1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
| rule Bitter_Artra_AutoDownloader {
meta:
date = "2020-12-22"
strings:
$sequence_0 = { 8b442410 5f 5e 83c41c c21000 5f 33c0 }
// n = 7, score = 800
// 8b442410 | mov eax, dword ptr [esp + 0x10]
// 5f | pop edi
// 5e | pop esi
// 83c41c | add esp, 0x1c
// c21000 | ret 0x10
// 5f | pop edi
// 33c0 | xor eax, eax
$sequence_1 = { 51 8bc6 57 33c9 }
// n = 4, score = 700
// 51 | push ecx
// 8bc6 | mov eax, esi
// 57 | push edi
// 33c9 | xor ecx, ecx
$sequence_2 = { 8bc6 41 8d7801 8d9b00000000 8a10 40 }
// n = 6, score = 700
// 8bc6 | mov eax, esi
// 41 | inc ecx
// 8d7801 | lea edi, [eax + 1]
// 8d9b00000000 | lea ebx, [ebx]
// 8a10 | mov dl, byte ptr [eax]
// 40 | inc eax
$sequence_3 = { 84d2 75f9 2bc7 3bc8 72e3 8bc6 }
// n = 6, score = 700
// 84d2 | test dl, dl
// 75f9 | jne 0xfffffffb
// 2bc7 | sub eax, edi
// 3bc8 | cmp ecx, eax
// 72e3 | jb 0xffffffe5
// 8bc6 | mov eax, esi
$sequence_4 = { 57 33c9 8d7801 8da42400000000 }
// n = 4, score = 700
// 57 | push edi
// 33c9 | xor ecx, ecx
// 8d7801 | lea edi, [eax + 1]
// 8da42400000000 | lea esp, [esp]
$sequence_5 = { 72e3 8bc6 8d5001 5f 8a08 }
// n = 5, score = 700
// 72e3 | jb 0xffffffe5
// 8bc6 | mov eax, esi
// 8d5001 | lea edx, [eax + 1]
// 5f | pop edi
// 8a08 | mov cl, byte ptr [eax]
$sequence_6 = { 5f 8a08 40 84c9 75f9 2bc2 880c30 }
// n = 7, score = 700
// 5f | pop edi
// 8a08 | mov cl, byte ptr [eax]
// 40 | inc eax
// 84c9 | test cl, cl
// 75f9 | jne 0xfffffffb
// 2bc2 | sub eax, edx
// 880c30 | mov byte ptr [eax + esi], cl
$sequence_7 = { 2bc2 03fb 8a4f01 47 84c9 }
// n = 5, score = 600
// 2bc2 | sub eax, edx
// 03fb | add edi, ebx
// 8a4f01 | mov cl, byte ptr [edi + 1]
// 47 | inc edi
// 84c9 | test cl, cl
$sequence_8 = { 8bf8 85ff 0f8488000000 6a00 57 }
// n = 5, score = 600
// 8bf8 | mov edi, eax
// 85ff | test edi, edi
// 0f8488000000 | je 0x8e
// 6a00 | push 0
// 57 | push edi
$sequence_9 = { 8b2d???????? 90 8b542410 8d4c2410 51 56 52 }
// n = 7, score = 600
// 8b2d???????? |
// 90 | nop
// 8b542410 | mov edx, dword ptr [esp + 0x10]
// 8d4c2410 | lea ecx, [esp + 0x10]
// 51 | push ecx
// 56 | push esi
// 52 | push edx
$sequence_10 = { 6a00 8d442414 50 ffd7 85c0 }
// n = 5, score = 600
// 6a00 | push 0
// 8d442414 | lea eax, [esp + 0x14]
// 50 | push eax
// ffd7 | call edi
// 85c0 | test eax, eax
$sequence_11 = { 8a08 880a 40 42 84c9 75f6 e8???????? }
// n = 7, score = 600
// 8a08 | mov cl, byte ptr [eax]
// 880a | mov byte ptr [edx], cl
// 40 | inc eax
// 42 | inc edx
// 84c9 | test cl, cl
// 75f6 | jne 0xfffffff8
// e8???????? |
$sequence_12 = { 8b1d???????? 55 8b2d???????? 90 }
// n = 4, score = 600
// 8b1d???????? |
// 55 | push ebp
// 8b2d???????? |
// 90 | nop
$sequence_13 = { ffd7 85c0 7445 53 8b1d???????? }
// n = 5, score = 600
// ffd7 | call edi
// 85c0 | test eax, eax
// 7445 | je 0x47
// 53 | push ebx
// 8b1d???????? |
$sequence_14 = { 57 ff15???????? 6a6d 56 ff15???????? 8bf0 e8???????? }
// n = 7, score = 600
// 57 | push edi
// ff15???????? |
// 6a6d | push 0x6d
// 56 | push esi
// ff15???????? |
// 8bf0 | mov esi, eax
// e8???????? |
$sequence_15 = { 6a0a f3a4 6a32 8d8c24ec000000 51 52 e8???????? }
// n = 7, score = 500
// 6a0a | push 0xa
// f3a4 | rep movsb byte ptr es:[edi], byte ptr [esi]
// 6a32 | push 0x32
// 8d8c24ec000000 | lea ecx, [esp + 0xec]
// 51 | push ecx
// 52 | push edx
// e8???????? |
$sequence_16 = { 33f6 51 8945e8 8975e4 e8???????? 8975fc }
// n = 6, score = 500
// 33f6 | xor esi, esi
// 51 | push ecx
// 8945e8 | mov dword ptr [ebp - 0x18], eax
// 8975e4 | mov dword ptr [ebp - 0x1c], esi
// e8???????? |
// 8975fc | mov dword ptr [ebp - 4], esi
$sequence_17 = { 7419 3c26 7515 807c24146c 750e }
// n = 5, score = 400
// 7419 | je 0x1b
// 3c26 | cmp al, 0x26
// 7515 | jne 0x17
// 807c24146c | cmp byte ptr [esp + 0x14], 0x6c
// 750e | jne 0x10
$sequence_18 = { 8b0c8de03b4100 c1e006 8d440104 8020fe ff36 e8???????? }
// n = 6, score = 400
// 8b0c8de03b4100 | mov ecx, dword ptr [ecx*4 + 0x413be0]
// c1e006 | shl eax, 6
// 8d440104 | lea eax, [ecx + eax + 4]
// 8020fe | and byte ptr [eax], 0xfe
// ff36 | push dword ptr [esi]
// e8???????? |
$sequence_19 = { 885c2413 bf03000000 eb14 885c2414 bf02000000 eb09 885c2416 }
// n = 7, score = 400
// 885c2413 | mov byte ptr [esp + 0x13], bl
// bf03000000 | mov edi, 3
// eb14 | jmp 0x16
// 885c2414 | mov byte ptr [esp + 0x14], bl
// bf02000000 | mov edi, 2
// eb09 | jmp 0xb
// 885c2416 | mov byte ptr [esp + 0x16], bl
$sequence_20 = { ffd6 85c0 75cc 5d 5b }
// n = 5, score = 400
// ffd6 | call esi
// 85c0 | test eax, eax
// 75cc | jne 0xffffffce
// 5d | pop ebp
// 5b | pop ebx
$sequence_21 = { 59 8b7508 8d34f520104100 391e 7404 }
// n = 5, score = 400
// 59 | pop ecx
// 8b7508 | mov esi, dword ptr [ebp + 8]
// 8d34f520104100 | lea esi, [esi*8 + 0x411020]
// 391e | cmp dword ptr [esi], ebx
// 7404 | je 6
$sequence_22 = { 2bc2 8b542428 50 68???????? 6a01 6a00 }
// n = 6, score = 200
// 2bc2 | sub eax, edx
// 8b542428 | mov edx, dword ptr [esp + 0x28]
// 50 | push eax
// 68???????? |
// 6a01 | push 1
// 6a00 | push 0
condition:
7 of them and filesize < 811008
}
|
