There is no description at this point.
rule win_xfilesstealer_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.xfilesstealer." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfilesstealer" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { ffd3 33c9 85c0 7524 448b4c2450 4c8d05c3f12600 ba00040000 } // n = 7, score = 100 // ffd3 | inc ebp // 33c9 | test esi, esi // 85c0 | jne 0x1838 // 7524 | test cl, cl // 448b4c2450 | jne 0x1838 // 4c8d05c3f12600 | cmp ebx, 0x2c // ba00040000 | cmp ebx, 0x27 $sequence_1 = { e8???????? 8bf8 488d4dc0 e8???????? 85ff 0f88cb000000 488d55c0 } // n = 7, score = 100 // e8???????? | // 8bf8 | inc esp // 488d4dc0 | mov eax, esi // e8???????? | // 85ff | inc ecx // 0f88cb000000 | mov edx, esi // 488d55c0 | dec eax $sequence_2 = { ffd3 498b4f58 894114 498b4758 33ff 897818 498b4758 } // n = 7, score = 100 // ffd3 | jne 0x97 // 498b4f58 | dec eax // 894114 | mov edx, edi // 498b4758 | dec eax // 33ff | mov ecx, esi // 897818 | test al, al // 498b4758 | je 0x97 $sequence_3 = { eb00 90 488d4d48 e8???????? 90 837d5800 7411 } // n = 7, score = 100 // eb00 | je 0x1286 // 90 | dec eax // 488d4d48 | lea ecx, [ebp + 0x1f0] // e8???????? | // 90 | jne 0x1195 // 837d5800 | inc ecx // 7411 | mov ecx, dword ptr [eax] $sequence_4 = { e8???????? 4c392b 7439 488b05???????? 488906 488d0d439c8900 48894e08 } // n = 7, score = 100 // e8???????? | // 4c392b | mov ecx, dword ptr [ecx + 0x4b0] // 7439 | inc ecx // 488b05???????? | // 488906 | mov edx, eax // 488d0d439c8900 | dec ecx // 48894e08 | mov ecx, ecx $sequence_5 = { ffd3 4c63c0 48c744243080060000 4c89442428 48c744242020205248 4c8d0dee771b00 ba00400000 } // n = 7, score = 100 // ffd3 | mov eax, dword ptr [esp + 0x30] // 4c63c0 | test al, al // 48c744243080060000 | jne 0x4b // 4c89442428 | dec eax // 48c744242020205248 | lea ecx, [esp + 0x20] // 4c8d0dee771b00 | mov dword ptr [esp + 0x28], 0x3d2 // ba00400000 | mov eax, dword ptr [esp + 0x30] $sequence_6 = { b801000000 e9???????? 85ed 7512 4d8bc6 488bd6 488bcb } // n = 7, score = 100 // b801000000 | mov ebx, eax // e9???????? | // 85ed | mov ecx, ebx // 7512 | dec esp // 4d8bc6 | lea eax, [0x3857e8] // 488bd6 | mov edx, 0x104 // 488bcb | dec eax $sequence_7 = { ff15???????? 8bd8 85c0 7e09 0fb7d8 81cb00000780 488d4db0 } // n = 7, score = 100 // ff15???????? | // 8bd8 | mov ecx, dword ptr [esi] // 85c0 | dec eax // 7e09 | mov eax, dword ptr [esi + 0x108] // 0fb7d8 | sub ecx, 0x10 // 81cb00000780 | dec eax // 488d4db0 | add ecx, ecx $sequence_8 = { 89742428 4489742420 4c8d4df8 4c8d45d8 488b55f0 488d8d30010000 e8???????? } // n = 7, score = 100 // 89742428 | mov dword ptr [esi + eax*2], edi // 4489742420 | cmp eax, -1 // 4c8d4df8 | je 0x618 // 4c8d45d8 | dec ecx // 488b55f0 | mov ecx, esi // 488d8d30010000 | dec eax // e8???????? | $sequence_9 = { ff5208 33c0 4883c448 c3 488d4c2420 c744242890010000 e8???????? } // n = 7, score = 100 // ff5208 | mov eax, edi // 33c0 | dec ecx // 4883c448 | mov edx, ebp // c3 | dec ecx // 488d4c2420 | mov ecx, edi // c744242890010000 | cmp eax, 5 // e8???????? | condition: 7 of them and filesize < 20821780 }
rule win_xfilesstealer_w0 { meta: author = "Johannes Bader @viql" date = "2022-04-15" version = "v1.0" description = "detects XFiles-Stealer" hash = "d06072f959d895f2fc9a57f44bf6357596c5c3410e90dabe06b171161f37d690" tlp = "TLP:WHITE" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xfilesstealer" malpedia_rule_date = "20220425" malpedia_hash = "" malpedia_version = "20220425" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" strings: $ad_1 = "Telegram bot - @XFILESShop_Bot" wide $ad_2 = "Telegram support - @XFILES_Seller" wide $names_1 = "XFiles.Models.Yeti" $names_2 = "anti_vzlom_popki" // анти взлом попки $names_3 = "assType" $names_4 = "hackrjaw" $upload_1 = "zipx" wide $upload_2 = "user_id" wide $upload_3 = "passworlds_x" wide $upload_4 = "ip_x" wide $upload_5 = "cc_x" wide $upload_6 = "cookies_x" wide $upload_7 = "zip_x" wide $upload_8 = "contry_x" wide $upload_9 = "tag_x" wide $upload_10 = "piece" wide condition: uint16(0) == 0x5A4D and ( all of ($ad_*) or all of ($names_*) or all of ($upload_*) ) }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below. Changes regarding references should be proposed on the Malpedia library page.
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY