rule win_akira_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.akira."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.akira"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb0f 48890f 8b45c7 894710 8b456f 894714 33c0 }
            // n = 7, score = 200
            //   eb0f                 | dec                 eax
            //   48890f               | mov                 ecx, dword ptr [edi]
            //   8b45c7               | test                al, al
            //   894710               | jne                 0x1ca9
            //   8b456f               | movzx               ecx, byte ptr [edi + 8]
            //   894714               | test                cl, cl
            //   33c0                 | jne                 0x1c0b

        $sequence_1 = { c3 4055 4883ec20 488bea b818010000 48038520010000 48898598000000 }
            // n = 7, score = 200
            //   c3                   | mov                 byte ptr [ebp + eax + 0x63], cl
            //   4055                 | dec                 ecx
            //   4883ec20             | inc                 eax
            //   488bea               | dec                 ecx
            //   b818010000           | cmp                 eax, 0xa
            //   48038520010000       | shr                 eax, 0x1f
            //   48898598000000       | add                 edx, eax

        $sequence_2 = { 4156 4883ec20 65488b042558000000 488bf9 b904000000 bd01000000 896a30 }
            // n = 7, score = 200
            //   4156                 | dec                 eax
            //   4883ec20             | lea                 ecx, [ebp + 0x820]
            //   65488b042558000000     | inc    eax
            //   488bf9               | push                ebp
            //   b904000000           | dec                 eax
            //   bd01000000           | sub                 esp, 0x20
            //   896a30               | dec                 eax

        $sequence_3 = { e9???????? 488d8a60120000 e9???????? 488d8a80120000 e9???????? 488d8aa0120000 e9???????? }
            // n = 7, score = 200
            //   e9????????           |                     
            //   488d8a60120000       | lea                 edx, [edi + 0x178]
            //   e9????????           |                     
            //   488d8a80120000       | dec                 esp
            //   e9????????           |                     
            //   488d8aa0120000       | lea                 eax, [edi + 0x168]
            //   e9????????           |                     

        $sequence_4 = { 8bc1 660f1f440000 48833cc200 7426 ffc1 48ffc0 4883f806 }
            // n = 7, score = 200
            //   8bc1                 | mov                 eax, dword ptr [edx + ecx]
            //   660f1f440000         | jle                 0x8a
            //   48833cc200           | dec                 eax
            //   7426                 | lea                 ecx, [0x8bd1d]
            //   ffc1                 | jne                 0x7e
            //   48ffc0               | mov                 eax, dword ptr [edx + ecx]
            //   4883f806             | jle                 0x98

        $sequence_5 = { ff5020 88442430 0f57c0 0f11459f 48c745af01000000 41bf0f000000 4c897db7 }
            // n = 7, score = 200
            //   ff5020               | dec                 eax
            //   88442430             | lea                 ecx, [edx + 0x1760]
            //   0f57c0               | dec                 eax
            //   0f11459f             | lea                 ecx, [edx + 0x1820]
            //   48c745af01000000     | dec                 eax
            //   41bf0f000000         | lea                 ecx, [edx + 0x1840]
            //   4c897db7             | dec                 eax

        $sequence_6 = { 4533c0 488bd7 488d4dcf e8???????? 90 4c8d4dcf }
            // n = 6, score = 200
            //   4533c0               | jne                 0x12cf
            //   488bd7               | dec                 eax
            //   488d4dcf             | mov                 eax, dword ptr [ebx]
            //   e8????????           |                     
            //   90                   | dec                 eax
            //   4c8d4dcf             | inc                 ecx

        $sequence_7 = { ffd2 90 488d55c7 488bce e8???????? 4533f6 4c3975e7 }
            // n = 7, score = 200
            //   ffd2                 | lea                 ecx, [esp + 2]
            //   90                   | dec                 eax
            //   488d55c7             | cmp                 ecx, edi
            //   488bce               | ja                  0x108
            //   e8????????           |                     
            //   4533f6               | inc                 ecx
            //   4c3975e7             | cmp                 byte ptr [esp + ebx], 0x30

        $sequence_8 = { 75ab 0f2845bf 488b4d5f 0f1101 4c8d75cf 48837de710 }
            // n = 6, score = 200
            //   75ab                 | nop                 word ptr [eax + eax]
            //   0f2845bf             | inc                 edx
            //   488b4d5f             | movzx               ecx, byte ptr [ebp + eax + 0x339]
            //   0f1101               | mov                 eax, 0x1b
            //   4c8d75cf             | jne                 0x41e
            //   48837de710           | dec                 esp

        $sequence_9 = { e8???????? 8b0d???????? ff15???????? 4885c0 7423 488b4808 }
            // n = 6, score = 200
            //   e8????????           |                     
            //   8b0d????????         |                     
            //   ff15????????         |                     
            //   4885c0               | mov                 ecx, eax
            //   7423                 | nop                 
            //   488b4808             | dec                 eax

    condition:
        7 of them and filesize < 1286144
}