rule win_bbsrat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.bbsrat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bbsrat"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 898e44020000 899648020000 57 894308 894304 8903 ff15???????? }
            // n = 7, score = 100
            //   898e44020000         | mov                 dword ptr [esi + 0x244], ecx
            //   899648020000         | mov                 dword ptr [esi + 0x248], edx
            //   57                   | push                edi
            //   894308               | mov                 dword ptr [ebx + 8], eax
            //   894304               | mov                 dword ptr [ebx + 4], eax
            //   8903                 | mov                 dword ptr [ebx], eax
            //   ff15????????         |                     

        $sequence_1 = { 83c414 c20400 83ec1c a1???????? 33c4 89442418 8b442420 }
            // n = 7, score = 100
            //   83c414               | add                 esp, 0x14
            //   c20400               | ret                 4
            //   83ec1c               | sub                 esp, 0x1c
            //   a1????????           |                     
            //   33c4                 | xor                 eax, esp
            //   89442418             | mov                 dword ptr [esp + 0x18], eax
            //   8b442420             | mov                 eax, dword ptr [esp + 0x20]

        $sequence_2 = { 6800000080 50 ffd5 8bf0 83feff 7508 5e }
            // n = 7, score = 100
            //   6800000080           | push                0x80000000
            //   50                   | push                eax
            //   ffd5                 | call                ebp
            //   8bf0                 | mov                 esi, eax
            //   83feff               | cmp                 esi, -1
            //   7508                 | jne                 0xa
            //   5e                   | pop                 esi

        $sequence_3 = { 0fb70f 6685c9 741e 66890a 83c202 83c702 }
            // n = 6, score = 100
            //   0fb70f               | movzx               ecx, word ptr [edi]
            //   6685c9               | test                cx, cx
            //   741e                 | je                  0x20
            //   66890a               | mov                 word ptr [edx], cx
            //   83c202               | add                 edx, 2
            //   83c702               | add                 edi, 2

        $sequence_4 = { e8???????? 8b460c 8b7e10 2bf8 c1ff04 83c408 47 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8b460c               | mov                 eax, dword ptr [esi + 0xc]
            //   8b7e10               | mov                 edi, dword ptr [esi + 0x10]
            //   2bf8                 | sub                 edi, eax
            //   c1ff04               | sar                 edi, 4
            //   83c408               | add                 esp, 8
            //   47                   | inc                 edi

        $sequence_5 = { 8944245c 897c2458 e8???????? 83c414 8bf8 }
            // n = 5, score = 100
            //   8944245c             | mov                 dword ptr [esp + 0x5c], eax
            //   897c2458             | mov                 dword ptr [esp + 0x58], edi
            //   e8????????           |                     
            //   83c414               | add                 esp, 0x14
            //   8bf8                 | mov                 edi, eax

        $sequence_6 = { 0f873c0c0000 ff2485a0ed0010 8b742418 83fd03 733c 8b442414 8b7c2410 }
            // n = 7, score = 100
            //   0f873c0c0000         | ja                  0xc42
            //   ff2485a0ed0010       | jmp                 dword ptr [eax*4 + 0x1000eda0]
            //   8b742418             | mov                 esi, dword ptr [esp + 0x18]
            //   83fd03               | cmp                 ebp, 3
            //   733c                 | jae                 0x3e
            //   8b442414             | mov                 eax, dword ptr [esp + 0x14]
            //   8b7c2410             | mov                 edi, dword ptr [esp + 0x10]

        $sequence_7 = { 33ff 391e 7e2d 8d6e04 8d4900 8b4d00 8b542414 }
            // n = 7, score = 100
            //   33ff                 | xor                 edi, edi
            //   391e                 | cmp                 dword ptr [esi], ebx
            //   7e2d                 | jle                 0x2f
            //   8d6e04               | lea                 ebp, [esi + 4]
            //   8d4900               | lea                 ecx, [ecx]
            //   8b4d00               | mov                 ecx, dword ptr [ebp]
            //   8b542414             | mov                 edx, dword ptr [esp + 0x14]

        $sequence_8 = { e9???????? c70009000000 c74718e4b10210 eb4c 8b442424 895e1c 894620 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   c70009000000         | mov                 dword ptr [eax], 9
            //   c74718e4b10210       | mov                 dword ptr [edi + 0x18], 0x1002b1e4
            //   eb4c                 | jmp                 0x4e
            //   8b442424             | mov                 eax, dword ptr [esp + 0x24]
            //   895e1c               | mov                 dword ptr [esi + 0x1c], ebx
            //   894620               | mov                 dword ptr [esi + 0x20], eax

        $sequence_9 = { e8???????? 89ae8c000000 896e40 8b4644 }
            // n = 4, score = 100
            //   e8????????           |                     
            //   89ae8c000000         | mov                 dword ptr [esi + 0x8c], ebp
            //   896e40               | mov                 dword ptr [esi + 0x40], ebp
            //   8b4644               | mov                 eax, dword ptr [esi + 0x44]

    condition:
        7 of them and filesize < 434176
}