There is no description at this point.
rule win_ziyangrat_auto { meta: author = "Felix Bilstein - yara-signator at cocacoding dot com" date = "2023-12-06" version = "1" description = "Detects win.ziyangrat." info = "autogenerated rule brought to you by yara-signator" tool = "yara-signator v0.6.0" signator_config = "callsandjumps;datarefs;binvalue" malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ziyangrat" malpedia_rule_date = "20231130" malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351" malpedia_version = "20230808" malpedia_license = "CC BY-SA 4.0" malpedia_sharing = "TLP:WHITE" /* DISCLAIMER * The strings used in this rule have been automatically selected from the * disassembly of memory dumps and unpacked files, using YARA-Signator. * The code and documentation is published here: * https://github.com/fxb-cocacoding/yara-signator * As Malpedia is used as data source, please note that for a given * number of families, only single samples are documented. * This likely impacts the degree of generalization these rules will offer. * Take the described generation method also into consideration when you * apply the rules in your use cases and assign them confidence levels. */ strings: $sequence_0 = { 89442405 89442409 668944240d 8844240f 8b11 8d442410 } // n = 6, score = 200 // 89442405 | mov dword ptr [esp + 5], eax // 89442409 | mov dword ptr [esp + 9], eax // 668944240d | mov word ptr [esp + 0xd], ax // 8844240f | mov byte ptr [esp + 0xf], al // 8b11 | mov edx, dword ptr [ecx] // 8d442410 | lea eax, [esp + 0x10] $sequence_1 = { c3 8b9c24a4000000 68???????? 53 8d4c2444 } // n = 5, score = 200 // c3 | ret // 8b9c24a4000000 | mov ebx, dword ptr [esp + 0xa4] // 68???????? | // 53 | push ebx // 8d4c2444 | lea ecx, [esp + 0x44] $sequence_2 = { c68424e200000069 888424e3000000 889c24e4000000 888c24eb000000 c68424ec00000047 c68424ed00000020 } // n = 6, score = 200 // c68424e200000069 | mov byte ptr [esp + 0xe2], 0x69 // 888424e3000000 | mov byte ptr [esp + 0xe3], al // 889c24e4000000 | mov byte ptr [esp + 0xe4], bl // 888c24eb000000 | mov byte ptr [esp + 0xeb], cl // c68424ec00000047 | mov byte ptr [esp + 0xec], 0x47 // c68424ed00000020 | mov byte ptr [esp + 0xed], 0x20 $sequence_3 = { b93f000000 33c0 8dbc2441010000 889c2440010000 b265 f3ab } // n = 6, score = 200 // b93f000000 | mov ecx, 0x3f // 33c0 | xor eax, eax // 8dbc2441010000 | lea edi, [esp + 0x141] // 889c2440010000 | mov byte ptr [esp + 0x140], bl // b265 | mov dl, 0x65 // f3ab | rep stosd dword ptr es:[edi], eax $sequence_4 = { 8dbd48f7ffff 83c9ff 33c0 f2ae f7d1 83c1ff 51 } // n = 7, score = 200 // 8dbd48f7ffff | lea edi, [ebp - 0x8b8] // 83c9ff | or ecx, 0xffffffff // 33c0 | xor eax, eax // f2ae | repne scasb al, byte ptr es:[edi] // f7d1 | not ecx // 83c1ff | add ecx, -1 // 51 | push ecx $sequence_5 = { 889c2410020000 89442461 889c2410070000 6689442465 889c2410030000 } // n = 5, score = 200 // 889c2410020000 | mov byte ptr [esp + 0x210], bl // 89442461 | mov dword ptr [esp + 0x61], eax // 889c2410070000 | mov byte ptr [esp + 0x710], bl // 6689442465 | mov word ptr [esp + 0x65], ax // 889c2410030000 | mov byte ptr [esp + 0x310], bl $sequence_6 = { 8b4c2410 56 50 51 e8???????? 68???????? 8d542420 } // n = 7, score = 200 // 8b4c2410 | mov ecx, dword ptr [esp + 0x10] // 56 | push esi // 50 | push eax // 51 | push ecx // e8???????? | // 68???????? | // 8d542420 | lea edx, [esp + 0x20] $sequence_7 = { 48 0d0000ffff 40 6689442408 25ffff0000 8d1440 } // n = 6, score = 200 // 48 | dec eax // 0d0000ffff | or eax, 0xffff0000 // 40 | inc eax // 6689442408 | mov word ptr [esp + 8], ax // 25ffff0000 | and eax, 0xffff // 8d1440 | lea edx, [eax + eax*2] $sequence_8 = { 50 e8???????? 83c40c 85c0 752a e8???????? } // n = 6, score = 200 // 50 | push eax // e8???????? | // 83c40c | add esp, 0xc // 85c0 | test eax, eax // 752a | jne 0x2c // e8???????? | $sequence_9 = { 8b7c240c 8b04bd10894000 8d1cbd10894000 3d00100000 0f84c8000000 8b04bd20094100 56 } // n = 7, score = 200 // 8b7c240c | mov edi, dword ptr [esp + 0xc] // 8b04bd10894000 | mov eax, dword ptr [edi*4 + 0x408910] // 8d1cbd10894000 | lea ebx, [edi*4 + 0x408910] // 3d00100000 | cmp eax, 0x1000 // 0f84c8000000 | je 0xce // 8b04bd20094100 | mov eax, dword ptr [edi*4 + 0x410920] // 56 | push esi condition: 7 of them and filesize < 188416 }
If your designated proposal does not fit in any other category, feel free to write a free-text in the comment field below.
Please propose all changes regarding references on the Malpedia library page
Your suggestion will be reviewed before being published. Thank you for contributing!
YYYY-MM-DD
YYYY-MM
YYYY