MALPEDIA_Win_Smokeloader_Auto

YARA detection rule by Felix Bilstein - yara-signator at cocacoding dot com · GPL-2.0

autogenerated rule brought to you by yara-signator

rule MALPEDIA_Win_Smokeloader_Auto: FILE {
  meta:
    description        = "autogenerated rule brought to you by yara-signator"
    author             = "Felix Bilstein - yara-signator at cocacoding dot com"
    id                 = "977bd971-8931-5636-8c4a-15a97d7d7052"
    date               = "2023-12-06"
    modified           = "2023-12-08"
    reference          = "https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader"
    source_url         = "https://github.com/malpedia/signator-rules//blob/fbacfc09b84d53d410385e66a8e56f25016c588a/rules/win.smokeloader_auto.yar#L1-L568"
    license_url        = "N/A"
    logic_hash         = "1e0a8327807cdebec07ee883bf0e214c6531b2f2bf2969115a759b540a5a3955"
    score              = 75
    quality            = 50
    tags               = "FILE"
    version            = "1"
    tool               = "yara-signator v0.6.0"
    signator_config    = "callsandjumps;datarefs;binvalue"
    malpedia_rule_date = "20231130"
    malpedia_hash      = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
    malpedia_version   = "20230808"
    malpedia_license   = "CC BY-SA 4.0"
    malpedia_sharing   = "TLP:WHITE"

  strings:
    $sequence_0  = { ff 15 ?? ?? ?? ?? 8d 45 f0 50 8d 45 e8 50 8d 45 e0 50 }
    $sequence_1  = { 57 ff 15 ?? ?? ?? ?? 6a 00 68 00 00 00 02 6a 03 6a 00 6a 03 }
    $sequence_2  = { 50 8d 45 e0 50 56 ff 15 ?? ?? ?? ?? 56 ff 15 ?? ?? ?? ?? }
    $sequence_3  = { 8b f0 8d 45 dc 50 6a 00 53 ff 15 ?? ?? ?? ?? }
    $sequence_4  = { 74 0a 83 c1 04 83 f9 20 72 f0 }
    $sequence_5  = { e8 ?? ?? ?? ?? 8b f0 8d 45 fc 50 ff 75 fc 56 6a 19 }
    $sequence_6  = { ff 15 ?? ?? ?? ?? bf 90 01 00 00 8b cf e8 ?? ?? ?? ?? }
    $sequence_7  = { 0f b6 44 05 dc 50 8d 45 ec 50 }
    $sequence_8  = { 50 56 68 1f 00 0f 00 57 }
    $sequence_9  = { 56 8d 45 fc 50 57 57 6a 19 }
    $sequence_10 = { 66 8c e8 66 85 c0 74 06 fe 05 ?? ?? ?? ?? }
    $sequence_11 = { 8b 07 03 c3 50 ff 15 ?? ?? ?? ?? }
    $sequence_12 = { 56 ff 15 ?? ?? ?? ?? 50 56 6a 00 ff 15 ?? ?? ?? ?? }
    $sequence_13 = { 33 c0 e9 ?? ?? ?? ?? e8 ?? ?? ?? ?? b9 04 01 00 00 }
    $sequence_14 = { 88 44 3c 18 88 54 34 18 0f b6 4c 3c 18 0f b6 c2 03 c8 81 e1 ff 00 00 00 }
    $sequence_15 = { 81 e5 ff 00 00 00 8a 44 2c 18 88 44 3c 18 47 }
    $sequence_16 = { e8 ?? ?? ?? ?? 8b f8 68 ?? ?? ?? ?? ff 15 ?? ?? ?? ?? }
    $sequence_17 = { eb f5 55 8b ec 83 ec 24 8d 45 f4 53 }
    $sequence_18 = { 50 57 ff 15 ?? ?? ?? ?? 43 83 fb 0f }
    $sequence_19 = { 8b 7d 10 50 57 56 53 e8 ?? ?? ?? ?? }
    $sequence_20 = { 8d 8d e8 fd ff ff 50 50 50 }
    $sequence_21 = { 8d 95 f0 fd ff ff c7 02 00 00 00 00 68 00 80 00 00 52 51 6a ff }
    $sequence_22 = { 89 85 ec fd ff ff ff b5 f0 fd ff ff 50 53 e8 ?? ?? ?? ?? 8d 8d ec fd ff ff }
    $sequence_23 = { e8 ?? ?? ?? ?? 25 00 30 00 38 00 58 00 25 00 30 00 38 }
    $sequence_24 = { 8d b5 f8 fd ff ff c6 06 53 56 6a 00 6a 00 6a 00 }
    $sequence_25 = { 8b 45 14 89 86 08 02 00 00 56 6a ff }
    $sequence_26 = { 01 d4 8d 85 f0 fd ff ff 8b 75 0c 8b 7d 10 50 57 }
    $sequence_27 = { fc 5f 5e 5b }
    $sequence_28 = { 89 e5 81 ec 5c 06 00 00 53 56 }
    $sequence_29 = { 30 d0 aa e2 f3 75 05 }
    $sequence_30 = { 89 cf fc b2 80 31 db a4 }
    $sequence_31 = { 60 89 c6 89 cf fc }
    $sequence_32 = { ff 15 ?? ?? ?? ?? 85 c0 74 7c 48 8b 4c 24 48 45 33 c9 48 8d 44 24 40 }
    $sequence_33 = { 48 8b 45 47 48 89 07 48 85 c9 74 0f 8b 45 0f 48 89 4d 17 83 c8 02 }
    $sequence_34 = { 33 c9 e8 ?? ?? ?? ?? 48 8b d8 45 84 ff 74 11 41 b1 01 }
    $sequence_35 = { 4f 8d 1c 10 41 8b 4b 18 45 }
    $sequence_36 = { 01 c4 ff c9 49 8d 3c 8c }
    $sequence_37 = { 4c 01 c7 8b 04 8f 4c }
    $sequence_38 = { 49 8d 3c 8c 8b 37 4c 01 c6 }
    $sequence_39 = { 41 b1 04 44 8b c7 48 8b cb e8 ?? ?? ?? ?? 48 8b 74 24 40 48 8b c3 48 8b 5c 24 30 }
    $sequence_40 = { 55 89 e5 81 ec 54 04 00 00 53 }
    $sequence_41 = { 33 c9 4c 89 7c 24 28 c7 44 24 20 00 a0 0f 00 ff 15 ?? ?? ?? ?? }
    $sequence_42 = { 8b 4b 18 45 8b 63 20 4d }
    $sequence_43 = { 89 d0 c1 e2 05 01 c2 31 c0 ac 01 c2 85 c0 }
    $sequence_44 = { 83 c4 08 85 c0 0f 84 cb 00 00 00 8b 45 f4 2d 10 bf 34 00 0f b7 4d ec }
    $sequence_45 = { 89 46 fc ad 85 c0 75 f3 c3 56 }
    $sequence_46 = { 56 ad 01 e8 31 c9 c1 c1 08 32 08 }
    $sequence_47 = { 8b 4d a0 8b 55 a4 89 51 48 68 9d 1e 6b 63 8b 45 e4 50 }
    $sequence_48 = { 8b 45 b4 89 42 20 eb 10 8b 8d 78 ff ff ff 8b 11 89 95 78 ff ff ff eb ae }
    $sequence_49 = { 03 47 1c 8b 04 28 01 e8 5e c3 }
    $sequence_50 = { 5b c9 c2 08 00 55 89 e5 83 ec 04 }
    $sequence_51 = { e8 ?? ?? ?? ?? 89 45 ac 6a 00 6a 04 8d 45 b4 50 }
    $sequence_52 = { aa e2 f3 75 06 74 04 }
    $sequence_53 = { 55 8b ec 83 c4 d0 1e 53 }
    $sequence_54 = { 68 4a 0d ce 09 8b 45 e4 50 e8 ?? ?? ?? ?? 89 45 a8 8b 4d a0 8b 55 a8 }
    $sequence_55 = { 83 ec 0c e8 ?? ?? ?? ?? 89 45 f8 8b 45 f8 8b 48 60 89 4d f4 ff 75 18 }
    $sequence_56 = { 80 38 00 75 f5 31 d1 75 ec }
    $sequence_57 = { 8b 45 0c 2d 10 bf 34 00 8b 4d 08 c1 e1 03 }
    $sequence_58 = { 8b 55 f8 0f b7 0a c1 e1 03 33 d2 f7 f1 89 45 fc }
    $sequence_59 = { 5e c3 60 89 c6 }
    $sequence_60 = { 9a 18 a1 5c 5d 5d 5d d6 00 55 d0 08 a5 0f 37 5d 37 }
    $sequence_61 = { 48 35 f9 4e 5d 5d d6 59 79 de 99 }
    $sequence_62 = { 5d 5d b6 58 1f 79 b6 a8 88 }
    $sequence_63 = { 00 55 d0 08 a5 0f 37 5d 37 5d 37 }
    $sequence_64 = { 5d 5d 28 58 29 5e cb }

  condition:
    7 of them and filesize < 245760
}

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

36ee2880-6f21-44fd-a52b-864758eebc85

Propose edits, view related rules, and engage with the community through comments.

Executable code, not a declarative rule

This submission is arbitrary [[ currentRule.format ? currentRule.format.toUpperCase() : '' ]] code, not a declarative detection rule — review it as you would any script before running it, and note that it cannot be safely aggregated or auto-executed alongside YARA/Sigma/Suricata/CRS rules.

Rejected pattern present

[[ reason ]]

What does this mean?

Format & documentation suggestions

Not a security issue — this rule is valid and was accepted as-is. These are optional fields/conventions its own format recommends, mainly affecting its quality score and how well it documents itself for other reviewers.

[[ reason ]]

What do these messages mean?

[[ currentRule.title && currentRule.title.length > 60 ? currentRule.title.slice(0, 60) + '…' : currentRule.title ]]

[[ currentRule.title ]]

Community Discussion