rule win_troll_stealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.troll_stealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.troll_stealer"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0fca 4084d7 453ad6 81f22940ac2d f7d2 f8 41f6c0a2 }
            // n = 7, score = 100
            //   0fca                 | dec                 eax
            //   4084d7               | add                 ebx, 1
            //   453ad6               | adc                 dh, 0x3e
            //   81f22940ac2d         | dec                 eax
            //   f7d2                 | rcl                 edx, cl
            //   f8                   | inc                 ecx
            //   41f6c0a2             | xor                 cl, al

        $sequence_1 = { 410fcb 99 410f90c0 48c1c992 41c1c303 66440f4ecc f6d0 }
            // n = 7, score = 100
            //   410fcb               | bswap               bp
            //   99                   | inc                 eax
            //   410f90c0             | dec                 ch
            //   48c1c992             | mov                 dl, dh
            //   41c1c303             | inc                 eax
            //   66440f4ecc           | dec                 dh
            //   f6d0                 | dec                 ecx

        $sequence_2 = { 53 f9 d3c3 d2cf 310c24 66d3c3 5b }
            // n = 7, score = 100
            //   53                   | dec                 ebp
            //   f9                   | mov                 dword ptr [ecx + 8], ebx
            //   d3c3                 | dec                 ebp
            //   d2cf                 | movsx               ebx, sp
            //   310c24               | dec                 ecx
            //   66d3c3               | mov                 ecx, dword ptr [ecx + 8]
            //   5b                   | btc                 ax, 0x55

        $sequence_3 = { fecb 6681ebec79 310c24 66440fbbc3 0fbfdd 5b 4863c9 }
            // n = 7, score = 100
            //   fecb                 | test                al, 0x98
            //   6681ebec79           | push                ebx
            //   310c24               | rol                 ebx, cl
            //   66440fbbc3           | neg                 ecx
            //   0fbfdd               | bswap               ecx
            //   5b                   | dec                 ecx
            //   4863c9               | stc                 

        $sequence_4 = { f8 f5 d1cd 6641f7c77652 664181fef414 f8 4150 }
            // n = 7, score = 100
            //   f8                   | inc                 ecx
            //   f5                   | test                eax, 0x600c54cd
            //   d1cd                 | add                 edx, 0x548a222b
            //   6641f7c77652         | inc                 eax
            //   664181fef414         | test                bh, 0x80
            //   f8                   | clc                 
            //   4150                 | cmc                 

        $sequence_5 = { 3adf 4184c1 f9 4153 490fbae3a3 4d0f4fdd 310c24 }
            // n = 7, score = 100
            //   3adf                 | inc                 ebp
            //   4184c1               | bts                 ecx, edi
            //   f9                   | dec                 esp
            //   4153                 | sub                 ecx, ebx
            //   490fbae3a3           | inc                 sp
            //   4d0f4fdd             | movzx               ecx, dh
            //   310c24               | inc                 ecx

        $sequence_6 = { c0f328 0adc 410fbfdd 80f18c 80e954 48c1dba3 f6d9 }
            // n = 7, score = 100
            //   c0f328               | bsf                 eax, eax
            //   0adc                 | xor                 ecx, 0x49e72b99
            //   410fbfdd             | inc                 ecx
            //   80f18c               | cmp                 ah, dh
            //   80e954               | clc                 
            //   48c1dba3             | neg                 ecx
            //   f6d9                 | ror                 ecx, 1

        $sequence_7 = { d1c8 f9 4084e0 4151 490fbaf94d 310424 }
            // n = 6, score = 100
            //   d1c8                 | movsx               edx, di
            //   f9                   | inc                 ecx
            //   4084e0               | pop                 dword ptr [eax]
            //   4151                 | dec                 eax
            //   490fbaf94d           | btr                 edx, esi
            //   310424               | dec                 ecx

        $sequence_8 = { 40f6c49f 81c11f68a01e f8 f7d1 f8 0fc9 }
            // n = 6, score = 100
            //   40f6c49f             | inc                 eax
            //   81c11f68a01e         | sbb                 bh, 0xf6
            //   f8                   | inc                 ecx
            //   f7d1                 | mov                 edi, dword ptr [ebx]
            //   f8                   | inc                 ecx
            //   0fc9                 | test                bl, 0x2b

        $sequence_9 = { 4963fe 311c24 40c0e73d 40d2ef 5f f8 }
            // n = 6, score = 100
            //   4963fe               | not                 ecx
            //   311c24               | dec                 esp
            //   40c0e73d             | mov                 ecx, ebp
            //   40d2ef               | inc                 ecx
            //   5f                   | pop                 ebx
            //   f8                   | dec                 eax

    condition:
        7 of them and filesize < 45868032
}