rule win_bankshot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.bankshot."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bankshot"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bf8 8d5101 8a01 41 84c0 75f9 57 }
            // n = 7, score = 300
            //   8bf8                 | je                  0x12
            //   8d5101               | push                eax
            //   8a01                 | mov                 eax, dword ptr [ebp + 8]
            //   41                   | fld                 qword ptr [eax]
            //   84c0                 | jmp                 0xffffffca
            //   75f9                 | mov                 dword ptr [ebp - 0x20], 0x1001bae8
            //   57                   | mov                 dword ptr [ebp - 0x20], 0x1001baf0

        $sequence_1 = { 55 8bec 81ec48040000 a1???????? 33c5 8945f8 53 }
            // n = 7, score = 300
            //   55                   | jl                  0x21
            //   8bec                 | cmp                 dword ptr [edi*4 + 0x1001f180], esi
            //   81ec48040000         | jne                 0x3a
            //   a1????????           |                     
            //   33c5                 | mov                 dword ptr [edi*4 + 0x1001f180], eax
            //   8945f8               | mov                 eax, dword ptr [esi + 0x1001f180]
            //   53                   | test                eax, eax

        $sequence_2 = { 8b4508 c700???????? 8b4508 898850030000 8b4508 59 c74048b8e40110 }
            // n = 7, score = 200
            //   8b4508               | jne                 0x17
            //   c700????????         |                     
            //   8b4508               | mov                 eax, dword ptr [ebp - 4]
            //   898850030000         | cmp                 dword ptr [eax + 0x48], 0x1001e4b8
            //   8b4508               | je                  0x17
            //   59                   | mov                 eax, dword ptr [ebp - 4]
            //   c74048b8e40110       | cmp                 dword ptr [eax + 0x48], 0x1001e4b8

        $sequence_3 = { 83c40c 0f57c0 81bde43fffff00200000 0f1185ac3affff 0f831c030000 8d8df03fffff }
            // n = 6, score = 200
            //   83c40c               | movups              xmm0, xmmword ptr [esp + ecx + 0x538]
            //   0f57c0               | movaps              xmm1, xmm2
            //   81bde43fffff00200000     | pxor    xmm0, xmm2
            //   0f1185ac3affff       | push                ecx
            //   0f831c030000         | push                eax
            //   8d8df03fffff         | push                0

        $sequence_4 = { e8???????? 83c40c e8???????? 99 b907000000 f7f9 }
            // n = 6, score = 200
            //   e8????????           |                     
            //   83c40c               | dec                 eax
            //   e8????????           |                     
            //   99                   | mov                 ecx, edi
            //   b907000000           | cmp                 eax, -1
            //   f7f9                 | je                  0x137

        $sequence_5 = { e8???????? 83c40c 6b45e430 8945e0 8d80d0e10110 8945e4 803800 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   83c40c               | push                6
            //   6b45e430             | lea                 edx, [eax + 0x1001e1c4]
            //   8945e0               | pop                 edi
            //   8d80d0e10110         | mov                 ax, word ptr [edx]
            //   8945e4               | lea                 edx, [edx + 2]
            //   803800               | mov                 word ptr [ecx], ax

        $sequence_6 = { 3bca 7d17 66660f1f840000000000 80b40c38050000aa }
            // n = 4, score = 200
            //   3bca                 | mov                 dword ptr [ebp - 8], eax
            //   7d17                 | push                ebx
            //   66660f1f840000000000     | mov    edi, eax
            //   80b40c38050000aa     | lea                 edx, [ecx + 1]

        $sequence_7 = { e8???????? 83c404 89861c020000 8b45e0 8d4e0c 6a06 8d90c4e10110 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   83c404               | mov                 ax, word ptr [edx]
            //   89861c020000         | imul                eax, dword ptr [ebp - 0x1c], 0x30
            //   8b45e0               | mov                 dword ptr [ebp - 0x20], eax
            //   8d4e0c               | lea                 eax, [eax + 0x1001e1d0]
            //   6a06                 | mov                 dword ptr [ebp - 0x1c], eax
            //   8d90c4e10110         | cmp                 byte ptr [eax], 0

        $sequence_8 = { e9???????? 57 33ff 8bcf 8bc7 894de4 3998c0e10110 }
            // n = 7, score = 200
            //   e9????????           |                     
            //   57                   | cmp                 edx, 0x100
            //   33ff                 | jae                 0x20
            //   8bcf                 | mov                 al, byte ptr [edi + 0x1001e1bc]
            //   8bc7                 | cmp                 dword ptr [eax + 0x48], 0x1001e4b8
            //   894de4               | je                  0x12
            //   3998c0e10110         | push                dword ptr [eax + 0x48]

        $sequence_9 = { 68e9fd0000 ff15???????? 8d8de83dffff 8bf0 8d5101 }
            // n = 5, score = 200
            //   68e9fd0000           | mov                 esi, edx
            //   ff15????????         |                     
            //   8d8de83dffff         | sub                 esi, eax
            //   8bf0                 | nop                 dword ptr [eax]
            //   8d5101               | nop                 word ptr [eax + eax]

        $sequence_10 = { 6a00 2bca 8d85e83dffff 51 50 6a00 68e9fd0000 }
            // n = 7, score = 200
            //   6a00                 | mov                 al, byte ptr [ecx]
            //   2bca                 | inc                 ecx
            //   8d85e83dffff         | test                al, al
            //   51                   | jne                 0
            //   50                   | push                edi
            //   6a00                 | sub                 esp, 0x448
            //   68e9fd0000           | xor                 eax, ebp

        $sequence_11 = { 8bf2 2bf0 0f1f4000 660f1f840000000000 0f10840c38050000 0f28ca 660fefc2 }
            // n = 7, score = 200
            //   8bf2                 | push                0
            //   2bf0                 | sub                 ecx, edx
            //   0f1f4000             | lea                 eax, [ebp - 0xc218]
            //   660f1f840000000000     | push    ecx
            //   0f10840c38050000     | push                eax
            //   0f28ca               | push                0
            //   660fefc2             | push                0xfde9

        $sequence_12 = { 817848b8e40110 7409 ff7048 e8???????? 59 c70701000000 }
            // n = 6, score = 200
            //   817848b8e40110       | push                6
            //   7409                 | lea                 edx, [eax + 0x1001e1c4]
            //   ff7048               | pop                 edi
            //   e8????????           |                     
            //   59                   | lea                 edx, [eax + 0x1001e1c4]
            //   c70701000000         | pop                 edi

        $sequence_13 = { c74048b8e40110 8b4508 6689486c 8b4508 66898872010000 8b4508 83a04c03000000 }
            // n = 7, score = 200
            //   c74048b8e40110       | inc                 ecx
            //   8b4508               | add                 eax, 0x30
            //   6689486c             | mov                 dword ptr [ebp - 0x1c], ecx
            //   8b4508               | jmp                 0x19
            //   66898872010000       | cmp                 edx, 0x100
            //   8b4508               | jae                 0x1b
            //   83a04c03000000       | mov                 al, byte ptr [edi + 0x1001e1bc]

        $sequence_14 = { 80b40c38050000aa 41 3bca 7cf3 83fa0c 0f8ca4020000 }
            // n = 6, score = 200
            //   80b40c38050000aa     | mov                 dword ptr [ebp - 8], eax
            //   41                   | push                ebx
            //   3bca                 | cmp                 ecx, edx
            //   7cf3                 | jge                 0x1b
            //   83fa0c               | nop                 word ptr [eax + eax]
            //   0f8ca4020000         | xor                 byte ptr [esp + ecx + 0x538], 0xaa

        $sequence_15 = { 6a00 681f000f00 50 ff5594 8bf0 }
            // n = 5, score = 100
            //   6a00                 | push                ebx
            //   681f000f00           | push                eax
            //   50                   | mov                 eax, dword ptr [ebp - 0x14]
            //   ff5594               | push                dword ptr [eax + 0xc]
            //   8bf0                 | call                dword ptr [ebp - 0x18]

        $sequence_16 = { 83c702 57 e8???????? 83c404 8bd8 53 }
            // n = 6, score = 100
            //   83c702               | push                eax
            //   57                   | mov                 eax, dword ptr [esp + 0x24]
            //   e8????????           |                     
            //   83c404               | push                ecx
            //   8bd8                 | push                1
            //   53                   | lea                 edx, [esp + 0x14]

        $sequence_17 = { 0fbe02 83f82e 743f 83bde8feffff1a }
            // n = 4, score = 100
            //   0fbe02               | mov                 dword ptr [ebp - 0x17], ecx
            //   83f82e               | mov                 dword ptr [ebp - 0x13], ecx
            //   743f                 | mov                 word ptr [ebp - 0xf], cx
            //   83bde8feffff1a       | mov                 byte ptr [ebp - 0xd], cl

        $sequence_18 = { 7c1f 3934bd80f10110 7531 e8???????? 8904bd80f10110 }
            // n = 5, score = 100
            //   7c1f                 | jb                  0xfffffffa
            //   3934bd80f10110       | mov                 eax, dword ptr [ebp + 8]
            //   7531                 | mov                 dword ptr [eax + 0x350], ecx
            //   e8????????           |                     
            //   8904bd80f10110       | mov                 eax, dword ptr [ebp + 8]

        $sequence_19 = { 488bfb f2ae 48f7d1 4803f1 33d2 488bcb }
            // n = 6, score = 100
            //   488bfb               | dec                 esp
            //   f2ae                 | mov                 ebp, ecx
            //   48f7d1               | mov                 edx, 0x403c
            //   4803f1               | mov                 ecx, 0x40
            //   33d2                 | dec                 eax
            //   488bcb               | mov                 edi, ebx

        $sequence_20 = { 8d542404 51 56 50 50 8b84249c000000 }
            // n = 6, score = 100
            //   8d542404             | cdq                 
            //   51                   | mov                 ecx, 7
            //   56                   | idiv                ecx
            //   50                   | mov                 eax, dword ptr [esp + 0x34]
            //   50                   | mov                 ecx, dword ptr [esp + 0x28]
            //   8b84249c000000       | mov                 edx, dword ptr [esp + 0x24]

        $sequence_21 = { 8b8680f10110 85c0 740e 50 e8???????? }
            // n = 5, score = 100
            //   8b8680f10110         | pop                 ecx
            //   85c0                 | mov                 dword ptr [eax + 0x48], 0x1001e4b8
            //   740e                 | mov                 eax, dword ptr [ebp + 8]
            //   50                   | mov                 word ptr [eax + 0x6c], cx
            //   e8????????           |                     

        $sequence_22 = { 7435 51 682e010000 8d85bcfeffff }
            // n = 4, score = 100
            //   7435                 | mov                 edi, eax
            //   51                   | push                0xfde9
            //   682e010000           | call                dword ptr [ebp - 0xda0]
            //   8d85bcfeffff         | mov                 eax, dword ptr [ebp - 0xd9c]

        $sequence_23 = { 8d8dfcf3ffff 51 6a00 ff15???????? 8985ecf3ffff 83bdecf3ffff00 }
            // n = 6, score = 100
            //   8d8dfcf3ffff         | cdq                 
            //   51                   | mov                 ecx, 7
            //   6a00                 | idiv                ecx
            //   ff15????????         |                     
            //   8985ecf3ffff         | add                 esp, 0xc
            //   83bdecf3ffff00       | cdq                 

        $sequence_24 = { c744242001000000 e8???????? 85c0 0f84ca010000 }
            // n = 4, score = 100
            //   c744242001000000     | repne scasb         al, byte ptr es:[edi]
            //   e8????????           |                     
            //   85c0                 | dec                 eax
            //   0f84ca010000         | not                 ecx

        $sequence_25 = { 8b442434 8b4c2428 8b542424 50 8b442424 51 }
            // n = 6, score = 100
            //   8b442434             | cdq                 
            //   8b4c2428             | mov                 ecx, 7
            //   8b542424             | add                 esp, 0xc
            //   50                   | cdq                 
            //   8b442424             | mov                 ecx, 7
            //   51                   | add                 esp, 0xc

        $sequence_26 = { ff15???????? 898588f8ffff c78574f8ffffffffffff c78560f8ffff00000000 c7858cf8ffff00000000 6802040000 }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   898588f8ffff         | cmp                 dword ptr [ebp - 0x678], 0
            //   c78574f8ffffffffffff     | je    0x15
            //   c78560f8ffff00000000     | mov    dword ptr [ebp - 0x680], 0
            //   c7858cf8ffff00000000     | jmp    0x16
            //   6802040000           | mov                 dword ptr [ebp - 0x680], 2

        $sequence_27 = { 89442440 e8???????? 85c0 0f84b9010000 }
            // n = 4, score = 100
            //   89442440             | je                  0x176
            //   e8????????           |                     
            //   85c0                 | mov                 edx, dword ptr [esp + 0x44]
            //   0f84b9010000         | dec                 ecx

        $sequence_28 = { 894de5 894de9 894ded 66894df1 884df3 ff15???????? }
            // n = 6, score = 100
            //   894de5               | mov                 ecx, 7
            //   894de9               | add                 esp, 0xc
            //   894ded               | cdq                 
            //   66894df1             | mov                 ecx, 7
            //   884df3               | add                 esp, 0xc
            //   ff15????????         |                     

        $sequence_29 = { 488bcf ff15???????? 83f8ff 0f842e010000 488d0d0f7f0000 }
            // n = 5, score = 100
            //   488bcf               | mov                 dword ptr [esp + 0x20], 1
            //   ff15????????         |                     
            //   83f8ff               | test                eax, eax
            //   0f842e010000         | je                  0x1d0
            //   488d0d0f7f0000       | test                eax, eax

        $sequence_30 = { 0f8d35040000 8b0d???????? 038dd8fbffff 81e10f000080 7905 }
            // n = 5, score = 100
            //   0f8d35040000         | push                0
            //   8b0d????????         |                     
            //   038dd8fbffff         | mov                 dword ptr [ebp - 0xc14], eax
            //   81e10f000080         | cmp                 dword ptr [ebp - 0xc14], 0
            //   7905                 | mov                 dword ptr [ebp - 0x1b], ecx

        $sequence_31 = { 8b148d40904100 33d0 a1???????? 33d0 33c0 8915???????? }
            // n = 6, score = 100
            //   8b148d40904100       | push                4
            //   33d0                 | mov                 dword ptr [esp + 0x18], eax
            //   a1????????           |                     
            //   33d0                 | lea                 edx, [esp + 4]
            //   33c0                 | push                ecx
            //   8915????????         |                     

        $sequence_32 = { 6a01 8d542414 6a04 89442418 }
            // n = 4, score = 100
            //   6a01                 | cdq                 
            //   8d542414             | mov                 ecx, 7
            //   6a04                 | idiv                ecx
            //   89442418             | add                 esp, 0xc

        $sequence_33 = { 8b4d08 51 0fb7956cd4ffff 83c21a 52 8b4d0c }
            // n = 6, score = 100
            //   8b4d08               | jge                 0x43b
            //   51                   | add                 ecx, dword ptr [ebp - 0x428]
            //   0fb7956cd4ffff       | and                 ecx, 0x8000000f
            //   83c21a               | jns                 0xd
            //   52                   | movsx               eax, byte ptr [edx]
            //   8b4d0c               | cmp                 eax, 0x2e

        $sequence_34 = { 83c414 85c0 7503 83ceff }
            // n = 4, score = 100
            //   83c414               | xor                 edx, eax
            //   85c0                 | xor                 edx, eax
            //   7503                 | xor                 eax, eax
            //   83ceff               | pop                 ebp

        $sequence_35 = { c78564f7ffff082a3b00 8bcb 6808040000 50 e8???????? c78550f7ffff01000000 }
            // n = 6, score = 100
            //   c78564f7ffff082a3b00     | xor    ecx, ecx
            //   8bcb                 | push                0x20000000
            //   6808040000           | push                eax
            //   50                   | mov                 word ptr [ebp + eax*2 - 0xd90], cx
            //   e8????????           |                     
            //   c78550f7ffff01000000     | push    0

        $sequence_36 = { 83bd88f9ffff00 740c c78580f9ffff00000000 eb0a c78580f9ffff02000000 }
            // n = 5, score = 100
            //   83bd88f9ffff00       | cdq                 
            //   740c                 | mov                 ecx, 7
            //   c78580f9ffff00000000     | idiv    ecx
            //   eb0a                 | lea                 ecx, [ebp - 0xc04]
            //   c78580f9ffff02000000     | push    ecx

        $sequence_37 = { 8d83e60e0000 8bca 50 83e103 8d442448 68???????? }
            // n = 6, score = 100
            //   8d83e60e0000         | push                edi
            //   8bca                 | add                 esp, 4
            //   50                   | mov                 ebx, eax
            //   83e103               | push                ebx
            //   8d442448             | mov                 edx, dword ptr [ecx*4 + 0x419040]
            //   68????????           |                     

        $sequence_38 = { 894ddc c745e064410110 e9???????? c745dc03000000 c745e070410110 e9???????? }
            // n = 6, score = 100
            //   894ddc               | inc                 ecx
            //   c745e064410110       | test                al, al
            //   e9????????           |                     
            //   c745dc03000000       | jne                 3
            //   c745e070410110       | push                edi
            //   e9????????           |                     

        $sequence_39 = { 53 50 8b45ec ff700c ff55e8 8bf8 }
            // n = 6, score = 100
            //   53                   | sub                 esp, 0x448
            //   50                   | xor                 eax, ebp
            //   8b45ec               | mov                 dword ptr [ebp - 8], eax
            //   ff700c               | push                ebx
            //   ff55e8               | mov                 ebp, esp
            //   8bf8                 | sub                 esp, 0x448

        $sequence_40 = { 68e9fd0000 ff9560f2ffff 8b8564f2ffff 33c9 6800000020 50 66898c4570f2ffff }
            // n = 7, score = 100
            //   68e9fd0000           | xor                 eax, ebp
            //   ff9560f2ffff         | mov                 dword ptr [ebp - 8], eax
            //   8b8564f2ffff         | push                ebx
            //   33c9                 | mov                 dword ptr [ebp - 0x24], ecx
            //   6800000020           | mov                 dword ptr [ebp - 0x20], 0x10014164
            //   50                   | mov                 dword ptr [ebp - 0x24], 3
            //   66898c4570f2ffff     | mov                 dword ptr [ebp - 0x20], 0x10014170

        $sequence_41 = { 4889842470010000 488bfa 4c8be9 ba3c400000 b940000000 }
            // n = 5, score = 100
            //   4889842470010000     | mov                 dword ptr [esp + 0x20], ebx
            //   488bfa               | dec                 eax
            //   4c8be9               | mov                 dword ptr [esp + 0x170], eax
            //   ba3c400000           | dec                 eax
            //   b940000000           | mov                 edi, edx

        $sequence_42 = { 85c0 0f846e010000 8b542444 498bcc 2bf2 }
            // n = 5, score = 100
            //   85c0                 | dec                 eax
            //   0f846e010000         | add                 esi, ecx
            //   8b542444             | xor                 edx, edx
            //   498bcc               | dec                 eax
            //   2bf2                 | mov                 ecx, ebx

        $sequence_43 = { 8bf8 ff15???????? 81ff10030000 75d6 e8???????? 85c0 740a }
            // n = 7, score = 100
            //   8bf8                 | mov                 edi, eax
            //   ff15????????         |                     
            //   81ff10030000         | cmp                 edi, 0x310
            //   75d6                 | jne                 0xffffffd8
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   740a                 | je                  0xc

        $sequence_44 = { 8b05???????? 488b4c2438 8947ff 895c2420 ff15???????? }
            // n = 5, score = 100
            //   8b05????????         |                     
            //   488b4c2438           | dec                 eax
            //   8947ff               | mov                 ecx, dword ptr [esp + 0x38]
            //   895c2420             | mov                 dword ptr [edi - 1], eax
            //   ff15????????         |                     

    condition:
        7 of them and filesize < 860160
}