There is no description at this point.
rule win_zitmo_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2020-12-22" version = "1" description = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zitmo" malpedia_rule_date = "20201222" malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130" malpedia_version = "20201023" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { c745d831353700 47 4f f7d6 83658834 ffb5fcfeffff ffb594feffff } // n = 7, score = 200 // c745d831353700 | mov dword ptr [ebp - 0x28], 0x373531 // 47 | inc edi // 4f | dec edi // f7d6 | not esi // 83658834 | and dword ptr [ebp - 0x78], 0x34 // ffb5fcfeffff | push dword ptr [ebp - 0x104] // ffb594feffff | push dword ptr [ebp - 0x16c] $sequence_1 = { 838d7cffffff37 c78570ffffff31373431 097dd0 6834313600 8d9538feffff 52 8d9584feffff } // n = 7, score = 200 // 838d7cffffff37 | or dword ptr [ebp - 0x84], 0x37 // c78570ffffff31373431 | mov dword ptr [ebp - 0x90], 0x31343731 // 097dd0 | or dword ptr [ebp - 0x30], edi // 6834313600 | push 0x363134 // 8d9538feffff | lea edx, [ebp - 0x1c8] // 52 | push edx // 8d9584feffff | lea edx, [ebp - 0x17c] $sequence_2 = { 23f8 81659436320000 8175cc33380000 8bd7 } // n = 4, score = 200 // 23f8 | and edi, eax // 81659436320000 | and dword ptr [ebp - 0x6c], 0x3236 // 8175cc33380000 | xor dword ptr [ebp - 0x34], 0x3833 // 8bd7 | mov edx, edi $sequence_3 = { c7458400000000 31b560ffffff 8d8d28feffff 51 6833373400 } // n = 5, score = 200 // c7458400000000 | mov dword ptr [ebp - 0x7c], 0 // 31b560ffffff | xor dword ptr [ebp - 0xa0], esi // 8d8d28feffff | lea ecx, [ebp - 0x1d8] // 51 | push ecx // 6833373400 | push 0x343733 $sequence_4 = { 6873130100 6831350000 57 e8???????? 83ec04 c7042400000000 50 } // n = 7, score = 200 // 6873130100 | push 0x11373 // 6831350000 | push 0x3531 // 57 | push edi // e8???????? | // 83ec04 | sub esp, 4 // c7042400000000 | mov dword ptr [esp], 0 // 50 | push eax $sequence_5 = { 8bde ff4dcc 53 ffb550ffffff ff75f8 } // n = 5, score = 200 // 8bde | mov ebx, esi // ff4dcc | dec dword ptr [ebp - 0x34] // 53 | push ebx // ffb550ffffff | push dword ptr [ebp - 0xb0] // ff75f8 | push dword ptr [ebp - 8] $sequence_6 = { 43 68ba641fc7 e8???????? 23c7 } // n = 4, score = 200 // 43 | inc ebx // 68ba641fc7 | push 0xc71f64ba // e8???????? | // 23c7 | and eax, edi $sequence_7 = { 8bec 81c404ffffff f7d8 8bf1 ff8520ffffff c9 c20c00 } // n = 7, score = 200 // 8bec | mov ebp, esp // 81c404ffffff | add esp, 0xffffff04 // f7d8 | neg eax // 8bf1 | mov esi, ecx // ff8520ffffff | inc dword ptr [ebp - 0xe0] // c9 | leave // c20c00 | ret 0xc $sequence_8 = { 42 4e f7df 03d7 48 40 } // n = 6, score = 200 // 42 | inc edx // 4e | dec esi // f7df | neg edi // 03d7 | add edx, edi // 48 | dec eax // 40 | inc eax $sequence_9 = { 81c454ffffff 43 0955e8 895db0 c9 c20c00 } // n = 6, score = 200 // 81c454ffffff | add esp, 0xffffff54 // 43 | inc ebx // 0955e8 | or dword ptr [ebp - 0x18], edx // 895db0 | mov dword ptr [ebp - 0x50], ebx // c9 | leave // c20c00 | ret 0xc condition: 7 of them and filesize < 843776 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY