rule win_dusty_hammock_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.dusty_hammock."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dusty_hammock"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { f7e2 89d7 894608 89d8 ba00ca9a3b 69c900ca9a3b 037e24 }
            // n = 7, score = 100
            //   f7e2                 | mul                 edx
            //   89d7                 | mov                 edi, edx
            //   894608               | mov                 dword ptr [esi + 8], eax
            //   89d8                 | mov                 eax, ebx
            //   ba00ca9a3b           | mov                 edx, 0x3b9aca00
            //   69c900ca9a3b         | imul                ecx, ecx, 0x3b9aca00
            //   037e24               | add                 edi, dword ptr [esi + 0x24]

        $sequence_1 = { e8???????? a801 885624 0f85991a0000 8b4614 895e30 89462c }
            // n = 7, score = 100
            //   e8????????           |                     
            //   a801                 | test                al, 1
            //   885624               | mov                 byte ptr [esi + 0x24], dl
            //   0f85991a0000         | jne                 0x1a9f
            //   8b4614               | mov                 eax, dword ptr [esi + 0x14]
            //   895e30               | mov                 dword ptr [esi + 0x30], ebx
            //   89462c               | mov                 dword ptr [esi + 0x2c], eax

        $sequence_2 = { e8???????? 8b4604 6683247800 47 897e08 5e 5f }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8b4604               | mov                 eax, dword ptr [esi + 4]
            //   6683247800           | and                 word ptr [eax + edi*2], 0
            //   47                   | inc                 edi
            //   897e08               | mov                 dword ptr [esi + 8], edi
            //   5e                   | pop                 esi
            //   5f                   | pop                 edi

        $sequence_3 = { 89f0 29f8 83f807 8d1439 7726 39fe 0f84da000000 }
            // n = 7, score = 100
            //   89f0                 | mov                 eax, esi
            //   29f8                 | sub                 eax, edi
            //   83f807               | cmp                 eax, 7
            //   8d1439               | lea                 edx, [ecx + edi]
            //   7726                 | ja                  0x28
            //   39fe                 | cmp                 esi, edi
            //   0f84da000000         | je                  0xe0

        $sequence_4 = { f7e2 7051 3dfcffff7f 7758 31c9 85f6 7416 }
            // n = 7, score = 100
            //   f7e2                 | mul                 edx
            //   7051                 | jo                  0x53
            //   3dfcffff7f           | cmp                 eax, 0x7ffffffc
            //   7758                 | ja                  0x5a
            //   31c9                 | xor                 ecx, ecx
            //   85f6                 | test                esi, esi
            //   7416                 | je                  0x18

        $sequence_5 = { ff75a8 ff15???????? 8b8df0deffff 89f2 89c3 e8???????? 8b4dc0 }
            // n = 7, score = 100
            //   ff75a8               | push                dword ptr [ebp - 0x58]
            //   ff15????????         |                     
            //   8b8df0deffff         | mov                 ecx, dword ptr [ebp - 0x2110]
            //   89f2                 | mov                 edx, esi
            //   89c3                 | mov                 ebx, eax
            //   e8????????           |                     
            //   8b4dc0               | mov                 ecx, dword ptr [ebp - 0x40]

        $sequence_6 = { c7868805000007000000 888668010000 6a2b 5a b9???????? 68???????? 68???????? }
            // n = 7, score = 100
            //   c7868805000007000000     | mov    dword ptr [esi + 0x588], 7
            //   888668010000         | mov                 byte ptr [esi + 0x168], al
            //   6a2b                 | push                0x2b
            //   5a                   | pop                 edx
            //   b9????????           |                     
            //   68????????           |                     
            //   68????????           |                     

        $sequence_7 = { ff15???????? 85c0 0f846c020000 8b4c2408 39f9 0f8473020000 0f83f0020000 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   0f846c020000         | je                  0x272
            //   8b4c2408             | mov                 ecx, dword ptr [esp + 8]
            //   39f9                 | cmp                 ecx, edi
            //   0f8473020000         | je                  0x279
            //   0f83f0020000         | jae                 0x2f6

        $sequence_8 = { 837c241800 0f8461f8ffff 89c2 68???????? e8???????? 8b4c242c 8b54240c }
            // n = 7, score = 100
            //   837c241800           | cmp                 dword ptr [esp + 0x18], 0
            //   0f8461f8ffff         | je                  0xfffff867
            //   89c2                 | mov                 edx, eax
            //   68????????           |                     
            //   e8????????           |                     
            //   8b4c242c             | mov                 ecx, dword ptr [esp + 0x2c]
            //   8b54240c             | mov                 edx, dword ptr [esp + 0xc]

        $sequence_9 = { 899520ffffff f20f118518ffffff 8b55d4 f20f1045cc 89952cffffff f20f118524ffffff 8b9548ffffff }
            // n = 7, score = 100
            //   899520ffffff         | mov                 dword ptr [ebp - 0xe0], edx
            //   f20f118518ffffff     | movsd               qword ptr [ebp - 0xe8], xmm0
            //   8b55d4               | mov                 edx, dword ptr [ebp - 0x2c]
            //   f20f1045cc           | movsd               xmm0, qword ptr [ebp - 0x34]
            //   89952cffffff         | mov                 dword ptr [ebp - 0xd4], edx
            //   f20f118524ffffff     | movsd               qword ptr [ebp - 0xdc], xmm0
            //   8b9548ffffff         | mov                 edx, dword ptr [ebp - 0xb8]

    condition:
        7 of them and filesize < 1051648
}