rule elf_blackcat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects elf.blackcat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/elf.blackcat"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0f0b 0f0b 90 90 90 }
            // n = 5, score = 200
            //   0f0b                 | mov                 byte ptr [esp + 0xd], al
            //   0f0b                 | mov                 eax, ebp
            //   90                   | shr                 eax, 6
            //   90                   | and                 al, 0x3f
            //   90                   | or                  al, 0x80

        $sequence_1 = { 83e13f 09f1 09d1 81f9???????? }
            // n = 4, score = 200
            //   83e13f               | je                  0x4be
            //   09f1                 | and                 eax, 0xfffffff0
            //   09d1                 | add                 ecx, eax
            //   81f9????????         |                     

        $sequence_2 = { f20f5cc3 f20f59c1 f20f58c3 f20f5dc2 }
            // n = 4, score = 200
            //   f20f5cc3             | movsd               qword ptr [esp + 0x60], xmm4
            //   f20f59c1             | addsd               xmm2, xmm4
            //   f20f58c3             | movd                xmm4, eax
            //   f20f5dc2             | lea                 eax, [edi + 0x10]

        $sequence_3 = { 89c1 c1e902 69d1???????? c1ea11 6bca64 }
            // n = 5, score = 200
            //   89c1                 | mov                 ebx, edx
            //   c1e902               | imul                ebp, eax
            //   69d1????????         |                     
            //   c1ea11               | mul                 edi
            //   6bca64               | add                 edx, ebp

        $sequence_4 = { 660f70c900 660f6fd1 660f74d0 660fd7ea 660f6fd0 }
            // n = 5, score = 200
            //   660f70c900           | or                  edi, esi
            //   660f6fd1             | test                eax, 0xc000000
            //   660f74d0             | movd                esi, xmm1
            //   660fd7ea             | jne                 0x434
            //   660f6fd0             | pshufd              xmm1, xmm0, 0x55

        $sequence_5 = { 660f2ec1 0fb6db 0f43dd 80fbff }
            // n = 4, score = 200
            //   660f2ec1             | test                dh, dh
            //   0fb6db               | jne                 0x126
            //   0f43dd               | jae                 0x145
            //   80fbff               | inc                 eax

        $sequence_6 = { d1e9 01d1 c1e902 8d14cd00000000 29ca }
            // n = 5, score = 200
            //   d1e9                 | mov                 edx, dword ptr [ebx + 0x26c]
            //   01d1                 | lea                 ecx, [ebx - 0x3348]
            //   c1e902               | lea                 edi, [ebx - 0x38884]
            //   8d14cd00000000       | mov                 dword ptr [esp + 0x1fc], 0
            //   29ca                 | mov                 dword ptr [esp + 0x200], edx

        $sequence_7 = { 09f2 c1e206 83e03f 09d0 3d???????? }
            // n = 5, score = 200
            //   09f2                 | je                  0x75
            //   c1e206               | dec                 eax
            //   83e03f               | add                 edx, 4
            //   09d0                 | or                  edi, ebp
            //   3d????????           |                     

        $sequence_8 = { 5b c3 e8???????? 89c2 }
            // n = 4, score = 200
            //   5b                   | mov                 esi, ecx
            //   c3                   | xchg                byte ptr [ecx + 0x54], al
            //   e8????????           |                     
            //   89c2                 | pop                 ebx

        $sequence_9 = { e9???????? b8???????? eb59 b8???????? eb52 b8???????? eb4b }
            // n = 7, score = 200
            //   e9????????           |                     
            //   b8????????           |                     
            //   eb59                 | mov                 byte ptr [esp + 0x1c], 1
            //   b8????????           |                     
            //   eb52                 | mov                 dword ptr [esp + 0xf4], 0
            //   b8????????           |                     
            //   eb4b                 | lea                 ecx, [ebx - 0x3a3a7]

    condition:
        7 of them and filesize < 8011776
}