There is no description at this point.
rule win_xorist_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-03-28" version = "1" description = "Detects win.xorist." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.xorist" malpedia_rule_date = "20230328" malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d" malpedia_version = "20230407" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 7504 b001 eb44 53 e8???????? 6a0c 59 } // n = 7, score = 100 // 7504 | jne 6 // b001 | mov al, 1 // eb44 | jmp 0x46 // 53 | push ebx // e8???????? | // 6a0c | push 0xc // 59 | pop ecx $sequence_1 = { ff742408 e8???????? 84c0 7404 b001 eb10 ff742404 } // n = 7, score = 100 // ff742408 | push dword ptr [esp + 8] // e8???????? | // 84c0 | test al, al // 7404 | je 6 // b001 | mov al, 1 // eb10 | jmp 0x12 // ff742404 | push dword ptr [esp + 4] $sequence_2 = { 56 e8???????? 59 8d8da8fbffff 8d3446 83c602 8bc6 } // n = 7, score = 100 // 56 | push esi // e8???????? | // 59 | pop ecx // 8d8da8fbffff | lea ecx, [ebp - 0x458] // 8d3446 | lea esi, [esi + eax*2] // 83c602 | add esi, 2 // 8bc6 | mov eax, esi $sequence_3 = { 8bcf 898668060000 e8???????? 89864c060000 898644060000 85c0 0f8432010000 } // n = 7, score = 100 // 8bcf | mov ecx, edi // 898668060000 | mov dword ptr [esi + 0x668], eax // e8???????? | // 89864c060000 | mov dword ptr [esi + 0x64c], eax // 898644060000 | mov dword ptr [esi + 0x644], eax // 85c0 | test eax, eax // 0f8432010000 | je 0x138 $sequence_4 = { 33748500 33749d00 8b442420 8bc8 d1c6 89749d00 8b5c2410 } // n = 7, score = 100 // 33748500 | xor esi, dword ptr [ebp + eax*4] // 33749d00 | xor esi, dword ptr [ebp + ebx*4] // 8b442420 | mov eax, dword ptr [esp + 0x20] // 8bc8 | mov ecx, eax // d1c6 | rol esi, 1 // 89749d00 | mov dword ptr [ebp + ebx*4], esi // 8b5c2410 | mov ebx, dword ptr [esp + 0x10] $sequence_5 = { c20400 56 8b742408 ba00000400 3bf2 7328 8b09 } // n = 7, score = 100 // c20400 | ret 4 // 56 | push esi // 8b742408 | mov esi, dword ptr [esp + 8] // ba00000400 | mov edx, 0x40000 // 3bf2 | cmp esi, edx // 7328 | jae 0x2a // 8b09 | mov ecx, dword ptr [ecx] $sequence_6 = { 807f2c00 7527 8d4730 c6472c01 50 8d4718 50 } // n = 7, score = 100 // 807f2c00 | cmp byte ptr [edi + 0x2c], 0 // 7527 | jne 0x29 // 8d4730 | lea eax, [edi + 0x30] // c6472c01 | mov byte ptr [edi + 0x2c], 1 // 50 | push eax // 8d4718 | lea eax, [edi + 0x18] // 50 | push eax $sequence_7 = { e8???????? 8bc6 50 e8???????? 59 8db5aafbffff } // n = 6, score = 100 // e8???????? | // 8bc6 | mov eax, esi // 50 | push eax // e8???????? | // 59 | pop ecx // 8db5aafbffff | lea esi, [ebp - 0x456] $sequence_8 = { 3894306c060000 74f1 0fb64101 8b542414 03e8 8b5c241c 8d842424040000 } // n = 7, score = 100 // 3894306c060000 | cmp byte ptr [eax + esi + 0x66c], dl // 74f1 | je 0xfffffff3 // 0fb64101 | movzx eax, byte ptr [ecx + 1] // 8b542414 | mov edx, dword ptr [esp + 0x14] // 03e8 | add ebp, eax // 8b5c241c | mov ebx, dword ptr [esp + 0x1c] // 8d842424040000 | lea eax, [esp + 0x424] $sequence_9 = { 8b4c2428 83c40c 83c108 83c508 83eb08 894c241c 83ef01 } // n = 7, score = 100 // 8b4c2428 | mov ecx, dword ptr [esp + 0x28] // 83c40c | add esp, 0xc // 83c108 | add ecx, 8 // 83c508 | add ebp, 8 // 83eb08 | sub ebx, 8 // 894c241c | mov dword ptr [esp + 0x1c], ecx // 83ef01 | sub edi, 1 condition: 7 of them and filesize < 1402880 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY