rule win_terra_stealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.terra_stealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.terra_stealer"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb05 488b7c2478 8b5dec 85db 745b 49638f90000000 41398f94000000 }
            // n = 7, score = 100
            //   eb05                 | dec                 eax
            //   488b7c2478           | lea                 eax, [0x17f2f]
            //   8b5dec               | dec                 edx
            //   85db                 | mov                 dword ptr [ecx + eax], eax
            //   745b                 | dec                 eax
            //   49638f90000000       | arpl                word ptr [eax + 4], cx
            //   41398f94000000       | lea                 edx, [ecx - 0x10]

        $sequence_1 = { e8???????? 488d15d6cc0700 4c8bc0 488bcf e8???????? e9???????? 488b4718 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488d15d6cc0700       | mov                 edi, eax
            //   4c8bc0               | dec                 eax
            //   488bcf               | mov                 ecx, ebx
            //   e8????????           |                     
            //   e9????????           |                     
            //   488b4718             | movzx               edx, byte ptr [eax + 0x64]

        $sequence_2 = { 89442450 41ff5078 488b542478 4c8b6d88 0fb7f0 418937 f642280c }
            // n = 7, score = 100
            //   89442450             | mov                 ecx, esi
            //   41ff5078             | mov                 dword ptr [esp + 0x20], edi
            //   488b542478           | dec                 eax
            //   4c8b6d88             | test                edx, edx
            //   0fb7f0               | jne                 0x6b
            //   418937               | inc                 ebp
            //   f642280c             | xor                 eax, eax

        $sequence_3 = { e8???????? e9???????? 488d1536ad0800 e9???????? 488d1592ad0800 e9???????? 488d1546ae0800 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   e9????????           |                     
            //   488d1536ad0800       | dec                 eax
            //   e9????????           |                     
            //   488d1592ad0800       | lea                 ecx, [esi + 0x40]
            //   e9????????           |                     
            //   488d1546ae0800       | xor                 edx, edx

        $sequence_4 = { e9???????? 448b7d20 33f6 4863c3 89742430 4c8d0cc1 498d0441 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   448b7d20             | mov                 ebp, edx
            //   33f6                 | dec                 eax
            //   4863c3               | lea                 edx, [0x7fd4d]
            //   89742430             | inc                 esp
            //   4c8d0cc1             | mov                 dword ptr [esp + 0x80], esi
            //   498d0441             | dec                 ebp

        $sequence_5 = { e9???????? b210 488bcf e8???????? 486385fc000000 4c8d0583be0700 4c8b8dc0000000 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   b210                 | mov                 edx, dword ptr [esp + 0x20]
            //   488bcf               | jmp                 0x16ec
            //   e8????????           |                     
            //   486385fc000000       | dec                 eax
            //   4c8d0583be0700       | mov                 dword ptr [esp + 0x38], edi
            //   4c8b8dc0000000       | bt                  dx, 9

        $sequence_6 = { 660f7f442420 488d542420 488d8d20130000 e8???????? 90 66c74424403614 c64424423e }
            // n = 7, score = 100
            //   660f7f442420         | inc                 cx
            //   488d542420           | mov                 dword ptr [ebp + 0x1a4], ebx
            //   488d8d20130000       | dec                 eax
            //   e8????????           |                     
            //   90                   | mov                 ebx, eax
            //   66c74424403614       | dec                 eax
            //   c64424423e           | mov                 esi, eax

        $sequence_7 = { e9???????? 41b805000000 488d155d7f0800 488bcf e8???????? 85c0 0f841cffffff }
            // n = 7, score = 100
            //   e9????????           |                     
            //   41b805000000         | dec                 eax
            //   488d155d7f0800       | mov                 dword ptr [esp + 0x20], ebx
            //   488bcf               | dec                 esp
            //   e8????????           |                     
            //   85c0                 | lea                 eax, [0x687f5]
            //   0f841cffffff         | inc                 ecx

        $sequence_8 = { eb05 ba01000000 48638b90000000 8b742434 398b94000000 7f1c 89542420 }
            // n = 7, score = 100
            //   eb05                 | mov                 dword ptr [ecx + eax], eax
            //   ba01000000           | dec                 eax
            //   48638b90000000       | arpl                word ptr [eax + 4], cx
            //   8b742434             | lea                 edx, [ecx - 0x10]
            //   398b94000000         | inc                 edx
            //   7f1c                 | mov                 dword ptr [ecx + eax - 4], edx
            //   89542420             | dec                 eax

        $sequence_9 = { e9???????? 488b5308 488d05d334f3ff 48ff42f8 4c8b4318 488b3b 4981f8ffffff7f }
            // n = 7, score = 100
            //   e9????????           |                     
            //   488b5308             | mov                 edx, 0x40
            //   488d05d334f3ff       | dec                 eax
            //   48ff42f8             | lea                 ecx, [ebp + 0x90]
            //   4c8b4318             | dec                 eax
            //   488b3b               | add                 esp, 0x20
            //   4981f8ffffff7f       | dec                 eax

    condition:
        7 of them and filesize < 4621312
}