rule win_cloudburst_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.cloudburst."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cloudburst"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 418b0424 4c8b2c24 4d8d9700010000 418902 418b442404 4983c210 }
            // n = 6, score = 300
            //   418b0424             | push                edi
            //   4c8b2c24             | dec                 eax
            //   4d8d9700010000       | sub                 esp, 0x70
            //   418902               | mov                 edi, dword ptr [ecx + 0x54]
            //   418b442404           | push                esi
            //   4983c210             | push                edi

        $sequence_1 = { 8905???????? 4c2bda 90 428d048d00000000 41ffc1 4983c004 4863c8 }
            // n = 7, score = 300
            //   8905????????         |                     
            //   4c2bda               | inc                 ecx
            //   90                   | xor                 ebp, dword ptr [ebp + 4]
            //   428d048d00000000     | shr                 eax, 0x10
            //   41ffc1               | movzx               edx, al
            //   4983c004             | inc                 ecx
            //   4863c8               | mov                 eax, ecx

        $sequence_2 = { 488bcb e8???????? 488b0d???????? 41b9000000a0 4183c8ff 488bd3 ff15???????? }
            // n = 7, score = 300
            //   488bcb               | dec                 ebp
            //   e8????????           |                     
            //   488b0d????????       |                     
            //   41b9000000a0         | mov                 ecx, dword ptr [ecx + 8]
            //   4183c8ff             | mov                 dword ptr [esp + 0x28], edx
            //   488bd3               | and                 eax, 0xf
            //   ff15????????         |                     

        $sequence_3 = { 418bdd ff15???????? 85c0 7448 448b442444 4585c0 }
            // n = 6, score = 300
            //   418bdd               | inc                 cx
            //   ff15????????         |                     
            //   85c0                 | cmp                 eax, eax
            //   7448                 | je                  0x9df
            //   448b442444           | movzx               ecx, word ptr [ebx + 2]
            //   4585c0               | movzx               eax, cx

        $sequence_4 = { ff15???????? 85c0 744e 0f1f4000 }
            // n = 4, score = 300
            //   ff15????????         |                     
            //   85c0                 | mov                 eax, dword ptr [edi + 0x30]
            //   744e                 | dec                 esp
            //   0f1f4000             | lea                 ecx, [0x59da5]

        $sequence_5 = { 0bd0 43895403fa 4183f904 7cc0 418b8700020000 }
            // n = 5, score = 300
            //   0bd0                 | cmp                 dword ptr [ebp - 0x24], edi
            //   43895403fa           | je                  0x46d
            //   4183f904             | dec                 esp
            //   7cc0                 | lea                 eax, [0xfff46c01]
            //   418b8700020000       | jne                 0x47b

        $sequence_6 = { 488bf2 488bf9 33db 8d544001 8d4b40 ff15???????? }
            // n = 6, score = 300
            //   488bf2               | inc                 esp
            //   488bf9               | mov                 eax, dword ptr [ebp - 0x6c]
            //   33db                 | inc                 ebp
            //   8d544001             | xor                 ecx, ecx
            //   8d4b40               | dec                 eax
            //   ff15????????         |                     

        $sequence_7 = { c1e208 0bd0 410fb640fc c1e208 0bd0 }
            // n = 5, score = 300
            //   c1e208               | test                eax, eax
            //   0bd0                 | je                  0x1e1c
            //   410fb640fc           | dec                 eax
            //   c1e208               | mov                 ecx, esi
            //   0bd0                 | dec                 ebp

        $sequence_8 = { 43895403fa 4183f904 7cc0 418b8700020000 48895c2438 }
            // n = 5, score = 300
            //   43895403fa           | inc                 ecx
            //   4183f904             | mov                 eax, 2
            //   7cc0                 | dec                 eax
            //   418b8700020000       | lea                 edx, [0xce508]
            //   48895c2438           | dec                 eax

        $sequence_9 = { 4d8bf8 440fb6420c 41c1e108 4c8d35a3e5ffff 41c1e008 c1e708 }
            // n = 6, score = 300
            //   4d8bf8               | shr                 eax, 8
            //   440fb6420c           | movzx               edx, al
            //   41c1e108             | inc                 ecx
            //   4c8d35a3e5ffff       | mov                 eax, ebx
            //   41c1e008             | inc                 ecx
            //   c1e708               | xor                 esi, dword ptr [esp + eax*4 + 0xd6a50]

    condition:
        7 of them and filesize < 2363392
}