rule win_agent_btz_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.agent_btz."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d4c240c 51 ffd6 8d54240c 52 }
            // n = 5, score = 2400
            //   8d4c240c             | lea                 ecx, [esp + 0xc]
            //   51                   | push                ecx
            //   ffd6                 | call                esi
            //   8d54240c             | lea                 edx, [esp + 0xc]
            //   52                   | push                edx

        $sequence_1 = { c74608ffffffff f644240801 7409 56 e8???????? 83c404 }
            // n = 6, score = 2400
            //   c74608ffffffff       | mov                 dword ptr [esi + 8], 0xffffffff
            //   f644240801           | test                byte ptr [esp + 8], 1
            //   7409                 | je                  0xb
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c404               | add                 esp, 4

        $sequence_2 = { ffd3 85c0 75d8 5f }
            // n = 4, score = 2400
            //   ffd3                 | call                ebx
            //   85c0                 | test                eax, eax
            //   75d8                 | jne                 0xffffffda
            //   5f                   | pop                 edi

        $sequence_3 = { b805000f00 8b4df4 64890d00000000 5f 5e 5b 8be5 }
            // n = 7, score = 2300
            //   b805000f00           | mov                 eax, 0xf0005
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx
            //   8be5                 | mov                 esp, ebp

        $sequence_4 = { ff15???????? b800000f00 8b4df4 64890d00000000 }
            // n = 4, score = 2300
            //   ff15????????         |                     
            //   b800000f00           | mov                 eax, 0xf0000
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   64890d00000000       | mov                 dword ptr fs:[0], ecx

        $sequence_5 = { c706???????? c7460c00000000 895e08 895e04 c7461000000000 895e14 }
            // n = 6, score = 2300
            //   c706????????         |                     
            //   c7460c00000000       | mov                 dword ptr [esi + 0xc], 0
            //   895e08               | mov                 dword ptr [esi + 8], ebx
            //   895e04               | mov                 dword ptr [esi + 4], ebx
            //   c7461000000000       | mov                 dword ptr [esi + 0x10], 0
            //   895e14               | mov                 dword ptr [esi + 0x14], ebx

        $sequence_6 = { 56 6a00 68???????? 8935???????? e8???????? }
            // n = 5, score = 2200
            //   56                   | push                esi
            //   6a00                 | push                0
            //   68????????           |                     
            //   8935????????         |                     
            //   e8????????           |                     

        $sequence_7 = { 6a00 50 ff15???????? 894614 }
            // n = 4, score = 2200
            //   6a00                 | push                0
            //   50                   | push                eax
            //   ff15????????         |                     
            //   894614               | mov                 dword ptr [esi + 0x14], eax

        $sequence_8 = { 8bf1 8b4608 c706???????? 85c0 7413 83f8ff }
            // n = 6, score = 2100
            //   8bf1                 | mov                 esi, ecx
            //   8b4608               | mov                 eax, dword ptr [esi + 8]
            //   c706????????         |                     
            //   85c0                 | test                eax, eax
            //   7413                 | je                  0x15
            //   83f8ff               | cmp                 eax, -1

        $sequence_9 = { 740e 50 ff15???????? c74608ffffffff f644240801 }
            // n = 5, score = 2100
            //   740e                 | je                  0x10
            //   50                   | push                eax
            //   ff15????????         |                     
            //   c74608ffffffff       | mov                 dword ptr [esi + 8], 0xffffffff
            //   f644240801           | test                byte ptr [esp + 8], 1

        $sequence_10 = { 8d542408 52 c744240c30000000 c744241003000000 }
            // n = 4, score = 2100
            //   8d542408             | lea                 edx, [esp + 8]
            //   52                   | push                edx
            //   c744240c30000000     | mov                 dword ptr [esp + 0xc], 0x30
            //   c744241003000000     | mov                 dword ptr [esp + 0x10], 3

        $sequence_11 = { 6801010000 ff15???????? 85c0 7415 }
            // n = 4, score = 1800
            //   6801010000           | push                0x101
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   7415                 | je                  0x17

        $sequence_12 = { 6a0a 68???????? 6a01 6a00 }
            // n = 4, score = 1400
            //   6a0a                 | push                0xa
            //   68????????           |                     
            //   6a01                 | push                1
            //   6a00                 | push                0

        $sequence_13 = { 51 6a00 6819000200 6a00 68???????? }
            // n = 5, score = 1400
            //   51                   | push                ecx
            //   6a00                 | push                0
            //   6819000200           | push                0x20019
            //   6a00                 | push                0
            //   68????????           |                     

        $sequence_14 = { 6a01 6a04 6a01 68???????? }
            // n = 4, score = 1100
            //   6a01                 | push                1
            //   6a04                 | push                4
            //   6a01                 | push                1
            //   68????????           |                     

        $sequence_15 = { 50 68???????? 6a01 68???????? e8???????? 83c410 }
            // n = 6, score = 1100
            //   50                   | push                eax
            //   68????????           |                     
            //   6a01                 | push                1
            //   68????????           |                     
            //   e8????????           |                     
            //   83c410               | add                 esp, 0x10

        $sequence_16 = { 6a01 68???????? e8???????? 83c414 5f 5e }
            // n = 6, score = 1000
            //   6a01                 | push                1
            //   68????????           |                     
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_17 = { 50 e8???????? 83c408 6800010000 e8???????? }
            // n = 5, score = 1000
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c408               | add                 esp, 8
            //   6800010000           | push                0x100
            //   e8????????           |                     

        $sequence_18 = { 7511 e8???????? 83c020 50 }
            // n = 4, score = 900
            //   7511                 | jne                 0x13
            //   e8????????           |                     
            //   83c020               | add                 eax, 0x20
            //   50                   | push                eax

        $sequence_19 = { 6a01 e8???????? 50 e8???????? 83c41c }
            // n = 5, score = 900
            //   6a01                 | push                1
            //   e8????????           |                     
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c41c               | add                 esp, 0x1c

        $sequence_20 = { 89461c 3dea000000 740b 3de5030000 }
            // n = 4, score = 900
            //   89461c               | sub                 esp, 0x40
            //   3dea000000           | dec                 eax
            //   740b                 | mov                 eax, dword ptr [ecx + 0x38]
            //   3de5030000           | inc                 ecx

        $sequence_21 = { 0fb605???????? 66890d???????? 0fb60d???????? 660fafca 6603c8 }
            // n = 5, score = 900
            //   0fb605????????       |                     
            //   66890d????????       |                     
            //   0fb60d????????       |                     
            //   660fafca             | imul                cx, dx
            //   6603c8               | add                 cx, ax

        $sequence_22 = { 83c020 50 e8???????? 83c404 33c0 }
            // n = 5, score = 900
            //   83c020               | add                 eax, 0x20
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   33c0                 | xor                 eax, eax

        $sequence_23 = { 037dfc 8b4508 83c414 837df800 8938 }
            // n = 5, score = 800
            //   037dfc               | push                esi
            //   8b4508               | inc                 ecx
            //   83c414               | push                edi
            //   837df800             | dec                 eax
            //   8938                 | sub                 esp, 0x40

        $sequence_24 = { 59 6a25 58 6a30 668945f2 58 6a38 }
            // n = 7, score = 800
            //   59                   | xor                 ebp, ebp
            //   6a25                 | dec                 eax
            //   58                   | mov                 edi, ecx
            //   6a30                 | dec                 ecx
            //   668945f2             | mov                 esi, eax
            //   58                   | dec                 eax
            //   6a38                 | mov                 dword ptr [ecx + 8], eax

        $sequence_25 = { c78424a000000068000000 c78424dc00000001000000 33c0 66898424e0000000 }
            // n = 4, score = 800
            //   c78424a000000068000000     | mov    dword ptr [esp + 0xa0], 0x68
            //   c78424dc00000001000000     | mov    dword ptr [esp + 0xdc], 1
            //   33c0                 | xor                 eax, eax
            //   66898424e0000000     | mov                 word ptr [esp + 0xe0], ax

        $sequence_26 = { c684248c00000074 c684248d00000065 c684248e00000050 c684248f00000072 }
            // n = 4, score = 800
            //   c684248c00000074     | mov                 byte ptr [esp + 0x8c], 0x74
            //   c684248d00000065     | mov                 byte ptr [esp + 0x8d], 0x65
            //   c684248e00000050     | mov                 byte ptr [esp + 0x8e], 0x50
            //   c684248f00000072     | mov                 byte ptr [esp + 0x8f], 0x72

        $sequence_27 = { 8b4624 6888130000 ff7618 897dfc }
            // n = 4, score = 800
            //   8b4624               | dec                 eax
            //   6888130000           | mov                 ecx, dword ptr [edi]
            //   ff7618               | dec                 eax
            //   897dfc               | mov                 eax, dword ptr [ecx + 8]

        $sequence_28 = { c684249400000073 c684249500000057 c684249600000000 c684241001000047 c684241101000065 c684241201000074 }
            // n = 6, score = 800
            //   c684249400000073     | mov                 byte ptr [esp + 0x94], 0x73
            //   c684249500000057     | mov                 byte ptr [esp + 0x95], 0x57
            //   c684249600000000     | mov                 byte ptr [esp + 0x96], 0
            //   c684241001000047     | mov                 byte ptr [esp + 0x110], 0x47
            //   c684241101000065     | mov                 byte ptr [esp + 0x111], 0x65
            //   c684241201000074     | mov                 byte ptr [esp + 0x112], 0x74

        $sequence_29 = { 6a00 6a27 6a02 6a00 6a01 }
            // n = 5, score = 800
            //   6a00                 | push                0
            //   6a27                 | push                0x27
            //   6a02                 | push                2
            //   6a00                 | push                0
            //   6a01                 | push                1

        $sequence_30 = { 740d 3cff 7409 f6d0 }
            // n = 4, score = 800
            //   740d                 | je                  0xf
            //   3cff                 | cmp                 al, 0xff
            //   7409                 | je                  0xb
            //   f6d0                 | not                 al

        $sequence_31 = { c684249100000063 c684249200000065 c684249300000073 c684249400000073 c684249500000057 }
            // n = 5, score = 800
            //   c684249100000063     | mov                 byte ptr [esp + 0x91], 0x63
            //   c684249200000065     | mov                 byte ptr [esp + 0x92], 0x65
            //   c684249300000073     | mov                 byte ptr [esp + 0x93], 0x73
            //   c684249400000073     | mov                 byte ptr [esp + 0x94], 0x73
            //   c684249500000057     | mov                 byte ptr [esp + 0x95], 0x57

        $sequence_32 = { 8d4df8 51 8d8df8f7ffff 51 57 }
            // n = 5, score = 800
            //   8d4df8               | dec                 eax
            //   51                   | mov                 eax, dword ptr [ecx + 0x38]
            //   8d8df8f7ffff         | inc                 ecx
            //   51                   | push                esp
            //   57                   | inc                 ecx

        $sequence_33 = { 8b5d0c 56 8bf0 8b4624 57 }
            // n = 5, score = 800
            //   8b5d0c               | dec                 eax
            //   56                   | mov                 edi, ecx
            //   8bf0                 | dec                 ecx
            //   8b4624               | mov                 esi, eax
            //   57                   | dec                 eax

        $sequence_34 = { 33c9 ff542458 85c0 7420 }
            // n = 4, score = 800
            //   33c9                 | xor                 ecx, ecx
            //   ff542458             | call                dword ptr [esp + 0x58]
            //   85c0                 | test                eax, eax
            //   7420                 | je                  0x22

        $sequence_35 = { 66894dea 59 6a65 668945f0 66894dec }
            // n = 5, score = 800
            //   66894dea             | dec                 eax
            //   59                   | mov                 eax, dword ptr [ecx + 8]
            //   6a65                 | dec                 eax
            //   668945f0             | mov                 dword ptr [ecx + 0x28], eax
            //   66894dec             | dec                 eax

        $sequence_36 = { ff9574ffffff 8b4de0 89410c 33c0 8be5 5d c20400 }
            // n = 7, score = 800
            //   ff9574ffffff         | call                dword ptr [ebp - 0x8c]
            //   8b4de0               | mov                 ecx, dword ptr [ebp - 0x20]
            //   89410c               | mov                 dword ptr [ecx + 0xc], eax
            //   33c0                 | xor                 eax, eax
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp
            //   c20400               | ret                 4

        $sequence_37 = { 8bf1 33db 895e10 895e0c }
            // n = 4, score = 800
            //   8bf1                 | push                edi
            //   33db                 | dec                 eax
            //   895e10               | sub                 esp, 0x40
            //   895e0c               | dec                 eax

        $sequence_38 = { c645d316 c645d43a c645d53b c645d63b c645d730 c645d836 }
            // n = 6, score = 700
            //   c645d316             | mov                 byte ptr [ebp - 0x2d], 0x16
            //   c645d43a             | mov                 byte ptr [ebp - 0x2c], 0x3a
            //   c645d53b             | mov                 byte ptr [ebp - 0x2b], 0x3b
            //   c645d63b             | mov                 byte ptr [ebp - 0x2a], 0x3b
            //   c645d730             | mov                 byte ptr [ebp - 0x29], 0x30
            //   c645d836             | mov                 byte ptr [ebp - 0x28], 0x36

        $sequence_39 = { 8d8505feffff 50 e8???????? 83c40c }
            // n = 4, score = 700
            //   8d8505feffff         | lea                 eax, [ebp - 0x1fb]
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_40 = { 488b4338 33d2 488bce 448d4220 }
            // n = 4, score = 500
            //   488b4338             | dec                 eax
            //   33d2                 | mov                 eax, dword ptr [ebx + 0x38]
            //   488bce               | xor                 edx, edx
            //   448d4220             | dec                 eax

        $sequence_41 = { 488b0f 48894108 488b0f 488b4108 }
            // n = 4, score = 400
            //   488b0f               | dec                 eax
            //   48894108             | mov                 dword ptr [ecx + 0x28], eax
            //   488b0f               | dec                 eax
            //   488b4108             | mov                 ecx, dword ptr [edi]

        $sequence_42 = { 488b5738 488bce 8bd8 ff92e8010000 }
            // n = 4, score = 400
            //   488b5738             | mov                 esi, eax
            //   488bce               | mov                 eax, dword ptr [esi + 0x24]
            //   8bd8                 | push                edi
            //   ff92e8010000         | add                 ebx, 4

        $sequence_43 = { 488bd6 ff90c8010000 8bf8 85c0 }
            // n = 4, score = 400
            //   488bd6               | pop                 ecx
            //   ff90c8010000         | push                0x25
            //   8bf8                 | pop                 eax
            //   85c0                 | push                0x30

        $sequence_44 = { 488b0f 894130 eb06 488b07 }
            // n = 4, score = 400
            //   488b0f               | mov                 ecx, dword ptr [edi]
            //   894130               | dec                 eax
            //   eb06                 | mov                 eax, dword ptr [ecx + 8]
            //   488b07               | dec                 eax

        $sequence_45 = { 488bcf c744242088130000 e8???????? 488b5738 }
            // n = 4, score = 400
            //   488bcf               | mov                 ecx, edi
            //   c744242088130000     | mov                 ebx, eax
            //   e8????????           |                     
            //   488b5738             | mov                 dword ptr [esi + 0x1c], eax

        $sequence_46 = { 488b0f 488901 488b07 488338ff }
            // n = 4, score = 400
            //   488b0f               | mov                 dword ptr [ecx + 0x28], eax
            //   488901               | dec                 eax
            //   488b07               | mov                 ecx, dword ptr [edi]
            //   488338ff             | dec                 eax

        $sequence_47 = { 488b0f 488b4108 48894128 488b0f }
            // n = 4, score = 400
            //   488b0f               | mov                 ecx, esi
            //   488b4108             | inc                 esp
            //   48894128             | lea                 eax, [edx + 0x20]
            //   488b0f               | dec                 eax

        $sequence_48 = { 83c904 c1e803 448bc9 440fafc8 }
            // n = 4, score = 400
            //   83c904               | mov                 eax, dword ptr [ebp + 8]
            //   c1e803               | add                 esp, 0x14
            //   448bc9               | cmp                 dword ptr [ebp - 8], 0
            //   440fafc8             | mov                 dword ptr [eax], edi

        $sequence_49 = { 4155 4156 4157 4883ec40 488b4138 }
            // n = 5, score = 400
            //   4155                 | cmp                 dword ptr [ecx + 0x28], ebp
            //   4156                 | dec                 eax
            //   4157                 | mov                 ecx, dword ptr [edi]
            //   4883ec40             | dec                 eax
            //   488b4138             | mov                 dword ptr [ecx + 8], eax

        $sequence_50 = { 488b4b38 ff5160 894330 3dea000000 }
            // n = 4, score = 400
            //   488b4b38             | mov                 word ptr [ebp - 0xe], ax
            //   ff5160               | pop                 eax
            //   894330               | push                0x38
            //   3dea000000           | push                0x30

        $sequence_51 = { 4883ec40 33ed 488bf9 498bf0 }
            // n = 4, score = 400
            //   4883ec40             | dec                 eax
            //   33ed                 | mov                 dword ptr [ecx + 0x28], eax
            //   488bf9               | dec                 eax
            //   498bf0               | mov                 ecx, dword ptr [edi]

        $sequence_52 = { 488b0e 48894628 488b4638 4c8d4c2450 448bc3 488bd7 }
            // n = 6, score = 400
            //   488b0e               | mov                 eax, dword ptr [edi]
            //   48894628             | mov                 dword ptr [eax + 0x30], ebp
            //   488b4638             | xor                 eax, eax
            //   4c8d4c2450           | dec                 eax
            //   448bc3               | mov                 ebx, dword ptr [esp + 0x58]
            //   488bd7               | dec                 eax

        $sequence_53 = { 488b07 896830 33c0 488b5c2458 488b6c2460 }
            // n = 5, score = 400
            //   488b07               | mov                 dword ptr [ecx + 0x28], eax
            //   896830               | dec                 eax
            //   33c0                 | mov                 ecx, dword ptr [edi]
            //   488b5c2458           | dec                 eax
            //   488b6c2460           | mov                 ecx, dword ptr [edi]

        $sequence_54 = { 488b4638 488b0e 4c8d442450 4533c9 }
            // n = 4, score = 400
            //   488b4638             | dec                 eax
            //   488b0e               | mov                 eax, dword ptr [edi]
            //   4c8d442450           | mov                 dword ptr [eax + 0x30], ebp
            //   4533c9               | xor                 eax, eax

        $sequence_55 = { 8d8594faffff 50 68???????? ff15???????? }
            // n = 4, score = 300
            //   8d8594faffff         | lea                 eax, [ebp - 0x56c]
            //   50                   | push                eax
            //   68????????           |                     
            //   ff15????????         |                     

        $sequence_56 = { 0304b5100b4200 59 eb05 b8???????? 8a4004 2482 }
            // n = 6, score = 200
            //   0304b5100b4200       | add                 eax, dword ptr [esi*4 + 0x420b10]
            //   59                   | pop                 ecx
            //   eb05                 | jmp                 7
            //   b8????????           |                     
            //   8a4004               | mov                 al, byte ptr [eax + 4]
            //   2482                 | and                 al, 0x82

        $sequence_57 = { 8b7c2420 8d442410 ff7708 56 }
            // n = 4, score = 200
            //   8b7c2420             | mov                 edi, dword ptr [esp + 0x20]
            //   8d442410             | lea                 eax, [esp + 0x10]
            //   ff7708               | push                dword ptr [edi + 8]
            //   56                   | push                esi

        $sequence_58 = { 4e 42 0fb606 80b890fc410000 74e9 8b5ddc }
            // n = 6, score = 200
            //   4e                   | dec                 esi
            //   42                   | inc                 edx
            //   0fb606               | movzx               eax, byte ptr [esi]
            //   80b890fc410000       | cmp                 byte ptr [eax + 0x41fc90], 0
            //   74e9                 | je                  0xffffffeb
            //   8b5ddc               | mov                 ebx, dword ptr [ebp - 0x24]

        $sequence_59 = { 53 ff15???????? 85c0 7413 8d85f0fdffff 50 68???????? }
            // n = 7, score = 200
            //   53                   | push                ebx
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   7413                 | je                  0x15
            //   8d85f0fdffff         | lea                 eax, [ebp - 0x210]
            //   50                   | push                eax
            //   68????????           |                     

        $sequence_60 = { eb2f ff742430 ff742430 53 53 ff742430 }
            // n = 6, score = 200
            //   eb2f                 | jmp                 0x31
            //   ff742430             | push                dword ptr [esp + 0x30]
            //   ff742430             | push                dword ptr [esp + 0x30]
            //   53                   | push                ebx
            //   53                   | push                ebx
            //   ff742430             | push                dword ptr [esp + 0x30]

        $sequence_61 = { 8b7e08 8b6c2430 81e7ffffff7f 85ed 7471 }
            // n = 5, score = 200
            //   8b7e08               | mov                 edi, dword ptr [esi + 8]
            //   8b6c2430             | mov                 ebp, dword ptr [esp + 0x30]
            //   81e7ffffff7f         | and                 edi, 0x7fffffff
            //   85ed                 | test                ebp, ebp
            //   7471                 | je                  0x73

        $sequence_62 = { 8b3d???????? 83c41c 33f6 0fb6442e60 }
            // n = 4, score = 200
            //   8b3d????????         |                     
            //   83c41c               | add                 esp, 0x1c
            //   33f6                 | xor                 esi, esi
            //   0fb6442e60           | movzx               eax, byte ptr [esi + ebp + 0x60]

    condition:
        7 of them and filesize < 5577728
}

rule win_agent_btz_w0 {
    meta:
        author = "Symantec"
        source = "https://www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/waterbug-attack-group.pdf"
        contribution = "pnx - removed FPs"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.agent_btz"
        malpedia_version = "20171113"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $b = {C645????}
        $c = {C685??FEFFFF??}
        $d = {FFA0??0?0000}
        $e = {89A8??00000068??00000056FFD78B}
        $f = {00004889????030000488B}
        $tmp_fn = "FA.tmp"
    condition:
        ((#c > 200 and #b > 200 ) or (#d > 40) and (#e > 15 or #f > 30)) and $tmp_fn
}