rule elf_nosedive_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects elf.nosedive."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.nosedive"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 4c8b442410 488b4c2408 ba14000000 488b3c24 be02000000 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4c8b442410           | dec                 eax
            //   488b4c2408           | mov                 dword ptr [esp + 0x18], eax
            //   ba14000000           | dec                 eax
            //   488b3c24             | add                 esp, 0xd8
            //   be02000000           | ret                 
            //   e8????????           |                     

        $sequence_1 = { ba9c030000 488d3526900500 488d3d5d020400 e9???????? 488d148d03400000 e9???????? 4585c9 }
            // n = 7, score = 100
            //   ba9c030000           | jg                  0x1159
            //   488d3526900500       | inc                 esp
            //   488d3d5d020400       | mov                 edi, dword ptr [esp + 0x44]
            //   e9????????           |                     
            //   488d148d03400000     | mov                 ebx, dword ptr [esp + 0x34]
            //   e9????????           |                     
            //   4585c9               | mov                 eax, dword ptr [esp + 0x54]

        $sequence_2 = { c1ea18 460fb60403 0fb6541500 c1e218 4431c2 4189f8 c1ef10 }
            // n = 7, score = 100
            //   c1ea18               | mov                 edi, ebp
            //   460fb60403           | test                eax, eax
            //   0fb6541500           | jne                 0xca7
            //   c1e218               | mov                 ecx, 1
            //   4431c2               | dec                 esp
            //   4189f8               | mov                 edx, edi
            //   c1ef10               | dec                 esp

        $sequence_3 = { 89550c 418b4500 83e0fd 74f7 eb12 4584f6 750d }
            // n = 7, score = 100
            //   89550c               | test                dl, dl
            //   418b4500             | je                  0x256
            //   83e0fd               | dec                 eax
            //   74f7                 | mov                 dword ptr [esp + 0x50], edi
            //   eb12                 | dec                 eax
            //   4584f6               | mov                 ecx, dword ptr [esp + 0x50]
            //   750d                 | inc                 ebp

        $sequence_4 = { eb7a 4c89e7 e8???????? 4989c4 4885c0 74db 4889c7 }
            // n = 7, score = 100
            //   eb7a                 | dec                 eax
            //   4c89e7               | lea                 ebx, [ebp + 0x30]
            //   e8????????           |                     
            //   4989c4               | jns                 0x6b1
            //   4885c0               | dec                 eax
            //   74db                 | lea                 ebx, [ebp + 0x20]
            //   4889c7               | test                eax, eax

        $sequence_5 = { e8???????? 4c89f7 4989c5 e8???????? 488d4b02 4c89e2 4c89ff }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4c89f7               | test                esi, esi
            //   4989c5               | je                  0xa0b
            //   e8????????           |                     
            //   488d4b02             | dec                 eax
            //   4c89e2               | lea                 edx, [eax + 0x18]
            //   4c89ff               | dec                 ecx

        $sequence_6 = { e8???????? 4c8b442410 4c8b4c2418 4885c0 7434 4989d9 4889c2 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4c8b442410           | dec                 eax
            //   4c8b4c2418           | sub                 esp, 0xd8
            //   4885c0               | mov                 dword ptr [esp + 8], 0x18
            //   7434                 | dec                 eax
            //   4989d9               | mov                 dword ptr [esp + 0x10], eax
            //   4889c2               | dec                 eax

        $sequence_7 = { c5fe7f6f20 4983e820 0f821efcffff c5fe7f7740 4983e820 0f820ffcffff c5fe7f7f60 }
            // n = 7, score = 100
            //   c5fe7f6f20           | dec                 eax
            //   4983e820             | mov                 ebp, edi
            //   0f821efcffff         | dec                 eax
            //   c5fe7f7740           | mov                 ebx, esi
            //   4983e820             | dec                 esp
            //   0f820ffcffff         | lea                 esp, [esp + 0x10]
            //   c5fe7f7f60           | inc                 ebp

        $sequence_8 = { 89c7 83f8ff 743c b802000000 ba10000000 4889e6 66890424 }
            // n = 7, score = 100
            //   89c7                 | cmp                 edi, eax
            //   83f8ff               | jbe                 0xfffffdbc
            //   743c                 | dec                 ecx
            //   b802000000           | sub                 edi, eax
            //   ba10000000           | dec                 eax
            //   4889e6               | lea                 edx, [esp + 0x40]
            //   66890424             | test                eax, eax

        $sequence_9 = { eb0c 488d5001 49895508 440fb638 488b9dc0f9ffff 4963c7 488b5368 }
            // n = 7, score = 100
            //   eb0c                 | inc                 ecx
            //   488d5001             | cmp                 esp, -0xe
            //   49895508             | je                  0x1001
            //   440fb638             | dec                 eax
            //   488b9dc0f9ffff       | mov                 eax, dword ptr [esp + 0x38]
            //   4963c7               | dec                 eax
            //   488b5368             | sub                 eax, dword ptr [0x28]

    condition:
        7 of them and filesize < 3268608
}