Indicators of Compromise (IoCs)

MITRE ATT&CK Execution and Tactics

rule win_akira_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.akira."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.akira"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4d3bca 7223 49893b 41c7430802000000 41c6431001 e9???????? b8ffffffff }
            // n = 7, score = 100
            //   4d3bca               | mov                 dword ptr [esp + 0x20], ebp
            //   7223                 | inc                 ecx
            //   49893b               | sub                 dh, bh
            //   41c7430802000000     | imul                ebp, edi
            //   41c6431001           | inc                 eax
            //   e9????????           |                     
            //   b8ffffffff           | movsx               eax, dh

        $sequence_1 = { e8???????? 4c8bc0 488bd3 488d4c2440 e8???????? 488d154de80600 488d4c2440 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4c8bc0               | dec                 eax
            //   488bd3               | sub                 esp, ecx
            //   488d4c2440           | dec                 eax
            //   e8????????           |                     
            //   488d154de80600       | lea                 ebx, [esp + 0x50]
            //   488d4c2440           | dec                 eax

        $sequence_2 = { 488d8597010000 4c8bc7 0f1f840000000000 49ffc0 6642833c4000 75f5 488d9597010000 }
            // n = 7, score = 100
            //   488d8597010000       | dec                 eax
            //   4c8bc7               | mov                 eax, dword ptr [ebp - 8]
            //   0f1f840000000000     | dec                 eax
            //   49ffc0               | mov                 ebx, dword ptr [eax + 0x88]
            //   6642833c4000         | dec                 eax
            //   75f5                 | mov                 eax, dword ptr [ebp - 0x20]
            //   488d9597010000       | dec                 eax

        $sequence_3 = { 742c 4c8bc6 488d15fbf80400 488bcf e8???????? 488d55c0 48837dd810 }
            // n = 7, score = 100
            //   742c                 | dec                 eax
            //   4c8bc6               | mov                 edi, eax
            //   488d15fbf80400       | jmp                 0x3c2
            //   488bcf               | dec                 ecx
            //   e8????????           |                     
            //   488d55c0             | mov                 edi, ebp
            //   48837dd810           | dec                 eax

        $sequence_4 = { 488bd9 488bc2 488d0d45550400 0f57c0 488d5308 48890b 488d4808 }
            // n = 7, score = 100
            //   488bd9               | mov                 edi, dword ptr [edi + 8]
            //   488bc2               | dec                 eax
            //   488d0d45550400       | test                edi, edi
            //   0f57c0               | jne                 0x4f
            //   488d5308             | dec                 eax
            //   48890b               | mov                 edi, dword ptr [ebp - 0x79]
            //   488d4808             | dec                 eax

        $sequence_5 = { 488d542420 e8???????? 8bf8 85c0 750d f744243010000000 0f95c3 }
            // n = 7, score = 100
            //   488d542420           | test                edi, edi
            //   e8????????           |                     
            //   8bf8                 | jne                 0x649
            //   85c0                 | mov                 edx, dword ptr [esp + 0x3b8]
            //   750d                 | cmp                 edx, 0x3b9aca00
            //   f744243010000000     | dec                 eax
            //   0f95c3               | lea                 eax, [esp + 0x50]

        $sequence_6 = { 488b842430010000 668910 4c892b e8???????? eb7a 0f1f00 488d4b28 }
            // n = 7, score = 100
            //   488b842430010000     | add                 edx, ecx
            //   668910               | dec                 eax
            //   4c892b               | sar                 edx, 6
            //   e8????????           |                     
            //   eb7a                 | dec                 eax
            //   0f1f00               | mov                 eax, edx