Actor(s): Kimsuky
There is no description at this point.
rule win_yorekey_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-01-25" version = "1" description = "Detects win.yorekey." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.yorekey" malpedia_rule_date = "20230124" malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686" malpedia_version = "20230125" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 750a 85c0 7506 ff15???????? } // n = 4, score = 200 // 750a | jne 0xc // 85c0 | test eax, eax // 7506 | jne 8 // ff15???????? | $sequence_1 = { eb03 488bc7 44883c08 48895f10 48837f1810 7205 } // n = 6, score = 100 // eb03 | and ecx, 0xf // 488bc7 | jmp 5 // 44883c08 | jmp 5 // 48895f10 | dec eax // 48837f1810 | mov eax, edi // 7205 | inc esp $sequence_2 = { 490fbec7 420fbe8c08205e0100 83e10f eb03 } // n = 4, score = 100 // 490fbec7 | dec ecx // 420fbe8c08205e0100 | movsx eax, bh // 83e10f | inc edx // eb03 | movsx ecx, byte ptr [eax + ecx + 0x15e20] $sequence_3 = { 56 8d957cffffff 57 52 e8???????? 8b7d8c } // n = 6, score = 100 // 56 | mov dword ptr [ebp - 0x10], eax // 8d957cffffff | dec eax // 57 | lea edx, [ebp - 0x60] // 52 | dec eax // e8???????? | // 8b7d8c | lea ecx, [0x19fbd] $sequence_4 = { 488b05???????? 4833c4 488945f0 488d55a0 488d0dbd9f0100 } // n = 5, score = 100 // 488b05???????? | // 4833c4 | xor eax, eax // 488945f0 | cmp cl, 0xa // 488d55a0 | sete al // 488d0dbd9f0100 | mov dword ptr [esp + 0x44], eax $sequence_5 = { 7520 80fcfe 751b 6a02 } // n = 4, score = 100 // 7520 | mov dword ptr [ebp - 0x20], esi // 80fcfe | lea esi, [ecx + 0x411530] // 751b | mov dword ptr [ebp - 0x1c], esi // 6a02 | jmp 0x39 $sequence_6 = { 55 8bec 8b4508 56 8d34c5d8194100 } // n = 5, score = 100 // 55 | jne 8 // 8bec | jb 0x11 // 8b4508 | mov edx, dword ptr [ebp - 0x84] // 56 | push edx // 8d34c5d8194100 | add esp, 4 $sequence_7 = { 33c0 80f90a 0f94c0 89442444 488d05c00d0100 } // n = 5, score = 100 // 33c0 | nop // 80f90a | dec eax // 0f94c0 | inc eax // 89442444 | cmp word ptr [ebx + eax*2], si // 488d05c00d0100 | test eax, eax $sequence_8 = { 8b3d???????? bb04000000 6a0a ff15???????? ff15???????? 85c0 } // n = 6, score = 100 // 8b3d???????? | // bb04000000 | dec eax // 6a0a | lea eax, [0x10ce3] // ff15???????? | // ff15???????? | // 85c0 | dec eax $sequence_9 = { 897c243c 897c2438 6689bc2480000000 e8???????? 488d942480000000 41b804010000 } // n = 6, score = 100 // 897c243c | je 0x1d // 897c2438 | dec eax // 6689bc2480000000 | mov ecx, dword ptr [esp + 0x38] // e8???????? | // 488d942480000000 | dec eax // 41b804010000 | lea edx, [0xf7ac] $sequence_10 = { 720f 8b957cffffff 52 e8???????? 83c404 8bc6 } // n = 6, score = 100 // 720f | inc ecx // 8b957cffffff | mov eax, 0x104 // 52 | dec eax // e8???????? | // 83c404 | xor eax, esp // 8bc6 | dec eax $sequence_11 = { 8d8d74ffffff 51 56 57 53 ff15???????? 85c0 } // n = 7, score = 100 // 8d8d74ffffff | mov eax, esi // 51 | push esi // 56 | lea edx, [ebp - 0x84] // 57 | push edi // 53 | push edx // ff15???????? | // 85c0 | mov edi, dword ptr [ebp - 0x74] $sequence_12 = { 85c0 741b 488b4c2438 488d15acf70000 ff15???????? } // n = 5, score = 100 // 85c0 | jb 7 // 741b | jne 0x3d // 488b4c2438 | dec eax // 488d15acf70000 | or eax, 0xffffffff // ff15???????? | $sequence_13 = { 83c40c 6bc930 8975e0 8db130154100 8975e4 eb2b 8a4601 } // n = 7, score = 100 // 83c40c | mov ecx, dword ptr [eax + ecx*8] // 6bc930 | dec esp // 8975e0 | lea ecx, [esp + 0x58] // 8db130154100 | dec eax // 8975e4 | lea edx, [esp + 0x60] // eb2b | jne 0xc // 8a4601 | test eax, eax $sequence_14 = { 753b 4883c8ff 90 48ffc0 66393443 } // n = 5, score = 100 // 753b | mov byte ptr [eax + ecx], bh // 4883c8ff | dec eax // 90 | mov dword ptr [edi + 0x10], ebx // 48ffc0 | dec eax // 66393443 | cmp dword ptr [edi + 0x18], 0x10 condition: 7 of them and filesize < 274432 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY