{"group":"clop","count":1,"rules":[{"rule_name":"clop.yar","rule_text":"rule win_clop_auto {\n\n meta:\n author = \"Felix Bilstein - yara-signator at cocacoding dot com\"\n date = \"2023-07-11\"\n version = \"1\"\n description = \"Detects win.clop.\"\n info = \"autogenerated rule brought to you by yara-signator\"\n tool = \"yara-signator v0.6.0\"\n signator_config = \"callsandjumps;datarefs;binvalue\"\n malpedia_reference = \"https://malpedia.caad.fkie.fraunhofer.de/details/win.clop\"\n malpedia_rule_date = \"20230705\"\n malpedia_hash = \"42d0574f4405bd7d2b154d321d345acb18834a41\"\n malpedia_version = \"20230715\"\n malpedia_license = \"CC BY-SA 4.0\"\n malpedia_sharing = \"TLP:WHITE\"\n\n /* DISCLAIMER\n * The strings used in this rule have been automatically selected from the\n * disassembly of memory dumps and unpacked files, using YARA-Signator.\n * The code and documentation is published here:\n * https://github.com/fxb-cocacoding/yara-signator\n * As Malpedia is used as data source, please note that for a given\n * number of families, only single samples are documented.\n * This likely impacts the degree of generalization these rules will offer.\n * Take the described generation method also into consideration when you\n * apply the rules in your use cases and assign them confidence levels.\n */\n\n\n strings:\n $sequence_0 = { 6a04 6800300000 6887000000 6a00 }\n // n = 4, score = 900\n // 6a04 | push 4\n // 6800300000 | push 0x3000\n // 6887000000 | push 0x87\n // 6a00 | push 0\n\n $sequence_1 = { 83c40c 6860070000 6a40 ff15???????? }\n // n = 4, score = 900\n // 83c40c | add esp, 0xc\n // 6860070000 | push 0x760\n // 6a40 | push 0x40\n // ff15???????? | \n\n $sequence_2 = { 56 53 ff15???????? 50 ff15???????? 56 53 }\n // n = 7, score = 800\n // 56 | push esi\n // 53 | push ebx\n // ff15???????? | \n // 50 | push eax\n // ff15???????? | \n // 56 | push esi\n // 53 | push ebx\n\n $sequence_3 = { ff15???????? 56 53 8bf8 ff15???????? 8bf0 56 }\n // n = 7, score = 800\n // ff15???????? | \n // 56 | push esi\n // 53 | push ebx\n // 8bf8 | mov edi, eax\n // ff15???????? | \n // 8bf0 | mov esi, eax\n // 56 | push esi\n\n $sequence_4 = { 6a00 ff15???????? 68???????? 8bd8 }\n // n = 4, score = 800\n // 6a00 | push 0\n // ff15???????? | \n // 68???????? | \n // 8bd8 | mov ebx, eax\n\n $sequence_5 = { 833d????????00 0f842e0c0000 83ec08 0fae5c2404 8b442404 25807f0000 3d801f0000 }\n // n = 7, score = 700\n // 833d????????00 | \n // 0f842e0c0000 | je 0xc34\n // 83ec08 | sub esp, 8\n // 0fae5c2404 | stmxcsr dword ptr [esp + 4]\n // 8b442404 | mov eax, dword ptr [esp + 4]\n // 25807f0000 | and eax, 0x7f80\n // 3d801f0000 | cmp eax, 0x1f80\n\n $sequence_6 = { 6683f87f 8d642408 0f85fd0b0000 eb00 }\n // n = 4, score = 700\n // 6683f87f | cmp ax, 0x7f\n // 8d642408 | lea esp, [esp + 8]\n // 0f85fd0b0000 | jne 0xc03\n // eb00 | jmp 2\n\n $sequence_7 = { db2d???????? b802000000 833d????????00 0f85f0080000 }\n // n = 4, score = 700\n // db2d???????? | \n // b802000000 | mov eax, 2\n // 833d????????00 | \n // 0f85f0080000 | jne 0x8f6\n\n $sequence_8 = { 50 ff15???????? 83c40c 6860070000 }\n // n = 4, score = 600\n // 50 | push eax\n // ff15???????? | \n // 83c40c | add esp, 0xc\n // 6860070000 | push 0x760\n\n $sequence_9 = { 0f85aa010000 68???????? 8d442450 50 }\n // n = 4, score = 500\n // 0f85aa010000 | jne 0x1b0\n // 68???????? | \n // 8d442450 | lea eax, [esp + 0x50]\n // 50 | push eax\n\n $sequence_10 = { 5d c20400 56 ff15???????? 6a00 }\n // n = 5, score = 500\n // 5d | pop ebp\n // c20400 | ret 4\n // 56 | push esi\n // ff15???????? | \n // 6a00 | push 0\n\n $sequence_11 = { 8b1d???????? 8d85d4f7ffff 68???????? 50 ffd3 8d85d4f7ffff }\n // n = 6, score = 500\n // 8b1d???????? | \n // 8d85d4f7ffff | lea eax, [ebp - 0x82c]\n // 68???????? | \n // 50 | push eax\n // ffd3 | call ebx\n // 8d85d4f7ffff | lea eax, [ebp - 0x82c]\n\n $sequence_12 = { 8d85bcefffff 50 ff15???????? 68???????? }\n // n = 4, score = 500\n // 8d85bcefffff | lea eax, [ebp - 0x1044]\n // 50 | push eax\n // ff15???????? | \n // 68???????? | \n\n $sequence_13 = { ff15???????? 68???????? 8d85dcf7ffff 50 }\n // n = 4, score = 500\n // ff15???????? | \n // 68???????? | \n // 8d85dcf7ffff | lea eax, [ebp - 0x824]\n // 50 | push eax\n\n $sequence_14 = { 68???????? 68???????? e8???????? 83c424 6aff }\n // n = 5, score = 500\n // 68???????? | \n // 68???????? | \n // e8???????? | \n // 83c424 | add esp, 0x24\n // 6aff | push -1\n\n $sequence_15 = { ffd0 c3 8bff 55 8bec 83ec1c 8d4de4 }\n // n = 7, score = 500\n // ffd0 | call eax\n // c3 | ret \n // 8bff | mov edi, edi\n // 55 | push ebp\n // 8bec | mov ebp, esp\n // 83ec1c | sub esp, 0x1c\n // 8d4de4 | lea ecx, [ebp - 0x1c]\n\n $sequence_16 = { 6a00 e8???????? 83c408 6aff ff15???????? }\n // n = 5, score = 400\n // 6a00 | push 0\n // e8???????? | \n // 83c408 | add esp, 8\n // 6aff | push -1\n // ff15???????? | \n\n $sequence_17 = { 83c424 53 50 ffd6 }\n // n = 4, score = 300\n // 83c424 | add esp, 0x24\n // 53 | push ebx\n // 50 | push eax\n // ffd6 | call esi\n\n $sequence_18 = { 83c40c 33f6 85ff 7428 }\n // n = 4, score = 300\n // 83c40c | add esp, 0xc\n // 33f6 | xor esi, esi\n // 85ff | test edi, edi\n // 7428 | je 0x2a\n\n $sequence_19 = { 6aff ffd7 8b4dfc 33c0 }\n // n = 4, score = 300\n // 6aff | push -1\n // ffd7 | call edi\n // 8b4dfc | mov ecx, dword ptr [ebp - 4]\n // 33c0 | xor eax, eax\n\n $sequence_20 = { 6a00 51 ffb560e2ffff 50 }\n // n = 4, score = 200\n // 6a00 | push 0\n // 51 | push ecx\n // ffb560e2ffff | push dword ptr [ebp - 0x1da0]\n // 50 | push eax\n\n condition:\n 7 of them and filesize < 796672\n}","sha256":"23646b2d31dfdb73f20071a851f448dde926c02bc7c9d22c62a4dd92901f1a8f","byte_size":10167,"updated_at":"2026-06-24 05:16:00"}]}