Actor(s): Sofacy
There is no description at this point.
rule win_zebrocy_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2022-05-16" version = "1" description = "Detects win.zebrocy." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zebrocy" malpedia_rule_date = "20220513" malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26" malpedia_version = "20220516" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 014158 11515c e8???????? dc6360 } // n = 4, score = 100 // 014158 | add dword ptr [ecx + 0x58], eax // 11515c | adc dword ptr [ecx + 0x5c], edx // e8???????? | // dc6360 | fsub qword ptr [ebx + 0x60] $sequence_1 = { 8bfe c645fc07 e8???????? 3ac3 } // n = 4, score = 100 // 8bfe | mov edi, esi // c645fc07 | mov byte ptr [ebp - 4], 7 // e8???????? | // 3ac3 | cmp al, bl $sequence_2 = { 0103 83c41c 5b 5e } // n = 4, score = 100 // 0103 | add dword ptr [ebx], eax // 83c41c | add esp, 0x1c // 5b | pop ebx // 5e | pop esi $sequence_3 = { c7840d2cffffff74434200 52 c7857cffffff24434200 e8???????? 83c404 837d1c10 720c } // n = 7, score = 100 // c7840d2cffffff74434200 | mov dword ptr [ebp + ecx - 0xd4], 0x424374 // 52 | push edx // c7857cffffff24434200 | mov dword ptr [ebp - 0x84], 0x424324 // e8???????? | // 83c404 | add esp, 4 // 837d1c10 | cmp dword ptr [ebp + 0x1c], 0x10 // 720c | jb 0xe $sequence_4 = { 0110 5e 5f 5d } // n = 4, score = 100 // 0110 | add dword ptr [eax], edx // 5e | pop esi // 5f | pop edi // 5d | pop ebp $sequence_5 = { 8bcf ffd0 8b0b 8b5104 } // n = 4, score = 100 // 8bcf | mov ecx, edi // ffd0 | call eax // 8b0b | mov ecx, dword ptr [ebx] // 8b5104 | mov edx, dword ptr [ecx + 4] $sequence_6 = { 0103 31d2 85ff 8b03 } // n = 4, score = 100 // 0103 | add dword ptr [ebx], eax // 31d2 | xor edx, edx // 85ff | test edi, edi // 8b03 | mov eax, dword ptr [ebx] $sequence_7 = { 8888f0894200 40 ebe9 33c0 8945e4 } // n = 5, score = 100 // 8888f0894200 | mov byte ptr [eax + 0x4289f0], cl // 40 | inc eax // ebe9 | jmp 0xffffffeb // 33c0 | xor eax, eax // 8945e4 | mov dword ptr [ebp - 0x1c], eax $sequence_8 = { 0102 8b45d4 89500c 89c1 } // n = 4, score = 100 // 0102 | add dword ptr [edx], eax // 8b45d4 | mov eax, dword ptr [ebp - 0x2c] // 89500c | mov dword ptr [eax + 0xc], edx // 89c1 | mov ecx, eax $sequence_9 = { 014150 8b550c 115154 014158 } // n = 4, score = 100 // 014150 | add dword ptr [ecx + 0x50], eax // 8b550c | mov edx, dword ptr [ebp + 0xc] // 115154 | adc dword ptr [ecx + 0x54], edx // 014158 | add dword ptr [ecx + 0x58], eax $sequence_10 = { 0110 8b7dd4 ba???????? 89470c } // n = 4, score = 100 // 0110 | add dword ptr [eax], edx // 8b7dd4 | mov edi, dword ptr [ebp - 0x2c] // ba???????? | // 89470c | mov dword ptr [edi + 0xc], eax $sequence_11 = { 83cbff 8b06 8bc8 c1f905 8b0c8dc0a84200 83e01f c1e006 } // n = 7, score = 100 // 83cbff | or ebx, 0xffffffff // 8b06 | mov eax, dword ptr [esi] // 8bc8 | mov ecx, eax // c1f905 | sar ecx, 5 // 8b0c8dc0a84200 | mov ecx, dword ptr [ecx*4 + 0x42a8c0] // 83e01f | and eax, 0x1f // c1e006 | shl eax, 6 $sequence_12 = { 8b450c 8945f4 8b4514 40 c745ec40e44000 894df8 } // n = 6, score = 100 // 8b450c | mov eax, dword ptr [ebp + 0xc] // 8945f4 | mov dword ptr [ebp - 0xc], eax // 8b4514 | mov eax, dword ptr [ebp + 0x14] // 40 | inc eax // c745ec40e44000 | mov dword ptr [ebp - 0x14], 0x40e440 // 894df8 | mov dword ptr [ebp - 8], ecx $sequence_13 = { c705????????0f000000 a3???????? a2???????? c3 c705????????50124200 c3 } // n = 6, score = 100 // c705????????0f000000 | // a3???????? | // a2???????? | // c3 | ret // c705????????50124200 | // c3 | ret $sequence_14 = { 0103 8b0e ba???????? e8???????? } // n = 4, score = 100 // 0103 | add dword ptr [ebx], eax // 8b0e | mov ecx, dword ptr [esi] // ba???????? | // e8???????? | $sequence_15 = { 51 03de 03d8 03d0 } // n = 4, score = 100 // 51 | push ecx // 03de | add ebx, esi // 03d8 | add ebx, eax // 03d0 | add edx, eax condition: 7 of them and filesize < 393216 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY