rule win_stowaway_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.stowaway."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.stowaway"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 76e8 77e8 78e8 79e8 }
            // n = 4, score = 200
            //   76e8                 | jbe                 0xffffffea
            //   77e8                 | ja                  0xffffffea
            //   78e8                 | js                  0xffffffea
            //   79e8                 | jns                 0xffffffea

        $sequence_1 = { 8a7cbe46 a3???????? 4e fb }
            // n = 4, score = 200
            //   8a7cbe46             | mov                 bh, byte ptr [esi + edi*4 + 0x46]
            //   a3????????           |                     
            //   4e                   | dec                 esi
            //   fb                   | sti                 

        $sequence_2 = { 4e fb b501 2a37 }
            // n = 4, score = 200
            //   4e                   | dec                 esi
            //   fb                   | sti                 
            //   b501                 | mov                 ch, 1
            //   2a37                 | sub                 dh, byte ptr [edi]

        $sequence_3 = { 78e8 79e8 7ae8 ce }
            // n = 4, score = 200
            //   78e8                 | js                  0xffffffea
            //   79e8                 | jns                 0xffffffea
            //   7ae8                 | jp                  0xffffffea
            //   ce                   | into                

        $sequence_4 = { ce f67be8 7ce8 7de8 7ee8 }
            // n = 5, score = 200
            //   ce                   | into                
            //   f67be8               | idiv                byte ptr [ebx - 0x18]
            //   7ce8                 | jl                  0xffffffea
            //   7de8                 | jge                 0xffffffea
            //   7ee8                 | jle                 0xffffffea

        $sequence_5 = { 0f11c1 7875 52 43 6b8ad456ed7902 a2???????? 6b89130a83d644 }
            // n = 7, score = 100
            //   0f11c1               | movups              xmm1, xmm0
            //   7875                 | js                  0x77
            //   52                   | push                edx
            //   43                   | inc                 ebx
            //   6b8ad456ed7902       | imul                ecx, dword ptr [edx + 0x79ed56d4], 2
            //   a2????????           |                     
            //   6b89130a83d644       | imul                ecx, dword ptr [ecx - 0x297cf5ed], 0x44

        $sequence_6 = { 7770 7771 7772 7773 }
            // n = 4, score = 100
            //   7770                 | ja                  0x72
            //   7771                 | ja                  0x73
            //   7772                 | ja                  0x74
            //   7773                 | ja                  0x75

        $sequence_7 = { 8a5631 1f 52 2021 8406 37 }
            // n = 6, score = 100
            //   8a5631               | mov                 dl, byte ptr [esi + 0x31]
            //   1f                   | pop                 ds
            //   52                   | push                edx
            //   2021                 | and                 byte ptr [ecx], ah
            //   8406                 | test                byte ptr [esi], al
            //   37                   | aaa                 

        $sequence_8 = { f60904 9c 26b696 7a19 }
            // n = 4, score = 100
            //   f60904               | test                byte ptr [ecx], 4
            //   9c                   | pushfd              
            //   26b696               | mov                 dh, 0x96
            //   7a19                 | jp                  0x1b

        $sequence_9 = { 8b5f04 8d843000a03b00 01f3 50 83c708 ff9628a03b00 95 }
            // n = 7, score = 100
            //   8b5f04               | mov                 ebx, dword ptr [edi + 4]
            //   8d843000a03b00       | lea                 eax, [eax + esi + 0x3ba000]
            //   01f3                 | add                 ebx, esi
            //   50                   | push                eax
            //   83c708               | add                 edi, 8
            //   ff9628a03b00         | call                dword ptr [esi + 0x3ba028]
            //   95                   | xchg                eax, ebp

        $sequence_10 = { 7072 72c8 0dc7707171 27 }
            // n = 4, score = 100
            //   7072                 | jo                  0x74
            //   72c8                 | jb                  0xffffffca
            //   0dc7707171           | or                  eax, 0x717170c7
            //   27                   | daa                 

        $sequence_11 = { 2cc6 ec 6e e695 8e01 5d }
            // n = 6, score = 100
            //   2cc6                 | sub                 al, 0xc6
            //   ec                   | in                  al, dx
            //   6e                   | outsb               dx, byte ptr [esi]
            //   e695                 | out                 0x95, al
            //   8e01                 | mov                 es, word ptr [ecx]
            //   5d                   | pop                 ebp

        $sequence_12 = { 9c 5c 4d 79c7 4d e081 025c51c9 }
            // n = 7, score = 100
            //   9c                   | pushfd              
            //   5c                   | pop                 esp
            //   4d                   | dec                 ebp
            //   79c7                 | jns                 0xffffffc9
            //   4d                   | dec                 ebp
            //   e081                 | loopne              0xffffff83
            //   025c51c9             | add                 bl, byte ptr [ecx + edx*2 - 0x37]

        $sequence_13 = { 89f7 b99eb40000 8a07 47 2ce8 3c01 }
            // n = 6, score = 100
            //   89f7                 | mov                 edi, esi
            //   b99eb40000           | mov                 ecx, 0xb49e
            //   8a07                 | mov                 al, byte ptr [edi]
            //   47                   | inc                 edi
            //   2ce8                 | sub                 al, 0xe8
            //   3c01                 | cmp                 al, 1

        $sequence_14 = { b082 17 16 40 9d }
            // n = 5, score = 100
            //   b082                 | mov                 al, 0x82
            //   17                   | pop                 ss
            //   16                   | push                ss
            //   40                   | inc                 eax
            //   9d                   | popfd               

        $sequence_15 = { 776a 776d 776e 776f 7770 }
            // n = 5, score = 100
            //   776a                 | ja                  0x6c
            //   776d                 | ja                  0x6f
            //   776e                 | ja                  0x70
            //   776f                 | ja                  0x71
            //   7770                 | ja                  0x72

        $sequence_16 = { 68b890e66c 195039 d0f1 1e }
            // n = 4, score = 100
            //   68b890e66c           | push                0x6ce690b8
            //   195039               | sbb                 dword ptr [eax + 0x39], edx
            //   d0f1                 | sal                 cl, 1
            //   1e                   | push                ds

        $sequence_17 = { 30c2 01420f 9f d8682a 1f d204c6 06 }
            // n = 7, score = 100
            //   30c2                 | xor                 dl, al
            //   01420f               | add                 dword ptr [edx + 0xf], eax
            //   9f                   | lahf                
            //   d8682a               | fsubr               dword ptr [eax + 0x2a]
            //   1f                   | pop                 ds
            //   d204c6               | rol                 byte ptr [esi + eax*8], cl
            //   06                   | push                es

        $sequence_18 = { 0535bc767f 111c0d16130d3c fc a4 0d00d7a01f 825b85a0 1e }
            // n = 7, score = 100
            //   0535bc767f           | add                 eax, 0x7f76bc35
            //   111c0d16130d3c       | adc                 dword ptr [ecx + 0x3c0d1316], ebx
            //   fc                   | cld                 
            //   a4                   | movsb               byte ptr es:[edi], byte ptr [esi]
            //   0d00d7a01f           | or                  eax, 0x1fa0d700
            //   825b85a0             | sbb                 byte ptr [ebx - 0x7b], 0xa0
            //   1e                   | push                ds

    condition:
        7 of them and filesize < 8003584
}