = {{Woody RAT: A new feature-rich malware spotted in the wild}}, date = {2022-08-03}, organization = {Malwarebytes}, url = {https://blog.malwarebytes.com/threat-intelligence/2022/08/woody-rat-a-new-feature-rich-malware-spotted-in-the-wild/}, language = {English}, urldate = {2022-08-05} } Woody RAT: A new feature-rich malware spotted in the wild
Woody RAT
Yara Rules
[TLP:WHITE] win_woodyrat_auto (20221125 | Detects win.woodyrat.)
rule win_woodyrat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-11-21"
        version = "1"
        description = "Detects win.woodyrat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.woodyrat"
        malpedia_rule_date = "20221118"
        malpedia_hash = "e0702e2e6d1d00da65c8a29a4ebacd0a4c59e1af"
        malpedia_version = "20221125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6689850cffffff 83fa08 7235 8b8dd8feffff 8d145502000000 8bc1 81fa00100000 }
            // n = 7, score = 100
            //   6689850cffffff       | mov                 word ptr [ebp - 0xf4], ax
            //   83fa08               | cmp                 edx, 8
            //   7235                 | jb                  0x37
            //   8b8dd8feffff         | mov                 ecx, dword ptr [ebp - 0x128]
            //   8d145502000000       | lea                 edx, [edx*2 + 2]
            //   8bc1                 | mov                 eax, ecx
            //   81fa00100000         | cmp                 edx, 0x1000

        $sequence_1 = { 8b4508 8b4d0c 8b33 8945d8 894de4 8bc8 }
            // n = 6, score = 100
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8b33                 | mov                 esi, dword ptr [ebx]
            //   8945d8               | mov                 dword ptr [ebp - 0x28], eax
            //   894de4               | mov                 dword ptr [ebp - 0x1c], ecx
            //   8bc8                 | mov                 ecx, eax

        $sequence_2 = { e8???????? 8b8d94ebffff 83ec0c 8bc4 c645fc04 6a03 50 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8b8d94ebffff         | mov                 ecx, dword ptr [ebp - 0x146c]
            //   83ec0c               | sub                 esp, 0xc
            //   8bc4                 | mov                 eax, esp
            //   c645fc04             | mov                 byte ptr [ebp - 4], 4
            //   6a03                 | push                3
            //   50                   | push                eax

        $sequence_3 = { 668951a4 c741b807000000 8956b8 8956bc 0f1041bc 0f1146a8 f30f7e41cc }
            // n = 7, score = 100
            //   668951a4             | mov                 word ptr [ecx - 0x5c], dx
            //   c741b807000000       | mov                 dword ptr [ecx - 0x48], 7
            //   8956b8               | mov                 dword ptr [esi - 0x48], edx
            //   8956bc               | mov                 dword ptr [esi - 0x44], edx
            //   0f1041bc             | movups              xmm0, xmmword ptr [ecx - 0x44]
            //   0f1146a8             | movups              xmmword ptr [esi - 0x58], xmm0
            //   f30f7e41cc           | movq                xmm0, qword ptr [ecx - 0x34]

        $sequence_4 = { 8bff 55 8bec 8b4d08 33c0 3b0cc5c8804400 7427 }
            // n = 7, score = 100
            //   8bff                 | mov                 edi, edi
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   33c0                 | xor                 eax, eax
            //   3b0cc5c8804400       | cmp                 ecx, dword ptr [eax*8 + 0x4480c8]
            //   7427                 | je                  0x29

        $sequence_5 = { ffd7 59 e9???????? c745e003000000 e9???????? c745e4d09c4400 ebb8 }
            // n = 7, score = 100
            //   ffd7                 | call                edi
            //   59                   | pop                 ecx
            //   e9????????           |                     
            //   c745e003000000       | mov                 dword ptr [ebp - 0x20], 3
            //   e9????????           |                     
            //   c745e4d09c4400       | mov                 dword ptr [ebp - 0x1c], 0x449cd0
            //   ebb8                 | jmp                 0xffffffba

        $sequence_6 = { 83c018 894598 3b4594 0f850effffff 8b55b0 8b45a8 8b4dac }
            // n = 7, score = 100
            //   83c018               | add                 eax, 0x18
            //   894598               | mov                 dword ptr [ebp - 0x68], eax
            //   3b4594               | cmp                 eax, dword ptr [ebp - 0x6c]
            //   0f850effffff         | jne                 0xffffff14
            //   8b55b0               | mov                 edx, dword ptr [ebp - 0x50]
            //   8b45a8               | mov                 eax, dword ptr [ebp - 0x58]
            //   8b4dac               | mov                 ecx, dword ptr [ebp - 0x54]

        $sequence_7 = { 8b06 8b7e04 898590feffff 8945cc 8b4608 897dd0 8945d4 }
            // n = 7, score = 100
            //   8b06                 | mov                 eax, dword ptr [esi]
            //   8b7e04               | mov                 edi, dword ptr [esi + 4]
            //   898590feffff         | mov                 dword ptr [ebp - 0x170], eax
            //   8945cc               | mov                 dword ptr [ebp - 0x34], eax
            //   8b4608               | mov                 eax, dword ptr [esi + 8]
            //   897dd0               | mov                 dword ptr [ebp - 0x30], edi
            //   8945d4               | mov                 dword ptr [ebp - 0x2c], eax

        $sequence_8 = { 8bc3 5f 5b 5d c20400 8900 8b4318 }
            // n = 7, score = 100
            //   8bc3                 | mov                 eax, ebx
            //   5f                   | pop                 edi
            //   5b                   | pop                 ebx
            //   5d                   | pop                 ebp
            //   c20400               | ret                 4
            //   8900                 | mov                 dword ptr [eax], eax
            //   8b4318               | mov                 eax, dword ptr [ebx + 0x18]

        $sequence_9 = { 8b45a0 83782800 7618 8d5018 8b4210 48 894210 }
            // n = 7, score = 100
            //   8b45a0               | mov                 eax, dword ptr [ebp - 0x60]
            //   83782800             | cmp                 dword ptr [eax + 0x28], 0
            //   7618                 | jbe                 0x1a
            //   8d5018               | lea                 edx, [eax + 0x18]
            //   8b4210               | mov                 eax, dword ptr [edx + 0x10]
            //   48                   | dec                 eax
            //   894210               | mov                 dword ptr [edx + 0x10], eax

    condition:
        7 of them and filesize < 785408
}
Download all Yara Rules