rule win_artfulpie_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artfulpie"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 50 8b471c ffd0 8bf0 }
            // n = 4, score = 100
            //   50                   | push                eax
            //   8b471c               | mov                 eax, dword ptr [edi + 0x1c]
            //   ffd0                 | call                eax
            //   8bf0                 | mov                 esi, eax

        $sequence_1 = { f2c3 8b4de4 33cd f2e84459ffff }
            // n = 4, score = 100
            //   f2c3                 | bnd ret             
            //   8b4de4               | mov                 ecx, dword ptr [ebp - 0x1c]
            //   33cd                 | xor                 ecx, ebp
            //   f2e84459ffff         | bnd call            0xffff594a

        $sequence_2 = { 8b7838 85ff 7e64 8b46fc 6a04 6800100000 }
            // n = 6, score = 100
            //   8b7838               | mov                 edi, dword ptr [eax + 0x38]
            //   85ff                 | test                edi, edi
            //   7e64                 | jle                 0x66
            //   8b46fc               | mov                 eax, dword ptr [esi - 4]
            //   6a04                 | push                4
            //   6800100000           | push                0x1000

        $sequence_3 = { ff15???????? 8b4dd8 8d51ff 8d59ff f7d2 035f50 8d41ff }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   8b4dd8               | mov                 ecx, dword ptr [ebp - 0x28]
            //   8d51ff               | lea                 edx, [ecx - 1]
            //   8d59ff               | lea                 ebx, [ecx - 1]
            //   f7d2                 | not                 edx
            //   035f50               | add                 ebx, dword ptr [edi + 0x50]
            //   8d41ff               | lea                 eax, [ecx - 1]

        $sequence_4 = { 0f1f440000 8b5104 8b01 85d2 7505 034738 eb02 }
            // n = 7, score = 100
            //   0f1f440000           | nop                 dword ptr [eax + eax]
            //   8b5104               | mov                 edx, dword ptr [ecx + 4]
            //   8b01                 | mov                 eax, dword ptr [ecx]
            //   85d2                 | test                edx, edx
            //   7505                 | jne                 7
            //   034738               | add                 eax, dword ptr [edi + 0x38]
            //   eb02                 | jmp                 4

        $sequence_5 = { 6bc930 53 8b5d10 8b0485984e4100 56 }
            // n = 5, score = 100
            //   6bc930               | imul                ecx, ecx, 0x30
            //   53                   | push                ebx
            //   8b5d10               | mov                 ebx, dword ptr [ebp + 0x10]
            //   8b0485984e4100       | mov                 eax, dword ptr [eax*4 + 0x414e98]
            //   56                   | push                esi

        $sequence_6 = { 8b34cdf00e4100 8b4d08 6a5a 2bce 5b 0fb70431 663bc7 }
            // n = 7, score = 100
            //   8b34cdf00e4100       | mov                 esi, dword ptr [ecx*8 + 0x410ef0]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   6a5a                 | push                0x5a
            //   2bce                 | sub                 ecx, esi
            //   5b                   | pop                 ebx
            //   0fb70431             | movzx               eax, word ptr [ecx + esi]
            //   663bc7               | cmp                 ax, di

        $sequence_7 = { 8b04bd984e4100 ff743018 ff15???????? 85c0 }
            // n = 4, score = 100
            //   8b04bd984e4100       | mov                 eax, dword ptr [edi*4 + 0x414e98]
            //   ff743018             | push                dword ptr [eax + esi + 0x18]
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax

        $sequence_8 = { 660f2815???????? f20f59db 660f282d???????? 660f59f5 660f28aa101f4100 660f54e5 660f58fe }
            // n = 7, score = 100
            //   660f2815????????     |                     
            //   f20f59db             | mulsd               xmm3, xmm3
            //   660f282d????????     |                     
            //   660f59f5             | mulpd               xmm6, xmm5
            //   660f28aa101f4100     | movapd              xmm5, xmmword ptr [edx + 0x411f10]
            //   660f54e5             | andpd               xmm4, xmm5
            //   660f58fe             | addpd               xmm7, xmm6

        $sequence_9 = { 8b413c 03c7 8b7dfc 8903 56 }
            // n = 5, score = 100
            //   8b413c               | mov                 eax, dword ptr [ecx + 0x3c]
            //   03c7                 | add                 eax, edi
            //   8b7dfc               | mov                 edi, dword ptr [ebp - 4]
            //   8903                 | mov                 dword ptr [ebx], eax
            //   56                   | push                esi

    condition:
        7 of them and filesize < 204800
}

rule win_artfulpie_w0 {
   meta:
      description = "Detects APT38 ARTFULPIE"
      author = "Emanuele De Lucia"
	  tlp = "white"
	  malfamily = "ARTFULPIE"
      actor = "Lazarus Group"
      actor_type = "APT"
	  malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.artfulpie"
	  malpedia_version = "20200227"
	  malpedia_license = "CC BY-NC-SA 4.0"
	  malpedia_sharing = "TLP:WHITE"
   strings:
      $a = "PPPh @A" fullword ascii
      $b = "3>3D3M3X3h3" fullword ascii
	  $c = "2`2d2h2p8t8x8|8" fullword ascii
	  $d = {C7 43 (1C|20) (60|70) 1E 40 00}
   condition:
      filesize < 200KB and 
	  uint16(0) == 0x5a4d and 
	  all of them
}