rule win_regphantom_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.regphantom."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.regphantom"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 488b45e0 488908 c745b0130968e0 e9???????? c745b02795afa3 e9???????? 488b45e8 }
            // n = 7, score = 100
            //   488b45e0             | sub                 eax, 0xbdadb2ce
            //   488908               | je                  0x73a
            //   c745b0130968e0       | sub                 eax, 0x912f2554
            //   e9????????           |                     
            //   c745b02795afa3       | je                  0xa20
            //   e9????????           |                     
            //   488b45e8             | mov                 eax, dword ptr [ebp - 0x5c]

        $sequence_1 = { 8b4594 2d1f81e4e7 0f844b0f0000 e9???????? 8b4594 2d94fd34e9 0f84c70f0000 }
            // n = 7, score = 100
            //   8b4594               | in                  al, dx
            //   2d1f81e4e7           | and                 bh, bh
            //   0f844b0f0000         | ror                 byte ptr [eax - 0x7d], 1
            //   e9????????           |                     
            //   8b4594               | les                 esp, ptr [eax]
            //   2d94fd34e9           | dec                 eax
            //   0f84c70f0000         | mov                 ecx, dword ptr [eax]

        $sequence_2 = { 8b45a4 2d9dddecf5 0f8475070000 e9???????? 8b45a4 2d989422f7 0f8425030000 }
            // n = 7, score = 100
            //   8b45a4               | dec                 eax
            //   2d9dddecf5           | mov                 dword ptr [ecx], edx
            //   0f8475070000         | dec                 eax
            //   e9????????           |                     
            //   8b45a4               | mov                 ecx, dword ptr [ecx]
            //   2d989422f7           | mov                 ecx, dword ptr [ecx + 0xb0]
            //   0f8425030000         | mov                 dword ptr [eax], ecx

        $sequence_3 = { 80e101 884dde 83f80a 0f9cc0 }
            // n = 4, score = 100
            //   80e101               | mov                 dword ptr [ebp - 8], eax
            //   884dde               | dec                 eax
            //   83f80a               | mov                 eax, dword ptr [ebp - 0x70]
            //   0f9cc0               | dec                 ecx

        $sequence_4 = { 8b4594 2d2ae90ea4 0f8472110000 e9???????? 8b4594 }
            // n = 5, score = 100
            //   8b4594               | sub                 edx, 1
            //   2d2ae90ea4           | mov                 byte ptr [ebp - 2], al
            //   0f8472110000         | mov                 edx, ecx
            //   e9????????           |                     
            //   8b4594               | sub                 edx, 1

        $sequence_5 = { 08c2 b8e95c8e41 b94a8237ed f6c201 0f45c1 8945d8 e9???????? }
            // n = 7, score = 100
            //   08c2                 | mov                 eax, 0x10
            //   b8e95c8e41           | dec                 eax
            //   b94a8237ed           | mov                 dword ptr [ebp - 0x80], eax
            //   f6c201               | dec                 eax
            //   0f45c1               | sub                 esp, eax
            //   8945d8               | ret                 
            //   e9????????           |                     

        $sequence_6 = { 4c2bc7 0f114130 498bc8 4c8bc8 66480f7ec0 f3aa 498bc1 }
            // n = 7, score = 100
            //   4c2bc7               | mov                 dword ptr [eax], ecx
            //   0f114130             | dec                 eax
            //   498bc8               | mov                 ecx, dword ptr [ebp + 0x20]
            //   4c8bc8               | xor                 edx, edx
            //   66480f7ec0           | inc                 ecx
            //   f3aa                 | mov                 eax, 0x20
            //   498bc1               | dec                 eax

        $sequence_7 = { 4883c420 488b4df8 488b4500 488908 488b4508 48c70000000000 c745c07291fd42 }
            // n = 7, score = 100
            //   4883c420             | and                 al, 1
            //   488b4df8             | mov                 byte ptr [ebp + 0x2c], al
            //   488b4500             | mov                 edx, ecx
            //   488908               | sub                 edx, 1
            //   488b4508             | setb                al
            //   48c70000000000       | and                 al, 1
            //   c745c07291fd42       | mov                 byte ptr [ebp + 0x39], al

        $sequence_8 = { 83f900 0f94c2 83f80a 0f9cc0 08c2 b8410b99be b942477ce1 }
            // n = 7, score = 100
            //   83f900               | dec                 eax
            //   0f94c2               | mov                 eax, 0x73cd8242
            //   83f80a               | push                0x4820e122
            //   0f9cc0               | lea                 ecx, [0xfffff820]
            //   08c2                 | dec                 eax
            //   b8410b99be           | sub                 esp, 0x20
            //   b942477ce1           | call                eax

        $sequence_9 = { e9???????? 488b45b8 488b08 488b45a8 488908 c745a057e9fb26 e9???????? }
            // n = 7, score = 100
            //   e9????????           |                     
            //   488b45b8             | sub                 eax, 0xf7229498
            //   488b08               | je                  0x13d9
            //   488b45a8             | mov                 eax, dword ptr [ebp - 0x5c]
            //   488908               | sub                 eax, 0x784c2d9e
            //   c745a057e9fb26       | je                  0x1614
            //   e9????????           |                     

    condition:
        7 of them and filesize < 123904
}