SYMBOLCOMMON_NAMEaka. SYNONYMS
win.zloader (Back to overview)

Zloader

aka: DELoader, SILENTNIGHT, Terdot
VTCollection     URLhaus      

This family describes the (initially small) loader, which downloads Zeus OpenSSL.

In June 2016, a new loader was dubbed DEloader by Fortinet. It has some functions borrowed from Zeus 2.0.8.9 (e.g. the versioning, nrv2b, binstorage-labels), but more importantly, it downloaded a Zeus-like banking trojan (-> Zeus OpenSSL). Furthermore, the loader shared its versioning with the Zeus OpenSSL it downloaded.
The initial samples from May 2016 were small (17920 bytes). At some point, visualEncrypt/Decrypt was added, e.g. in v1.11.0.0 (September 2016) with size 27648 bytes. In January 2017 with v1.15.0.0, obfuscation was added, which blew the size up to roughly 80k, and the loader became known as Zloader aka Terdot. These changes may be related to the Moskalvzapoe Distribution Network, which started the distribution of it at the same time.

Please note that IBM X-Force decided to call win.zloader/win.zeus_openssl "Zeus Sphinx", after mentioning it as "a new version of Zeus Sphinx" in their initial post in August 2016. Malpedia thus lists the alias "Zeus XSphinx" for win.zeus_openssl - the X to refer to IBM X-Force.

References
2024-12-10 ⋅ Zscaler ⋅ ThreatLabZ research team
Inside Zloader’s Latest Trick: DNS Tunneling
GhostSocks Zloader
2024-12-04 ⋅ Rapid7 ⋅ Tyler McGraw
Black Basta Ransomware Campaign Drops Zbot, DarkGate, and Custom Malware
Black Basta Cobalt Strike DarkGate SystemBC Zloader
2024-07-29 ⋅ Mandiant ⋅ Ashley Pearson, Jake Nicastro, Joseph Pisano, Josh Murchie, Joshua Shilko, Raymond Leong
UNC4393 Goes Gently into the SILENTNIGHT
Black Basta QakBot sRDI SystemBC Zloader UNC3973 UNC4393
2024-04-29 ⋅ Zscaler ⋅ Santiago Vicente
Zloader Learns Old Tricks
Zloader
2024-02-14 ⋅ K7 Security ⋅ Sudeep Waingankar
Zloader Strikes Back
Zloader
2024-01-19 ⋅ Zscaler ⋅ Ismael Garcia Perez, Santiago Vicente
Zloader: No Longer Silent in the Night
Zloader
2023-07-29 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
Unknown powershell backdoor with ties to new Zloader
Zloader
2023-03-30 ⋅ United States District Court (Eastern District of New York) ⋅ Fortra, HEALTH-ISAC, Microsoft
Cracked Cobalt Strike (1:23-cv-02447)
Black Basta BlackCat LockBit RagnarLocker LockBit Black Basta BlackCat Cobalt Strike Cuba Emotet LockBit Mount Locker PLAY QakBot RagnarLocker Royal Ransom Zloader
2023-02-27 ⋅ PRODAFT Threat Intelligence ⋅ PRODAFT
RIG Exploit Kit: In-Depth Analysis
Dridex IcedID ISFB PureCrypter Raccoon RecordBreaker RedLine Stealer Royal Ransom Silence SmokeLoader Zloader
2022-08-10 ⋅ Avast Decoded ⋅ Threat Research Team
Avast Q2/2022 Threat Report: Farewell to Conti, Zloader, and Maldocs; Hello Resurrection of Raccoon Stealer, and more Ransomware Attacks
Conti Raccoon RecordBreaker Zloader Caramel Tsunami
2022-08-08 ⋅ Medium CSIS Techblog ⋅ Benoît Ancel
An inside view of domain anonymization as-a-service — the BraZZZerSFF infrastructure
Riltok magecart Anubis Azorult BetaBot Buer CoalaBot CryptBot DiamondFox DreamBot GCleaner ISFB Loki Password Stealer (PWS) MedusaLocker MeguminTrojan Nemty PsiX RedLine Stealer SmokeLoader STOP TinyNuke Vidar Zloader
2022-06-24 ⋅ Palo Alto Networks Unit 42 ⋅ Mark Lim, Riley Porter
There Is More Than One Way to Sleep: Dive Deep Into the Implementations of API Hammering by Various Malware Families
BazarBackdoor Zloader
2022-06-02 ⋅ Youtube (AhmedS Kasmani) ⋅ AhmedS Kasmani
Zloader Malware Analysis - 1. Unpacking First stage.
Zloader
2022-04-25 ⋅ VinCSS ⋅ m4n0w4r, Tran Trung Kien
[RE026] A Deep Dive into Zloader - the Silent Night
Zloader
2022-04-25 ⋅ Cybereason ⋅ Aleksandar Milenkoski, Loïc Castel, Yonatan Gidnian
THREAT ANALYSIS REPORT: SocGholish and Zloader – From Fake Updates and Installers to Owning Your Systems
FAKEUPDATES Zloader
2022-04-20 ⋅ CISA ⋅ CISA
Alert (AA22-110A): Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader Killnet
2022-04-20 ⋅ CISA ⋅ Australian Cyber Security Centre (ACSC), Canadian Centre for Cyber Security (CCCS), CISA, FBI, Government Communications Security Bureau, National Crime Agency (NCA), NCSC UK, NSA
AA22-110A Joint CSA: Russian State-Sponsored and Criminal Cyber Threats to Critical Infrastructure
VPNFilter BlackEnergy DanaBot DoppelDridex Emotet EternalPetya GoldMax Industroyer Sality SmokeLoader TrickBot Triton Zloader
2022-04-14 ⋅ Avast Decoded ⋅ Vladimir Martyanov
Zloader 2: The Silent Night
ISFB Raccoon Zloader
2022-04-13 ⋅ UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA ⋅ UNITED STATES DISTRICT COURT FOR THE NORTHERN DISTRICT OF GEORGIA
Court order for taking down Zloader Infrastructure
Zloader
2022-04-13 ⋅ Microsoft ⋅ Amy Hogan-Burney
Notorious cybercrime gang’s botnet disrupted
Ryuk Zloader
2022-04-13 ⋅ Microsoft ⋅ Microsoft 365 Defender Threat Intelligence Team
Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware
BlackMatter Cobalt Strike DarkSide Ryuk Zloader
2022-04-13 ⋅ ESET Research ⋅ Jean-Ian Boutin, Tomáš Procházka
ESET takes part in global operation to disrupt Zloader botnets
Cobalt Strike Zloader
2022-03-14 ⋅ CrowdStrike ⋅ Falcon OverWatch Team
Falcon OverWatch Threat Hunting Uncovers Ongoing NIGHT SPIDER Zloader Campaign
Zloader
2022-01-19 ⋅ Sophos ⋅ Colin Cowie, Mat Gangwer, Sophos MTR Team, Stan Andic
Zloader Installs Remote Access Backdoors and Delivers Cobalt Strike
Cobalt Strike Zloader
2022-01-11 ⋅ Medium walmartglobaltech ⋅ Jason Reaves, Joshua Platt
Signed DLL campaigns as a service
BATLOADER Cobalt Strike ISFB Zloader
2022-01-05 ⋅ Check Point ⋅ Golan Cohen
Can You Trust a File’s Digital Signature? New Zloader Campaign exploits Microsoft’s Signature Verification putting users at risk
Zloader
2021-11-03 ⋅ Team Cymru ⋅ tcblogposts
Webinject Panel Administration: A Vantage Point into Multiple Threat Actor Campaigns - A Case Study on the Value of Threat Reconnaisance
DoppelDridex IcedID QakBot Zloader
2021-10-19 ⋅ Cisco ⋅ Artsiom Holub
STRRAT, ZLoader, and HoneyGain
STRRAT Zloader
2021-10-18 ⋅ Ali Aqeel
ZLoader Reversing
Zloader
2021-09-29 ⋅ Trend Micro ⋅ Trend Micro
Zloader Campaigns at a Glance
Zloader
2021-09-29 ⋅ Trend Micro ⋅ Trend Micro
Zloader Campaigns at a Glance (IOCs)
Zloader
2021-09-13 ⋅ SentinelOne ⋅ Antonio Cocomazzi, Antonio Pirozzi
Hide and Seek | New Zloader Infection Chain Comes With Improved Stealth and Evasion Mechanisms
Zloader
2021-09-03 ⋅ Trend Micro ⋅ Mohamad Mokbel
The State of SSL/TLS Certificate Usage in Malware C&C Communications
AdWind ostap AsyncRAT BazarBackdoor BitRAT Buer Chthonic CloudEyE Cobalt Strike DCRat Dridex FindPOS GootKit Gozi IcedID ISFB Nanocore RAT Orcus RAT PandaBanker Qadars QakBot Quasar RAT Rockloader ServHelper Shifu SManager TorrentLocker TrickBot Vawtrak Zeus Zloader
2021-07-08 ⋅ McAfee ⋅ Kiran Raj, Kishan N.
Zloader With a New Infection Technique
Zloader
2021-06-23 ⋅ K7 Security ⋅ Lokesh J
Java Plug-Ins Delivering Zloader
Zloader
2021-05-26 ⋅ DeepInstinct ⋅ Ron Ben Yizhak
A Deep Dive into Packing Software CryptOne
Cobalt Strike Dridex Emotet Gozi ISFB Mailto QakBot SmokeLoader WastedLocker Zloader
2021-05-14 ⋅ GuidePoint Security ⋅ Drew Schmitt
From ZLoader to DarkSide: A Ransomware Story
DarkSide Cobalt Strike Zloader
2021-05-11 ⋅ Mal-Eats ⋅ mal_eats
Campo, a New Attack Campaign Targeting Japan
AnchorDNS BazarBackdoor campoloader Cobalt Strike Phobos Snifula TrickBot Zloader
2021-05-10 ⋅ Mal-Eats ⋅ mal_eats
Overview of Campo, a new attack campaign targeting Japan
AnchorDNS BazarBackdoor Cobalt Strike ISFB Phobos TrickBot Zloader
2021-04-21 ⋅ PhishLabs ⋅ Jessica Ellis
ZLoader Dominates Email Payloads in Q1
Zloader
2021-04-19 ⋅ Cybleinc ⋅ cybleinc
ZLoader Returns Through Spelevo Exploit Kit & Phishing Campaign
Zloader
2021-04-12 ⋅ PTSecurity ⋅ PTSecurity
PaaS, or how hackers evade antivirus software
Amadey Bunitu Cerber Dridex ISFB KPOT Stealer Mailto Nemty Phobos Pony Predator The Thief QakBot Raccoon RTM SmokeLoader Zloader
2021-03-29 ⋅ Hornetsecurity ⋅ Hornetsecurity Security Lab
Zloader email campaign using MHTML to download and decrypt XLS
Zloader
2021-03-23 ⋅ Quick Heal ⋅ Anjali Raut
Zloader: Entailing Different Office Files
Zloader
2021-03-17 ⋅ HP ⋅ HP Bromium
Threat Insights Report Q4-2020
Agent Tesla BitRAT ComodoSec Dridex Emotet Ficker Stealer Formbook Zloader
2021-03-10 ⋅ ⋅ NTT Security ⋅ Hiroki Hada
日本を標的としたPseudoGateキャンペーンによるSpelevo Exploit Kitを用いた攻撃について
Zloader
2021-03-05 ⋅ Forcepoint ⋅ Kurt Natvig, Robert Neumann
Advancements in Invoicing - A highly sophisticated way to distribute ZLoader
Zloader
2021-03-01 ⋅ Group-IB ⋅ Oleg Skulkin, Roman Rezvukhin, Semyon Rogachev
Ransomware Uncovered 2020/2021
RansomEXX BazarBackdoor Buer Clop Conti DoppelPaymer Dridex Egregor IcedID Maze PwndLocker QakBot RansomEXX REvil Ryuk SDBbot TrickBot Zloader
2021-02-23 ⋅ PhishLabs ⋅ Jessica Ellis
Surge in ZLoader Attacks Observed
Zloader
2021-02-23 ⋅ CrowdStrike ⋅ CrowdStrike
2021 Global Threat Report
RansomEXX Amadey Anchor Avaddon BazarBackdoor Clop Cobalt Strike Conti Cutwail DanaBot DarkSide DoppelPaymer Dridex Egregor Emotet Hakbit IcedID JSOutProx KerrDown LockBit Mailto Maze MedusaLocker Mespinoza Mount Locker NedDnLoader Nemty Pay2Key PlugX Pushdo PwndLocker PyXie QakBot Quasar RAT RagnarLocker Ragnarok RansomEXX REvil Ryuk Sekhmet ShadowPad SmokeLoader Snake SUNBURST SunCrypt TEARDROP TrickBot WastedLocker Winnti Zloader Evilnum OUTLAW SPIDER RIDDLE SPIDER SOLAR SPIDER VIKING SPIDER
2021-02-02 ⋅ ⋅ CRONUP ⋅ Germán Fernández
De ataque con Malware a incidente de Ransomware
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DanaBot Dharma Dridex Egregor Emotet Empire Downloader FriedEx GootKit IcedID MegaCortex Nemty Phorpiex PwndLocker PyXie QakBot RansomEXX REvil Ryuk SDBbot SmokeLoader TrickBot Zloader
2020-12-23 ⋅ 0xC0DECAFE ⋅ Thomas Barabosch
Detect RC4 in (malicious) binaries
SmokeLoader Zloader
2020-12-21 ⋅ Cisco Talos ⋅ JON MUNSHAW
2020: The year in malware
WolfRAT Prometei Poet RAT Agent Tesla Astaroth Ave Maria CRAT Emotet Gozi IndigoDrop JhoneRAT Nanocore RAT NjRAT Oblique RAT SmokeLoader StrongPity WastedLocker Zloader
2020-11-20 ⋅ ZDNet ⋅ Catalin Cimpanu
The malware that usually installs ransomware and you need to remove right away
Avaddon BazarBackdoor Buer Clop Cobalt Strike Conti DoppelPaymer Dridex Egregor Emotet FriedEx MegaCortex Phorpiex PwndLocker QakBot Ryuk SDBbot TrickBot Zloader
2020-11-18 ⋅ Sophos ⋅ Sophos
SOPHOS 2021 THREAT REPORT Navigating cybersecurity in an uncertain world
Agent Tesla Dridex TrickBot Zloader
2020-11-16 ⋅ Malwarebytes ⋅ Threat Intelligence Team
Malsmoke operators abandon exploit kits in favor of social engineering scheme
Zloader
2020-11-09 ⋅ Bleeping Computer ⋅ Ionut Ilascu
Fake Microsoft Teams updates lead to Cobalt Strike deployment
Cobalt Strike DoppelPaymer NjRAT Predator The Thief Zloader
2020-11-06 ⋅ ⋅ LAC WATCH ⋅ Ishikawa, Matsumoto, Takagen
分析レポート：Emotetの裏で動くバンキングマルウェア「Zloader」に注意
Emotet Zloader
2020-11-05 ⋅ Twitter (@ffforward) ⋅ TheAnalyst
Tweet on Zloader infection leads to Cobaltstrike Installation and deployment of RYUK
Cobalt Strike Ryuk Zloader
2020-10-28 ⋅ SophosLabs Uncut ⋅ Anand Ajjan, Bill Kearny, Brett Cove, Elida Leite, Gabor Szappanos, Peter Mackenzie, Sean Gallagher, Syed Shahram
Hacks for sale: inside the Buer Loader malware-as-a-service
Buer Ryuk Zloader
2020-10-21 ⋅ ⋅ Alyac ⋅ Alyac
ZLoader 악성코드, 사업 정지 경고로 위장해 유포중
Zloader
2020-10-07 ⋅ CrowdStrike ⋅ The Falcon Complete Team
Duck Hunting with Falcon Complete: Analyzing a Fowl Banking Trojan, Part 2
QakBot Zloader
2020-09-24 ⋅ Click All the Things! Blog ⋅ Jamie Arndt
zLoader XLM Update: Macro code and behavior change
Zloader
2020-09-02 ⋅ Cisco Talos ⋅ Edmund Brumaghin, Holger Unterbrink
Salfram: Robbing the place without removing your name tag
Ave Maria ISFB SmokeLoader Zloader
2020-08-19 ⋅ SecurityLiterate ⋅ Kyle Cucci
Chantay’s Resume: Investigating a CV-Themed ZLoader Malware
Zloader
2020-08-14 ⋅ Twitter (@VK_intel) ⋅ Vitali Kremez
Tweet on Zloader infection leading to Cobaltstrike Installation
Cobalt Strike Zloader
2020-07-30 ⋅ Spamhaus ⋅ Spamhaus Malware Labs
Spamhaus Botnet Threat Update Q2 2020
AdWind Agent Tesla Arkei Stealer AsyncRAT Ave Maria Azorult DanaBot Emotet IcedID ISFB KPOT Stealer Loki Password Stealer (PWS) Nanocore RAT NetWire RC NjRAT Pony Raccoon RedLine Stealer Remcos Zloader
2020-07-22 ⋅ SentinelOne ⋅ Jason Reaves, Joshua Platt
Enter the Maze: Demystifying an Affiliate Involved in Maze (SNOW)
ISFB Maze TrickBot Zloader
2020-06-24 ⋅ Morphisec ⋅ Arnold Osipov
Obfuscated VBScript Drops Zloader, Ursnif, Qakbot, Dridex
Dridex ISFB QakBot Zloader
2020-06-19 ⋅ Click All the Things! Blog ⋅ Jamie
zloader: VBA, R1C1 References, and Other Tomfoolery
Zloader
2020-06-19 ⋅ Yet Another Security Blog ⋅ Michael Weber
Further Evasion in the Forgotten Corners of MS-XLS
Zloader
2020-06-11 ⋅ Nullteilerfrei Blog ⋅ Lars Wallenborn
API Hashing in the Zloader malware
Zloader
2020-06-02 ⋅ Lastline Labs ⋅ James Haughom, Stefano Ortolani
Evolution of Excel 4.0 Macro Weaponization
Agent Tesla DanaBot ISFB TrickBot Zloader
2020-05-24 ⋅ Nullteilerfrei Blog ⋅ Lars Wallenborn
Zloader String Obfuscation
Zloader
2020-05-21 ⋅ Malwarebytes ⋅ hasherezade, prsecurity
The “Silent Night” Zloader/Zbot
Zloader
2020-05-20 ⋅ Proofpoint ⋅ Dennis Schwarz, Matthew Mesa, Proofpoint Threat Research Team
ZLoader Loads Again: New ZLoader Variant Returns
Zloader
2020-05-12 ⋅ Yet Another Security Blog ⋅ Michael Weber
Evading Detection with Excel 4.0 Macros and the BIFF8 XLS Format
Zloader
2020-04-26 ⋅ Johannes Bader's Blog ⋅ Johannes Bader
The DGA of Zloader
Zloader
2020-04-07 ⋅ Youtube (DissectMalware) ⋅ Malwrologist
Malware Analysis in Action - Episode 2
Zloader
2020-03-30 ⋅ Bleeping Computer ⋅ Sergiu Gatlan
Banking Malware Spreading via COVID-19 Relief Payment Phishing
Zloader
2020-03-30 ⋅ IBM ⋅ Amir Gandler, Limor Kessem
Zeus Sphinx Trojan Awakens Amidst Coronavirus Spam Frenzy
Zeus OpenSSL Zloader
2020-03-13 ⋅ Comae ⋅ Matt Suiche
Yet Another Active Email Campaign With Malicious Excel Files Identified
Zloader
2018-09-06 ⋅ int 0xcc blog ⋅ Raashid Bhat
Dissecting DEloader malware with obfuscation
Zloader
2017-06-15 ⋅ Limor Kessem
Zeus Sphinx Pushes Empty Configuration Files — What Has the Sphinx Got Cooking?
Zloader
2017-01-26 ⋅ SecurityIntelligence ⋅ Limor Kessem
Around the World With Zeus Sphinx: From Canada to Australia and Back
Zloader
2017-01-26 ⋅ Malwarebytes ⋅ Malwarebytes Labs
Zbot with legitimate applications on board
Zloader
2016-09-22 ⋅ Forcepoint ⋅ Nicholas Griffin
Zeus Delivered by DELoader to Defraud Customers of Canadian Banks
Zloader
2016-06-21 ⋅ Fortinet ⋅ Floser Bacurio, Roland Dela Paz
The Curious Case of an Unknown Trojan Targeting German-Speaking Users
Zloader
Yara Rules
[TLP:WHITE] win_zloader_auto (20241030 | Detects win.zloader.)
rule win_zloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2024-10-31"
        version = "1"
        description = "Detects win.zloader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.zloader"
        malpedia_rule_date = "20241030"
        malpedia_hash = "26e26953c49c8efafbf72a38076855d578e0a2e4"
        malpedia_version = "20241030"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0fb7c0 57 50 53 e8???????? 83c40c }
            // n = 6, score = 2000
            //   0fb7c0               | xor                 ebx, ebx
            //   57                   | mov                 eax, ebx
            //   50                   | add                 esp, 0xc
            //   53                   | pop                 esi
            //   e8????????           |                     
            //   83c40c               | pop                 ebx

        $sequence_1 = { 6aff ff7514 e8???????? 83c40c 84c0 7424 }
            // n = 6, score = 2000
            //   6aff                 | pop                 esi
            //   ff7514               | pop                 edi
            //   e8????????           |                     
            //   83c40c               | je                  0x22
            //   84c0                 | test                al, al
            //   7424                 | je                  0x19

        $sequence_2 = { 0fb7450c 8d9df0feffff 53 50 ff7508 e8???????? 83c40c }
            // n = 7, score = 2000
            //   0fb7450c             | movzx               eax, ax
            //   8d9df0feffff         | push                edi
            //   53                   | push                eax
            //   50                   | push                ebx
            //   ff7508               | add                 esp, 0xc
            //   e8????????           |                     
            //   83c40c               | movzx               eax, word ptr [ebp + 0xc]

        $sequence_3 = { 31db 89d8 83c40c 5e 5b }
            // n = 5, score = 2000
            //   31db                 | mov                 eax, ebx
            //   89d8                 | add                 esp, 0x104
            //   83c40c               | xor                 ebx, ebx
            //   5e                   | lea                 ecx, [ebp - 0x110]
            //   5b                   | mov                 eax, ebx

        $sequence_4 = { 6a00 e8???????? 83c408 ff75f0 }
            // n = 4, score = 2000
            //   6a00                 | push                dword ptr [ebp + 0x14]
            //   e8????????           |                     
            //   83c408               | add                 esp, 0xc
            //   ff75f0               | test                al, al

        $sequence_5 = { 7420 e8???????? 84c0 7417 e8???????? }
            // n = 5, score = 2000
            //   7420                 | lea                 ecx, [ebp - 0x110]
            //   e8????????           |                     
            //   84c0                 | mov                 eax, ebx
            //   7417                 | add                 esp, 0x104
            //   e8????????           |                     

        $sequence_6 = { 31db 8d8df0feffff e8???????? 89d8 81c404010000 }
            // n = 5, score = 2000
            //   31db                 | mov                 dword ptr [esp], esi
            //   8d8df0feffff         | mov                 edi, ecx
            //   e8????????           |                     
            //   89d8                 | lea                 eax, [esi + esi*2]
            //   81c404010000         | mov                 dword ptr [ebp - 0x14], eax

        $sequence_7 = { 50 ff7508 53 e8???????? 83c40c 66c7047b0000 }
            // n = 6, score = 2000
            //   50                   | push                eax
            //   ff7508               | push                dword ptr [ebp + 8]
            //   53                   | add                 esp, 0xc
            //   e8????????           |                     
            //   83c40c               | push                ebx
            //   66c7047b0000         | push                edi

        $sequence_8 = { 56 50 a1???????? 89c1 }
            // n = 4, score = 1300
            //   56                   | push                eax
            //   50                   | mov                 eax, dword ptr [ebp + 8]
            //   a1????????           |                     
            //   89c1                 | mov                 ecx, dword ptr [ebp + 0xc]

        $sequence_9 = { e8???????? 89c1 89f0 99 f7f9 }
            // n = 5, score = 1100
            //   e8????????           |                     
            //   89c1                 | mov                 ecx, eax
            //   89f0                 | mov                 eax, esi
            //   99                   | cdq                 
            //   f7f9                 | idiv                ecx

        $sequence_10 = { e8???????? eb00 eb00 eb00 eb00 eb00 eb00 }
            // n = 7, score = 800
            //   e8????????           |                     
            //   eb00                 | jmp                 2
            //   eb00                 | jmp                 2
            //   eb00                 | jmp                 2
            //   eb00                 | jmp                 2
            //   eb00                 | jmp                 2
            //   eb00                 | jmp                 2

        $sequence_11 = { e8???????? 83f800 0f94c0 2401 }
            // n = 4, score = 800
            //   e8????????           |                     
            //   83f800               | cmp                 eax, 0
            //   0f94c0               | sete                al
            //   2401                 | and                 al, 1

        $sequence_12 = { e8???????? a801 7502 eb0f }
            // n = 4, score = 800
            //   e8????????           |                     
            //   a801                 | test                al, 1
            //   7502                 | jne                 4
            //   eb0f                 | jmp                 0x11

        $sequence_13 = { e8???????? 0fb700 3d64860000 0f94c0 2401 }
            // n = 5, score = 800
            //   e8????????           |                     
            //   0fb700               | movzx               eax, word ptr [eax]
            //   3d64860000           | cmp                 eax, 0x8664
            //   0f94c0               | sete                al
            //   2401                 | and                 al, 1

        $sequence_14 = { e8???????? ffd0 488905???????? b001 2401 0fb6c0 }
            // n = 6, score = 800
            //   e8????????           |                     
            //   ffd0                 | call                eax
            //   488905????????       |                     
            //   b001                 | mov                 al, 1
            //   2401                 | and                 al, 1
            //   0fb6c0               | movzx               eax, al

        $sequence_15 = { e8???????? 88c1 31c0 f6c101 }
            // n = 4, score = 800
            //   e8????????           |                     
            //   88c1                 | mov                 cl, al
            //   31c0                 | xor                 eax, eax
            //   f6c101               | test                cl, 1

        $sequence_16 = { 41b802000000 e8???????? a801 7505 e9???????? }
            // n = 5, score = 800
            //   41b802000000         | push                eax
            //   e8????????           |                     
            //   a801                 | inc                 ecx
            //   7505                 | mov                 eax, 2
            //   e9????????           |                     

        $sequence_17 = { e8???????? 59 84c0 7432 68???????? }
            // n = 5, score = 700
            //   e8????????           |                     
            //   59                   | push                dword ptr [esp + 8]
            //   84c0                 | pop                 ecx
            //   7432                 | test                al, al
            //   68????????           |                     

        $sequence_18 = { 84c0 7432 68???????? ff742408 e8???????? 59 }
            // n = 6, score = 700
            //   84c0                 | cmp                 eax, -1
            //   7432                 | test                al, al
            //   68????????           |                     
            //   ff742408             | je                  0x34
            //   e8????????           |                     
            //   59                   | push                dword ptr [esp + 8]

        $sequence_19 = { 8bc3 5b c3 8b44240c 83f8ff 750a }
            // n = 6, score = 700
            //   8bc3                 | movzx               eax, al
            //   5b                   | mov                 eax, ebx
            //   c3                   | pop                 ebx
            //   8b44240c             | ret                 
            //   83f8ff               | mov                 eax, dword ptr [esp + 0xc]
            //   750a                 | cmp                 eax, -1

        $sequence_20 = { 57 56 50 8b4510 31db }
            // n = 5, score = 700
            //   57                   | mov                 edx, dword ptr [ebp + 0x10]
            //   56                   | lea                 esi, [ebp + 0x14]
            //   50                   | push                esi
            //   8b4510               | push                eax
            //   31db                 | mov                 ecx, eax

        $sequence_21 = { 89542444 e8???????? 03c0 6689442438 8b442438 }
            // n = 5, score = 600
            //   89542444             | push                eax
            //   e8????????           |                     
            //   03c0                 | mov                 dword ptr [esp + 0x44], edx
            //   6689442438           | add                 eax, eax
            //   8b442438             | mov                 word ptr [esp + 0x38], ax

        $sequence_22 = { 6aff 50 e8???????? 8d857cffffff 50 }
            // n = 5, score = 600
            //   6aff                 | mov                 word ptr [esp + 0x38], ax
            //   50                   | push                -1
            //   e8????????           |                     
            //   8d857cffffff         | push                eax
            //   50                   | lea                 eax, [ebp - 0x84]

        $sequence_23 = { 50 56 56 56 ff7514 }
            // n = 5, score = 600
            //   50                   | cmp                 edi, -1
            //   56                   | push                eax
            //   56                   | push                esi
            //   56                   | push                esi
            //   ff7514               | push                esi

        $sequence_24 = { 5f c6043000 5e c3 56 57 8b7c2414 }
            // n = 7, score = 600
            //   5f                   | add                 esp, 0x24
            //   c6043000             | pop                 edi
            //   5e                   | mov                 byte ptr [eax + esi], 0
            //   c3                   | pop                 esi
            //   56                   | ret                 
            //   57                   | push                esi
            //   8b7c2414             | push                edi

        $sequence_25 = { 6689442438 8b442438 83c002 668944243a }
            // n = 4, score = 600
            //   6689442438           | add                 eax, 2
            //   8b442438             | mov                 word ptr [esp + 0x38], ax
            //   83c002               | mov                 eax, dword ptr [esp + 0x38]
            //   668944243a           | add                 eax, 2

        $sequence_26 = { e8???????? 83c414 c3 56 ff742410 }
            // n = 5, score = 600
            //   e8????????           |                     
            //   83c414               | mov                 word ptr [esp + 0x3a], ax
            //   c3                   | add                 esp, 0x14
            //   56                   | ret                 
            //   ff742410             | push                esi

        $sequence_27 = { 50 8d44243c 99 52 50 }
            // n = 5, score = 600
            //   50                   | push                dword ptr [esp + 8]
            //   8d44243c             | push                eax
            //   99                   | lea                 eax, [esp + 0x3c]
            //   52                   | cdq                 
            //   50                   | push                edx

        $sequence_28 = { 83c410 84c0 741f 8b45c8 3b4604 7617 }
            // n = 6, score = 500
            //   83c410               | push                dword ptr [esp + 0x10]
            //   84c0                 | add                 esp, 0x10
            //   741f                 | test                al, al
            //   8b45c8               | je                  0x21
            //   3b4604               | mov                 eax, dword ptr [ebp - 0x38]
            //   7617                 | cmp                 eax, dword ptr [esi + 4]

        $sequence_29 = { 81c614010000 8dbd78feffff f3a5 8d8578feffff 50 ff75fc 66a5 }
            // n = 7, score = 500
            //   81c614010000         | jbe                 0x19
            //   8dbd78feffff         | add                 esi, 0x114
            //   f3a5                 | lea                 edi, [ebp - 0x188]
            //   8d8578feffff         | rep movsd           dword ptr es:[edi], dword ptr [esi]
            //   50                   | lea                 eax, [ebp - 0x188]
            //   ff75fc               | push                eax
            //   66a5                 | push                dword ptr [ebp - 4]

        $sequence_30 = { 89e5 53 57 56 81eca8020000 }
            // n = 5, score = 500
            //   89e5                 | add                 esp, 0x2a8
            //   53                   | pop                 esi
            //   57                   | pop                 edi
            //   56                   | pop                 ebx
            //   81eca8020000         | mov                 ebp, esp

        $sequence_31 = { c7460488130000 c7462401000000 c7462800004001 e8???????? }
            // n = 4, score = 500
            //   c7460488130000       | mov                 edx, dword ptr [esp + 4]
            //   c7462401000000       | mov                 dword ptr [esi + 4], 0x1388
            //   c7462800004001       | mov                 dword ptr [esi + 0x24], 1
            //   e8????????           |                     

        $sequence_32 = { 57 56 83ec18 89d6 89cf }
            // n = 5, score = 400
            //   57                   | push                ebx
            //   56                   | push                edi
            //   83ec18               | push                esi
            //   89d6                 | sub                 esp, 0x2a8
            //   89cf                 | push                edi

        $sequence_33 = { 890424 c74424041c010000 e8???????? c74424101c010000 893424 }
            // n = 5, score = 400
            //   890424               | mov                 dword ptr [esp], eax
            //   c74424041c010000     | mov                 dword ptr [ebp - 0x14], eax
            //   e8????????           |                     
            //   c74424101c010000     | mov                 dword ptr [esp], eax
            //   893424               | mov                 dword ptr [ebp - 0x10], eax

        $sequence_34 = { 8d742410 89b42430010000 8b842430010000 8b842430010000 890424 }
            // n = 5, score = 400
            //   8d742410             | ret                 
            //   89b42430010000       | push                ecx
            //   8b842430010000       | mov                 eax, dword ptr fs:[0x30]
            //   8b842430010000       | mov                 dword ptr [esp], eax
            //   890424               | lea                 esi, [esp + 0x10]

        $sequence_35 = { 8945ec 890424 e8???????? 8945f0 }
            // n = 4, score = 400
            //   8945ec               | mov                 dword ptr [esp + 0x130], esi
            //   890424               | mov                 eax, dword ptr [esp + 0x130]
            //   e8????????           |                     
            //   8945f0               | mov                 eax, dword ptr [esp + 0x130]

        $sequence_36 = { 57 50 e8???????? 68???????? 56 e8???????? }
            // n = 6, score = 300
            //   57                   | push                eax
            //   50                   | push                edi
            //   e8????????           |                     
            //   68????????           |                     
            //   56                   | push                eax
            //   e8????????           |                     

        $sequence_37 = { 56 57 ff750c 33db 68???????? 6880000000 }
            // n = 6, score = 300
            //   56                   | je                  0x34
            //   57                   | push                esi
            //   ff750c               | push                edi
            //   33db                 | push                dword ptr [ebp + 0xc]
            //   68????????           |                     
            //   6880000000           | xor                 ebx, ebx

        $sequence_38 = { c3 8bc2 ebf7 8d442410 50 ff742410 }
            // n = 6, score = 300
            //   c3                   | mov                 ebx, dword ptr [esp + 0xc]
            //   8bc2                 | ret                 
            //   ebf7                 | mov                 eax, edx
            //   8d442410             | jmp                 0xfffffff9
            //   50                   | lea                 eax, [esp + 0x10]
            //   ff742410             | push                eax

        $sequence_39 = { 33db 68???????? 6880000000 50 e8???????? 83c410 8d4580 }
            // n = 7, score = 300
            //   33db                 | xor                 ebx, ebx
            //   68????????           |                     
            //   6880000000           | xor                 ebx, ebx
            //   50                   | push                0x80
            //   e8????????           |                     
            //   83c410               | push                eax
            //   8d4580               | add                 esp, 0x10

        $sequence_40 = { 68???????? ff742410 e8???????? 6823af2930 56 ff742410 }
            // n = 6, score = 300
            //   68????????           |                     
            //   ff742410             | push                0x80
            //   e8????????           |                     
            //   6823af2930           | push                dword ptr [esp + 0x10]
            //   56                   | push                0x3029af23
            //   ff742410             | push                esi

        $sequence_41 = { e8???????? ff7508 8d85f0fdffff 68???????? 6804010000 }
            // n = 5, score = 300
            //   e8????????           |                     
            //   ff7508               | push                dword ptr [esp + 0x10]
            //   8d85f0fdffff         | push                dword ptr [ebp + 8]
            //   68????????           |                     
            //   6804010000           | lea                 eax, [ebp - 0x210]

        $sequence_42 = { e8???????? 83c40c 5e 8bc3 5b c3 8b4c2404 }
            // n = 7, score = 300
            //   e8????????           |                     
            //   83c40c               | push                dword ptr [esp + 0x10]
            //   5e                   | add                 esp, 0xc
            //   8bc3                 | pop                 esi
            //   5b                   | mov                 eax, ebx
            //   c3                   | pop                 ebx
            //   8b4c2404             | ret                 

        $sequence_43 = { c3 56 8b742408 6804010000 68???????? }
            // n = 5, score = 300
            //   c3                   | push                eax
            //   56                   | ret                 
            //   8b742408             | push                esi
            //   6804010000           | mov                 esi, dword ptr [esp + 8]
            //   68????????           |                     

        $sequence_44 = { c3 8bc2 ebf8 53 8b5c240c }
            // n = 5, score = 300
            //   c3                   | pop                 ecx
            //   8bc2                 | ret                 
            //   ebf8                 | mov                 eax, edx
            //   53                   | jmp                 0xfffffffa
            //   8b5c240c             | push                ebx

        $sequence_45 = { 50 6a72 e8???????? 59 59 }
            // n = 5, score = 300
            //   50                   | mov                 edx, dword ptr [esp + 4]
            //   6a72                 | push                eax
            //   e8????????           |                     
            //   59                   | push                0x72
            //   59                   | pop                 ecx

        $sequence_46 = { 894c2424 890b 56 8944241c }
            // n = 4, score = 200
            //   894c2424             | cmp                 word ptr [ebx], bp
            //   890b                 | mov                 dword ptr [esp + 0x24], ecx
            //   56                   | mov                 dword ptr [ebx], ecx
            //   8944241c             | push                esi

    condition:
        7 of them and filesize < 5360640
}
Download all Yara Rules