rule win_alureon_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.alureon."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.alureon"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b00 83651400 03c2 50 ff7510 e8???????? }
            // n = 6, score = 200
            //   8b00                 | mov                 eax, dword ptr [eax]
            //   83651400             | and                 dword ptr [ebp + 0x14], 0
            //   03c2                 | add                 eax, edx
            //   50                   | push                eax
            //   ff7510               | push                dword ptr [ebp + 0x10]
            //   e8????????           |                     

        $sequence_1 = { 8bec 83ec0c 8b5508 8b423c }
            // n = 4, score = 200
            //   8bec                 | mov                 ebp, esp
            //   83ec0c               | sub                 esp, 0xc
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   8b423c               | mov                 eax, dword ptr [edx + 0x3c]

        $sequence_2 = { 8bf9 81e700f00000 bb00300000 663bfb 750e 8b7df0 }
            // n = 6, score = 200
            //   8bf9                 | mov                 edi, ecx
            //   81e700f00000         | and                 edi, 0xf000
            //   bb00300000           | mov                 ebx, 0x3000
            //   663bfb               | cmp                 di, bx
            //   750e                 | jne                 0x10
            //   8b7df0               | mov                 edi, dword ptr [ebp - 0x10]

        $sequence_3 = { 48 8b09 45 8bc2 44 }
            // n = 5, score = 200
            //   48                   | dec                 eax
            //   8b09                 | mov                 ecx, dword ptr [ecx]
            //   45                   | inc                 ebp
            //   8bc2                 | mov                 eax, edx
            //   44                   | inc                 esp

        $sequence_4 = { 895dec ffd7 85c0 0f888f000000 6a20 8d45b0 50 }
            // n = 7, score = 200
            //   895dec               | mov                 dword ptr [ebp - 0x14], ebx
            //   ffd7                 | call                edi
            //   85c0                 | test                eax, eax
            //   0f888f000000         | js                  0x95
            //   6a20                 | push                0x20
            //   8d45b0               | lea                 eax, [ebp - 0x50]
            //   50                   | push                eax

        $sequence_5 = { 83c0f8 743e 44 8d50ff 41 d1ea }
            // n = 6, score = 200
            //   83c0f8               | add                 eax, -8
            //   743e                 | je                  0x40
            //   44                   | inc                 esp
            //   8d50ff               | lea                 edx, [eax - 1]
            //   41                   | inc                 ecx
            //   d1ea                 | shr                 edx, 1

        $sequence_6 = { 895d14 7439 49 d1e9 }
            // n = 4, score = 200
            //   895d14               | mov                 dword ptr [ebp + 0x14], ebx
            //   7439                 | je                  0x3b
            //   49                   | dec                 ecx
            //   d1e9                 | shr                 ecx, 1

        $sequence_7 = { 41 8d43d8 66894520 8bc1 44 894d2c c1e818 }
            // n = 7, score = 200
            //   41                   | inc                 ecx
            //   8d43d8               | lea                 eax, [ebx - 0x28]
            //   66894520             | mov                 word ptr [ebp + 0x20], ax
            //   8bc1                 | mov                 eax, ecx
            //   44                   | inc                 esp
            //   894d2c               | mov                 dword ptr [ebp + 0x2c], ecx
            //   c1e818               | shr                 eax, 0x18

        $sequence_8 = { 33c0 5f 5e c3 0fb74114 8d440818 0fb74906 }
            // n = 7, score = 100
            //   33c0                 | xor                 eax, eax
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   c3                   | ret                 
            //   0fb74114             | movzx               eax, word ptr [ecx + 0x14]
            //   8d440818             | lea                 eax, [eax + ecx + 0x18]
            //   0fb74906             | movzx               ecx, word ptr [ecx + 6]

        $sequence_9 = { c645cb3c c645cc12 c645cd0e c645ce11 c645cf0c c645d002 c645d111 }
            // n = 7, score = 100
            //   c645cb3c             | mov                 byte ptr [ebp - 0x35], 0x3c
            //   c645cc12             | mov                 byte ptr [ebp - 0x34], 0x12
            //   c645cd0e             | mov                 byte ptr [ebp - 0x33], 0xe
            //   c645ce11             | mov                 byte ptr [ebp - 0x32], 0x11
            //   c645cf0c             | mov                 byte ptr [ebp - 0x31], 0xc
            //   c645d002             | mov                 byte ptr [ebp - 0x30], 2
            //   c645d111             | mov                 byte ptr [ebp - 0x2f], 0x11

        $sequence_10 = { 75f9 ff75b4 8d4dbc 2bc6 8b35???????? 51 }
            // n = 6, score = 100
            //   75f9                 | jne                 0xfffffffb
            //   ff75b4               | push                dword ptr [ebp - 0x4c]
            //   8d4dbc               | lea                 ecx, [ebp - 0x44]
            //   2bc6                 | sub                 eax, esi
            //   8b35????????         |                     
            //   51                   | push                ecx

        $sequence_11 = { 59 8bc8 85c9 7411 8b463c 48 }
            // n = 6, score = 100
            //   59                   | pop                 ecx
            //   8bc8                 | mov                 ecx, eax
            //   85c9                 | test                ecx, ecx
            //   7411                 | je                  0x13
            //   8b463c               | mov                 eax, dword ptr [esi + 0x3c]
            //   48                   | dec                 eax

        $sequence_12 = { 33f6 3974240c 57 89742408 }
            // n = 4, score = 100
            //   33f6                 | xor                 esi, esi
            //   3974240c             | cmp                 dword ptr [esp + 0xc], esi
            //   57                   | push                edi
            //   89742408             | mov                 dword ptr [esp + 8], esi

        $sequence_13 = { 55 8bec 81ec1c040000 53 56 57 be00100000 }
            // n = 7, score = 100
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   81ec1c040000         | sub                 esp, 0x41c
            //   53                   | push                ebx
            //   56                   | push                esi
            //   57                   | push                edi
            //   be00100000           | mov                 esi, 0x1000

        $sequence_14 = { 68???????? ff750c 8d8500ffffff ff7508 32db }
            // n = 5, score = 100
            //   68????????           |                     
            //   ff750c               | push                dword ptr [ebp + 0xc]
            //   8d8500ffffff         | lea                 eax, [ebp - 0x100]
            //   ff7508               | push                dword ptr [ebp + 8]
            //   32db                 | xor                 bl, bl

        $sequence_15 = { 50 53 53 66c74424641000 }
            // n = 4, score = 100
            //   50                   | push                eax
            //   53                   | push                ebx
            //   53                   | push                ebx
            //   66c74424641000       | mov                 word ptr [esp + 0x64], 0x10

    condition:
        7 of them and filesize < 278528
}