MAL_APT_NK_WIN_Tiger_RAT_Auto
Description
Detects the Tiger RAT variant used by Andariel
Query · yara
strings:
$sequence_0 = { 33 c0 89 44 24 38 89 44 24 30 44 8b cf 45 33 c0 }
// n = 5, score = 200
// 33c0 | jmp 5
// 89442438 | dec eax
// 89442430 | mov eax, ecx
// 448bcf | movzx eax, byte ptr [eax]
// 4533c0 | dec eax
$sequence_1 = { 41 b9 01 00 00 00 48 8b d6 48 8b cb e8 ?? ?? ?? ?? }
// n = 4, score = 200
// 41b901000000 | dec eax
// 488bd6 | mov eax, dword ptr [ecx]
// 488bcb | jmp 8
// e8???????? |
$sequence_2 = { 48 81 ec 90 05 00 00 8b 01 89 85 c8 04 00 00 8b 41 04 }
// n = 4, score = 200
// 4881ec90050000 | test eax, eax
// 8b01 | jns 0x16
// 8985c8040000 | dec eax
// 8b4104 | mov eax, dword ptr [ecx]
$sequence_3 = { 48 8b 01 ff 10 48 8b 4f 08 4c 8d 4c 24 30 }
// n = 4, score = 200
// 488b01 | mov edx, esi
// ff10 | dec eax
// 488b4f08 | mov ecx, ebx
// 4c8d4c2430 | inc ecx
$sequence_4 = { 48 8b 01 ff 10 48 8b 4e 18 48 8b 01 }
// n = 4, score = 200
// 488b01 | dec eax
// ff10 | cmp dword ptr [ecx + 0x18], 0x10
// 488b4e18 | dec eax
// 488b01 | sub esp, 0x590
$sequence_5 = { 48 81 ec a0 00 00 00 33 c0 48 8b d9 48 8d 4c 24 32 }
// n = 4, score = 200
// 4881eca0000000 | mov eax, dword ptr [ecx]
// 33c0 | mov dword ptr [ebp + 0x4c8], eax
// 488bd9 | mov eax, dword ptr [ecx + 4]
// 488d4c2432 | mov dword ptr [ebp + 0x4d0], eax
$sequence_6 = { 48 8b 01 eb 03 48 8b c1 0f b6 00 }
// n = 4, score = 200
// 488b01 | inc ecx
// eb03 | mov ebx, dword ptr [ebp + ebp]
// 488bc1 | inc ecx
// 0fb600 | movups xmmword ptr [edi], xmm0
$sequence_7 = { 48 8b 01 8b 10 89 51 24 44 8b 41 24 45 85 c0 }
// n = 5, score = 200
// 488b01 | sub esp, 0x30
// 8b10 | dec ecx
// 895124 | mov ebx, eax
// 448b4124 | dec eax
// 4585c0 | mov ecx, eax
$sequence_8 = { 4c 8d 0d 31 eb 00 00 c1 e9 18 c1 e8 08 41 bf 00 00 00 80 }
// n = 4, score = 100
// 4c8d0d31eb0000 | jne 0x1e6
// c1e918 | dec eax
// c1e808 | lea ecx, [0xbda0]
// 41bf00000080 | dec esp
$sequence_9 = { 48 8b d8 48 85 c0 75 2d ff 15 ?? ?? ?? ?? 83 f8 57 0f 85 e0 01 00 00 48 8d 0d a0 bd 00 00 }
// n = 7, score = 100
// 488bd8 | dec eax
// 4885c0 | mov ebx, eax
// 752d | dec eax
// ff15???????? |
// 83f857 | test eax, eax
// 0f85e0010000 | jne 0x2f
// 488d0da0bd0000 | cmp eax, 0x57
$sequence_10 = { 75 d4 48 8d 1d 7f 6c 01 00 48 8b 4b f8 48 85 c9 74 0b }
// n = 5, score = 100
// 75d4 | lea ecx, [0xeb31]
// 488d1d7f6c0100 | shr ecx, 0x18
// 488b4bf8 | shr eax, 8
// 4885c9 | inc ecx
// 740b | mov edi, 0x80000000
$sequence_11 = { 0f 85 d9 00 00 00 48 8d 15 d0 c9 00 00 41 b8 10 20 01 00 48 8b cd e8 ?? ?? ?? ?? eb 6b b9 f4 ff ff ff }
// n = 7, score = 100
// 0f85d9000000 | jne 0xffffffd6
// 488d15d0c90000 | dec eax
// 41b810200100 | lea ebx, [0x16c7f]
// 488bcd | dec eax
// e8???????? |
// eb6b | mov ecx, dword ptr [ebx - 8]
// b9f4ffffff | dec eax
$sequence_12 = { 48 89 0d ?? ?? ?? ?? 48 89 05 ?? ?? ?? ?? 48 8d 05 ae 61 00 00 48 89 05 ?? ?? ?? ?? 48 8d 05 a0 55 00 00 48 89 05 ?? ?? ?? ?? }
// n = 6, score = 100
// 48890d???????? |
// 488905???????? |
// 488d05ae610000 | test ecx, ecx
// 488905???????? |
// 488d05a0550000 | je 0x10
// 488905???????? |
$sequence_13 = { 8b cf e8 ?? ?? ?? ?? 48 8b 7c 24 48 85 c0 0f 84 40 03 00 00 48 8d 05 60 25 01 00 }
// n = 6, score = 100
// 8bcf | mov eax, 0x12010
// e8???????? |
// 488b7c2448 | dec eax
// 85c0 | mov ecx, ebp
// 0f8440030000 | jmp 0x83
// 488d0560250100 | mov ecx, 0xfffffff4
$sequence_14 = { ff 15 ?? ?? ?? ?? 8b 05 ?? ?? ?? ?? 23 05 ?? ?? ?? ?? ba 02 00 00 00 33 c9 89 05 ?? ?? ?? ?? 8b 05 ?? ?? ?? ?? }
// n = 7, score = 100
// ff15???????? |
// 8b05???????? |
// 2305???????? |
// ba02000000 | dec eax
// 33c9 | lea eax, [0x61ae]
// 8905???????? |
// 8b05???????? |
$sequence_15 = { 48 83 ec 30 49 8b d8 e8 ?? ?? ?? ?? 48 8b c8 48 85 c0 }
// n = 5, score = 100
// 4883ec30 | jne 0xdf
// 498bd8 | dec eax
// e8???????? |
// 488bc8 | lea edx, [0xc9d0]
// 4885c0 | inc ecx
condition:
filesize < 600KB and 7 of them