rule win_topinambour_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.topinambour."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.topinambour"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 2b1d 09 1106 1107 }
            // n = 4, score = 100
            //   2b1d                 | add                 byte ptr [eax], al
            //   09                   | or                  ch, byte ptr [eax]
            //   1106                 | or                  byte ptr [eax], al
            //   1107                 | add                 byte ptr [edx], cl

        $sequence_1 = { 02 282100000a 6f2200000a 25 6f1d00000a 16 6f2300000a }
            // n = 7, score = 100
            //   02                   | jb                  0x99
            //   282100000a           | add                 byte ptr [eax], al
            //   6f2200000a           | jo                  0x4a
            //   25                   | sub                 byte ptr [ecx], ah
            //   6f1d00000a           | add                 byte ptr [eax], al
            //   16                   | or                  ch, byte ptr [edi + 0x22]
            //   6f2300000a           | add                 byte ptr [eax], al

        $sequence_2 = { 1105 8d0f000001 1306 16 1307 }
            // n = 5, score = 100
            //   1105                 | add                 byte ptr [eax], al
            //   8d0f000001           | add                 dword ptr [ecx], ecx
            //   1306                 | adc                 dword ptr [edx + ebx], eax
            //   16                   | push                ss
            //   1307                 | outsd               dx, dword ptr [esi]

        $sequence_3 = { 6f1d00000a 7245000070 6f2000000a 25 6f1d00000a 7255000070 02 }
            // n = 7, score = 100
            //   6f1d00000a           | adc                 dword ptr [edi], eax
            //   7245000070           | adc                 dword ptr [ebx], ecx
            //   6f2000000a           | pop                 eax
            //   25                   | outsd               dx, dword ptr [esi]
            //   6f1d00000a           | adc                 al, 0
            //   7255000070           | add                 byte ptr [edx], cl
            //   02                   | sub                 byte ptr [edx], al

        $sequence_4 = { 20204e0000 6f0c00000a 09 2060ea0000 6f0d00000a }
            // n = 5, score = 100
            //   20204e0000           | or                  eax, 0x1e6f1709
            //   6f0c00000a           | add                 byte ptr [eax], al
            //   09                   | or                  ah, byte ptr [0x1d6f]
            //   2060ea0000           | or                  dl, byte ptr [edi]
            //   6f0d00000a           | pop                 ss

        $sequence_5 = { 25 721d000070 6f0500000a 25 }
            // n = 4, score = 100
            //   25                   | pop                 ds
            //   721d000070           | add                 byte ptr [eax], al
            //   6f0500000a           | or                  ah, byte ptr [0x1d6f]
            //   25                   | or                  dl, byte ptr [edi]

        $sequence_6 = { 730900000a 0c 6f0a00000a 17 1c 730b00000a }
            // n = 6, score = 100
            //   730900000a           | outsd               dx, dword ptr [esi]
            //   0c                   | pop                 ds
            //   6f0a00000a           | add                 byte ptr [eax], al
            //   17                   | or                  ah, byte ptr [0x1f6f]
            //   1c                   | or                  ah, byte ptr [0x1d6f]
            //   730b00000a           | or                  dh, byte ptr [edx + 0x45]

        $sequence_7 = { 25 6f1d00000a 7255000070 02 282100000a }
            // n = 5, score = 100
            //   25                   | or                  byte ptr [edi + 0xe], ch
            //   6f1d00000a           | add                 byte ptr [eax], al
            //   7255000070           | or                  ah, byte ptr [eax]
            //   02                   | fnsave              dword ptr [ebx]
            //   282100000a           | add                 byte ptr [eax], al

        $sequence_8 = { 2e06 731000000a 7a 1104 16 }
            // n = 5, score = 100
            //   2e06                 | add                 byte ptr [eax], al
            //   731000000a           | or                  bh, byte ptr [edx]
            //   7a                   | sti                 
            //   1104                 | outsd               dx, dword ptr [esi]
            //   16                   | push                ss

        $sequence_9 = { 6f1400000a 2802000006 1308 281300000a 1108 6f1500000a }
            // n = 6, score = 100
            //   6f1400000a           | or                  cl, byte ptr [edx]
            //   2802000006           | cmp                 cl, bh
            //   1308                 | add                 byte ptr [eax], al
            //   281300000a           | add                 byte ptr [edx], dl
            //   1108                 | add                 byte ptr [eax], ch
            //   6f1500000a           | pop                 es

    condition:
        7 of them and filesize < 50176
}