rule win_epsilon_red_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.epsilon_red."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.epsilon_red"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7613 31c9 31c0 e9???????? 31c0 4889d9 e8???????? }
            // n = 7, score = 200
            //   7613                 | mov                 dword ptr [esp + 0xa8], ebp
            //   31c9                 | dec                 eax
            //   31c0                 | lea                 ebp, [esp + 0xa8]
            //   e9????????           |                     
            //   31c0                 | dec                 eax
            //   4889d9               | mov                 ecx, dword ptr [ecx]
            //   e8????????           |                     

        $sequence_1 = { ffd2 488b442450 488d7001 488b842498000000 488b542440 488b4c2448 4889742450 }
            // n = 7, score = 200
            //   ffd2                 | dec                 esp
            //   488b442450           | mov                 dword ptr [esp + 8], esp
            //   488d7001             | dec                 esp
            //   488b842498000000     | mov                 dword ptr [esp + 0x2c8], edx
            //   488b542440           | dec                 ecx
            //   488b4c2448           | lea                 eax, [edx + edi]
            //   4889742450           | dec                 eax

        $sequence_2 = { ebd4 4883c108 ebce 48895c2428 48894c2418 4883792000 0f85ae020000 }
            // n = 7, score = 200
            //   ebd4                 | dec                 eax
            //   4883c108             | mov                 eax, dword ptr [esp + 0xe0]
            //   ebce                 | dec                 eax
            //   48895c2428           | mov                 dword ptr [esp + 0x30], eax
            //   48894c2418           | dec                 eax
            //   4883792000           | mov                 dword ptr [esp + 0x38], 0
            //   0f85ae020000         | dec                 esp

        $sequence_3 = { 4c894c2440 4c89542430 4c29d0 4889c6 48f7d8 48c1f83f 4c21d0 }
            // n = 7, score = 200
            //   4c894c2440           | nop                 
            //   4c89542430           | dec                 eax
            //   4c29d0               | cmp                 ebx, ecx
            //   4889c6               | jge                 0x654
            //   48f7d8               | dec                 eax
            //   48c1f83f             | test                esi, esi
            //   4c21d0               | dec                 eax

        $sequence_4 = { eb08 488b8c24a0000000 4889542450 4839c2 0f8d8e000000 4889442440 488b9c2490000000 }
            // n = 7, score = 200
            //   eb08                 | inc                 esp
            //   488b8c24a0000000     | movzx               edx, byte ptr [esp + 8]
            //   4889542450           | dec                 eax
            //   4839c2               | mov                 eax, dword ptr [esp + 0x108]
            //   0f8d8e000000         | dec                 ecx
            //   4889442440           | mov                 ebx, dword ptr [eax + 0x68]
            //   488b9c2490000000     | dec                 eax

        $sequence_5 = { 488d442420 48890424 488b8c2478010000 48894c2408 6690 e8???????? 48c784248000000000000000 }
            // n = 7, score = 200
            //   488d442420           | mov                 edx, dword ptr [esp + 0x40]
            //   48890424             | dec                 eax
            //   488b8c2478010000     | mov                 dword ptr [esp + 0xe8], edx
            //   48894c2408           | dec                 eax
            //   6690                 | mov                 dword ptr [esp + 0x1a0], ecx
            //   e8????????           |                     
            //   48c784248000000000000000     | dec    eax

        $sequence_6 = { e8???????? 4c89f0 4c89d9 e8???????? 31c0 0f1f4000 e8???????? }
            // n = 7, score = 200
            //   e8????????           |                     
            //   4c89f0               | add                 esp, 0x60
            //   4c89d9               | ret                 
            //   e8????????           |                     
            //   31c0                 | dec                 eax
            //   0f1f4000             | mov                 ecx, edi
            //   e8????????           |                     

        $sequence_7 = { 75ce 90 4839f0 7446 488b542458 4839f2 0f8234010000 }
            // n = 7, score = 200
            //   75ce                 | mov                 ecx, dword ptr [ecx]
            //   90                   | dec                 eax
            //   4839f0               | cmp                 esp, dword ptr [ecx + 0x10]
            //   7446                 | jbe                 0x600
            //   488b542458           | dec                 eax
            //   4839f2               | sub                 esp, 0x38
            //   0f8234010000         | dec                 eax

        $sequence_8 = { 7511 80b8b100000000 7408 48c74010defaffff 488b442428 4889442468 488b6c2450 }
            // n = 7, score = 200
            //   7511                 | mov                 ecx, dword ptr [ecx]
            //   80b8b100000000       | dec                 eax
            //   7408                 | cmp                 esp, dword ptr [ecx + 0x10]
            //   48c74010defaffff     | jbe                 0x236
            //   488b442428           | dec                 eax
            //   4889442468           | sub                 esp, 0x20
            //   488b6c2450           | dec                 eax

        $sequence_9 = { e8???????? ebd3 48894c2440 4c89442460 4889542468 48891424 4889742408 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   ebd3                 | cmp                 eax, 0x208
            //   48894c2440           | ja                  0x1a17
            //   4c89442460           | dec                 eax
            //   4889542468           | mov                 dword ptr [esp + 0x10], 9
            //   48891424             | dec                 eax
            //   4889742408           | mov                 dword ptr [esp + 0x18], eax

    condition:
        7 of them and filesize < 5075968
}