SYMBOLCOMMON_NAMEaka. SYNONYMS
win.zeoticus (Back to overview)

Zeoticus


There is no description at this point.

References
2021-02-03SentinelOneJim Walter
@online{walter:20210203:zeoticus:b4fee76, author = {Jim Walter}, title = {{Zeoticus 2.0 | Ransomware With No C2 Required}}, date = {2021-02-03}, organization = {SentinelOne}, url = {https://labs.sentinelone.com/zeoticus-2-0-ransomware-with-no-c2-required/}, language = {English}, urldate = {2021-02-04} } Zeoticus 2.0 | Ransomware With No C2 Required
Zeoticus
Yara Rules
[TLP:WHITE] win_zeoticus_auto (20211008 | Detects win.zeoticus.)
rule win_zeoticus_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.zeoticus."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zeoticus"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c1e818 0bf0 8bca 038c24f8000000 8bc6 138424fc000000 014c2410 }
            // n = 7, score = 100
            //   c1e818               | shr                 eax, 0x18
            //   0bf0                 | or                  esi, eax
            //   8bca                 | mov                 ecx, edx
            //   038c24f8000000       | add                 ecx, dword ptr [esp + 0xf8]
            //   8bc6                 | mov                 eax, esi
            //   138424fc000000       | adc                 eax, dword ptr [esp + 0xfc]
            //   014c2410             | add                 dword ptr [esp + 0x10], ecx

        $sequence_1 = { 0144241c 8b44241c 89842438010000 8b44242c 13c1 335c241c 33f8 }
            // n = 7, score = 100
            //   0144241c             | add                 dword ptr [esp + 0x1c], eax
            //   8b44241c             | mov                 eax, dword ptr [esp + 0x1c]
            //   89842438010000       | mov                 dword ptr [esp + 0x138], eax
            //   8b44242c             | mov                 eax, dword ptr [esp + 0x2c]
            //   13c1                 | adc                 eax, ecx
            //   335c241c             | xor                 ebx, dword ptr [esp + 0x1c]
            //   33f8                 | xor                 edi, eax

        $sequence_2 = { f765e0 03f8 8b45f8 13da f765f0 03f8 8b450c }
            // n = 7, score = 100
            //   f765e0               | mul                 dword ptr [ebp - 0x20]
            //   03f8                 | add                 edi, eax
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   13da                 | adc                 ebx, edx
            //   f765f0               | mul                 dword ptr [ebp - 0x10]
            //   03f8                 | add                 edi, eax
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]

        $sequence_3 = { 8b4a2c 137a04 33c6 894c2438 35d182e6ad 8b4a30 894c2440 }
            // n = 7, score = 100
            //   8b4a2c               | mov                 ecx, dword ptr [edx + 0x2c]
            //   137a04               | adc                 edi, dword ptr [edx + 4]
            //   33c6                 | xor                 eax, esi
            //   894c2438             | mov                 dword ptr [esp + 0x38], ecx
            //   35d182e6ad           | xor                 eax, 0xade682d1
            //   8b4a30               | mov                 ecx, dword ptr [edx + 0x30]
            //   894c2440             | mov                 dword ptr [esp + 0x40], ecx

        $sequence_4 = { 8b8c2410010000 0bd8 8b842414010000 03cf 13c3 014c2410 8b4c2410 }
            // n = 7, score = 100
            //   8b8c2410010000       | mov                 ecx, dword ptr [esp + 0x110]
            //   0bd8                 | or                  ebx, eax
            //   8b842414010000       | mov                 eax, dword ptr [esp + 0x114]
            //   03cf                 | add                 ecx, edi
            //   13c3                 | adc                 eax, ebx
            //   014c2410             | add                 dword ptr [esp + 0x10], ecx
            //   8b4c2410             | mov                 ecx, dword ptr [esp + 0x10]

        $sequence_5 = { 8b45c8 13f2 f76de0 03c8 8b45f0 13f2 f76dd8 }
            // n = 7, score = 100
            //   8b45c8               | mov                 eax, dword ptr [ebp - 0x38]
            //   13f2                 | adc                 esi, edx
            //   f76de0               | imul                dword ptr [ebp - 0x20]
            //   03c8                 | add                 ecx, eax
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]
            //   13f2                 | adc                 esi, edx
            //   f76dd8               | imul                dword ptr [ebp - 0x28]

        $sequence_6 = { 85c0 7522 6804010000 e8???????? 8b0d???????? 53 68???????? }
            // n = 7, score = 100
            //   85c0                 | test                eax, eax
            //   7522                 | jne                 0x24
            //   6804010000           | push                0x104
            //   e8????????           |                     
            //   8b0d????????         |                     
            //   53                   | push                ebx
            //   68????????           |                     

        $sequence_7 = { 8bf2 8bc8 8b55f4 8d0412 f76dd8 03c8 894dfc }
            // n = 7, score = 100
            //   8bf2                 | mov                 esi, edx
            //   8bc8                 | mov                 ecx, eax
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   8d0412               | lea                 eax, dword ptr [edx + edx]
            //   f76dd8               | imul                dword ptr [ebp - 0x28]
            //   03c8                 | add                 ecx, eax
            //   894dfc               | mov                 dword ptr [ebp - 4], ecx

        $sequence_8 = { e8???????? 83c404 8d4588 8d9560ffffff 8d4e78 50 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   8d4588               | lea                 eax, dword ptr [ebp - 0x78]
            //   8d9560ffffff         | lea                 edx, dword ptr [ebp - 0xa0]
            //   8d4e78               | lea                 ecx, dword ptr [esi + 0x78]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_9 = { f76de4 014508 8b45f0 13ca f76ddc 014508 }
            // n = 6, score = 100
            //   f76de4               | imul                dword ptr [ebp - 0x1c]
            //   014508               | add                 dword ptr [ebp + 8], eax
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]
            //   13ca                 | adc                 ecx, edx
            //   f76ddc               | imul                dword ptr [ebp - 0x24]
            //   014508               | add                 dword ptr [ebp + 8], eax

    condition:
        7 of them and filesize < 468992
}
Download all Yara Rules