rule win_venomloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.venomloader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.venomloader"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ff5048 488b4b08 488d5101 4839d5 7e0b 83f8ff 0f852effffff }
            // n = 7, score = 100
            //   ff5048               | movzx               edx, byte ptr [esi + 1]
            //   488b4b08             | mov                 ebx, ebx
            //   488d5101             | dec                 eax
            //   4839d5               | shr                 eax, 0x20
            //   7e0b                 | or                  eax, 0x80000000
            //   83f8ff               | dec                 eax
            //   0f852effffff         | shl                 eax, 0x20

        $sequence_1 = { e8???????? 4c89b42438020000 4989c2 488d8424c0000000 c78424e800000000000000 4889442458 488d058c87fcff }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4c89b42438020000     | dec                 eax
            //   4989c2               | lea                 ebx, [0x1300f]
            //   488d8424c0000000     | dec                 eax
            //   c78424e800000000000000     | mov    dword ptr [eax + 0x28], ebx
            //   4889442458           | mov                 byte ptr [edx + eax + 0x6e], cl
            //   488d058c87fcff       | dec                 eax

        $sequence_2 = { 4889d9 ff5048 89c2 6683f8ff 0f8507ffffff 0f1f00 b8ffffffff }
            // n = 7, score = 100
            //   4889d9               | xor                 edx, edx
            //   ff5048               | mov                 dword ptr [ecx + 8], eax
            //   89c2                 | dec                 eax
            //   6683f8ff             | lea                 eax, [0x6236c]
            //   0f8507ffffff         | dec                 eax
            //   0f1f00               | mov                 dword ptr [ecx + 0x10], edx
            //   b8ffffffff           | dec                 eax

        $sequence_3 = { 4c89e2 4889e9 e8???????? 488d05889b0200 488d5370 488b4e68 48894318 }
            // n = 7, score = 100
            //   4c89e2               | lea                 edx, [0x4ff5f]
            //   4889e9               | dec                 eax
            //   e8????????           |                     
            //   488d05889b0200       | mov                 ecx, ebx
            //   488d5370             | dec                 eax
            //   488b4e68             | mov                 ecx, esi
            //   48894318             | dec                 eax

        $sequence_4 = { 53 4883ec20 488d053c7a0100 488d155d7a0100 66480f6ec2 488941f0 4883c050 }
            // n = 7, score = 100
            //   53                   | dec                 eax
            //   4883ec20             | mov                 dword ptr [ebx], eax
            //   488d053c7a0100       | dec                 eax
            //   488d155d7a0100       | add                 eax, 0x50
            //   66480f6ec2           | dec                 eax
            //   488941f0             | lea                 ecx, [ebx + 0x50]
            //   4883c050             | movups              xmmword ptr [ebx + 0x10], xmm6

        $sequence_5 = { 4585d2 0f85bb020000 83430801 488d053b350b00 488906 e9???????? f083430801 }
            // n = 7, score = 100
            //   4585d2               | cwde                
            //   0f85bb020000         | dec                 eax
            //   83430801             | cvtpi2ps            xmm1, mm2
            //   488d053b350b00       | mulsd               xmm0, qword ptr [ecx + eax*8]
            //   488906               | addsd               xmm0, xmm1
            //   e9????????           |                     
            //   f083430801           | dec                 cx

        $sequence_6 = { 6690 488b16 4889f9 e8???????? 85c0 7421 }
            // n = 6, score = 100
            //   6690                 | dec                 esp
            //   488b16               | mov                 ebx, ebp
            //   4889f9               | dec                 eax
            //   e8????????           |                     
            //   85c0                 | mov                 dword ptr [esp + 0xf0], ecx
            //   7421                 | dec                 eax

        $sequence_7 = { 4885c0 0f84a2000000 488d1584300100 48c7401800000000 48895010 c6402000 c640482e }
            // n = 7, score = 100
            //   4885c0               | test                bh, bh
            //   0f84a2000000         | jne                 0x48d
            //   488d1584300100       | inc                 ebp
            //   48c7401800000000     | test                bh, bh
            //   48895010             | je                  0xa73
            //   c6402000             | dec                 eax
            //   c640482e             | mov                 eax, dword ptr [esp + 0x100]

        $sequence_8 = { 4c892b 488983d0000000 0f1183b8010000 0f1183c8010000 e8???????? 488d0541850400 488d7b08 }
            // n = 7, score = 100
            //   4c892b               | lea                 ecx, [0xb7e1]
            //   488983d0000000       | dec                 eax
            //   0f1183b8010000       | mov                 edx, dword ptr [ebx]
            //   0f1183c8010000       | dec                 eax
            //   e8????????           |                     
            //   488d0541850400       | mov                 ecx, dword ptr [edx + 8]
            //   488d7b08             | dec                 eax

        $sequence_9 = { 4d89e8 4889da 4889c1 4989c4 e8???????? 488d15fb030100 b904000000 }
            // n = 7, score = 100
            //   4d89e8               | test                al, al
            //   4889da               | jne                 0x1a6b
            //   4889c1               | nop                 dword ptr [eax]
            //   4989c4               | dec                 eax
            //   e8????????           |                     
            //   488d15fb030100       | lea                 eax, [eax + 0x18]
            //   b904000000           | cmp                 ebx, 2

    condition:
        7 of them and filesize < 2592768
}