rule win_abcsync_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.abcsync."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.abcsync"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c74424204d5d6a6e c74424245c776e4e c744242877756379 c644242cfb e8???????? 488b0d???????? 488bd0 }
            // n = 7, score = 100
            //   c74424204d5d6a6e     | add                 edx, eax
            //   c74424245c776e4e     | imul                eax, edx, 0x32
            //   c744242877756379     | inc                 ecx
            //   c644242cfb           | mov                 ecx, eax
            //   e8????????           |                     
            //   488b0d????????       |                     
            //   488bd0               | dec                 ebp

        $sequence_1 = { 2bc8 8d411f 4898 420fb60c18 410fb7441a3c }
            // n = 5, score = 100
            //   2bc8                 | dec                 eax
            //   8d411f               | mov                 ecx, edx
            //   4898                 | dec                 ecx
            //   420fb60c18           | mov                 edx, esp
            //   410fb7441a3c         | je                  0xf06

        $sequence_2 = { 498bc2 418be9 48c1f806 488d0d88e10000 4183e23f 4903e8 498bf0 }
            // n = 7, score = 100
            //   498bc2               | lea                 eax, [esp + 0x68]
            //   418be9               | je                  0x29c
            //   48c1f806             | dec                 esp
            //   488d0d88e10000       | lea                 ecx, [esp + 0x34]
            //   4183e23f             | mov                 edx, 0xffff
            //   4903e8               | mov                 dword ptr [esp + 0x34], 0x989680
            //   498bf0               | inc                 ecx

        $sequence_3 = { 660f6f05???????? 488d4c2420 f30f7f442420 66c7442430805a c644243201 e8???????? 488b0d???????? }
            // n = 7, score = 100
            //   660f6f05????????     |                     
            //   488d4c2420           | ja                  0x5e7
            //   f30f7f442420         | mov                 eax, dword ptr [esp + 0x68]
            //   66c7442430805a       | dec                 ecx
            //   c644243201           | mov                 edx, edi
            //   e8????????           |                     
            //   488b0d????????       |                     

        $sequence_4 = { 488bd9 ff15???????? ba08000000 488bc8 448d4209 }
            // n = 5, score = 100
            //   488bd9               | lea                 eax, [ecx + 0xa]
            //   ff15????????         |                     
            //   ba08000000           | dec                 eax
            //   488bc8               | cwde                
            //   448d4209             | inc                 edx

        $sequence_5 = { 488d0593db0000 4a8b0ce8 42385cf938 7d4d 8bce }
            // n = 5, score = 100
            //   488d0593db0000       | dec                 eax
            //   4a8b0ce8             | cwde                
            //   42385cf938           | inc                 edx
            //   7d4d                 | sub                 cl, byte ptr [eax + ebx]
            //   8bce                 | sub                 ecx, eax

        $sequence_6 = { c744242877756379 c644242cfb e8???????? 488b0d???????? 488bd0 ff15???????? }
            // n = 6, score = 100
            //   c744242877756379     | inc                 ecx
            //   c644242cfb           | lea                 ecx, [ecx + 3]
            //   e8????????           |                     
            //   488b0d????????       |                     
            //   488bd0               | inc                 cx
            //   ff15????????         |                     

        $sequence_7 = { 4533c0 0f114dff 48894507 488bd7 488b05???????? }
            // n = 5, score = 100
            //   4533c0               | mov                 dword ptr [esp + 0x38], 0x7963616b
            //   0f114dff             | mov                 byte ptr [esp + 0x3c], 0xff
            //   48894507             | mov                 dword ptr [esp + 0x34], 0x5b65496c
            //   488bd7               | mov                 byte ptr [esp + 0x38], 2
            //   488b05????????       |                     

        $sequence_8 = { 410fb64c1a06 4898 422a0c18 b81f85eb51 41884a06 418d4908 f7e9 }
            // n = 7, score = 100
            //   410fb64c1a06         | je                  0x11e1
            //   4898                 | je                  0x11e8
            //   422a0c18             | mov                 ecx, 0xea60
            //   b81f85eb51           | dec                 eax
            //   41884a06             | cmp                 ecx, -1
            //   418d4908             | je                  0x11ee
            //   f7e9                 | dec                 eax

        $sequence_9 = { 422a0c18 b81f85eb51 41884afc 418d4913 f7e9 418bc9 c1fa04 }
            // n = 7, score = 100
            //   422a0c18             | mov                 dword ptr [esp + 0x40], eax
            //   b81f85eb51           | inc                 ebp
            //   41884afc             | mov                 eax, esi
            //   418d4913             | mov                 eax, dword ptr [esp + 0x68]
            //   f7e9                 | dec                 eax
            //   418bc9               | lea                 eax, [esp + 0x70]
            //   c1fa04               | dec                 eax

    condition:
        7 of them and filesize < 348160
}