rule win_blacklotus_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.blacklotus."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blacklotus"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 40383c08 7406 4080ffcc 750a ffc2 49ffc3 413bd0 }
            // n = 7, score = 100
            //   40383c08             | mov                 edx, ebx
            //   7406                 | dec                 eax
            //   4080ffcc             | mov                 dword ptr [esp + 0x20], edi
            //   750a                 | mov                 cl, 1
            //   ffc2                 | inc                 ebp
            //   49ffc3               | xor                 ecx, ecx
            //   413bd0               | dec                 eax

        $sequence_1 = { 2bc7 ffc8 0fb71443 6683fa7f 7604 6683ea60 }
            // n = 6, score = 100
            //   2bc7                 | or                  edx, 0xffffffff
            //   ffc8                 | inc                 ebp
            //   0fb71443             | xor                 ecx, ecx
            //   6683fa7f             | inc                 ebp
            //   7604                 | xor                 eax, eax
            //   6683ea60             | lea                 ecx, [edx + 3]

        $sequence_2 = { e8???????? b20d 408ace 8ad8 e8???????? b20b }
            // n = 6, score = 100
            //   e8????????           |                     
            //   b20d                 | movzx               ebx, byte ptr [eax + edx]
            //   408ace               | lea                 eax, [edx + 3]
            //   8ad8                 | inc                 edx
            //   e8????????           |                     
            //   b20b                 | movzx               edi, byte ptr [eax + edx]

        $sequence_3 = { 48897820 4863413c 4533c9 488bea 458bd1 8b740850 }
            // n = 6, score = 100
            //   48897820             | jb                  0x1ce4
            //   4863413c             | inc                 esp
            //   4533c9               | mov                 eax, eax
            //   488bea               | xor                 edx, edx
            //   458bd1               | dec                 ecx
            //   8b740850             | mov                 ecx, ecx

        $sequence_4 = { 75f2 4d8bc6 488d542430 488d4d30 e8???????? 492bfe }
            // n = 6, score = 100
            //   75f2                 | mov                 dword ptr [ebp - 0x54], 0xd2f3ff10
            //   4d8bc6               | mov                 dword ptr [ebp - 0x50], 0xec130ccd
            //   488d542430           | mov                 dword ptr [ebp - 0x4c], 0x1744975f
            //   488d4d30             | mov                 dword ptr [ebp - 0x59], 0x5048706c
            //   e8????????           |                     
            //   492bfe               | mov                 dword ptr [ebp - 0x55], 0xdab9edfd

        $sequence_5 = { 4d85c0 744d 458bd1 410fb64002 410fb65003 48c1e208 }
            // n = 6, score = 100
            //   4d85c0               | dec                 eax
            //   744d                 | test                eax, eax
            //   458bd1               | js                  0xebe
            //   410fb64002           | lea                 eax, [ecx - 0x60]
            //   410fb65003           | movzx               edx, al
            //   48c1e208             | dec                 eax

        $sequence_6 = { b209 408ace 8ad8 e8???????? b20d }
            // n = 5, score = 100
            //   b209                 | jae                 0xb55
            //   408ace               | inc                 ebp
            //   8ad8                 | movzx               eax, cx
            //   e8????????           |                     
            //   b20d                 | inc                 edx

        $sequence_7 = { 4c8d4c2440 4c8bc0 488d0de6340000 e8???????? 85c0 }
            // n = 5, score = 100
            //   4c8d4c2440           | inc                 ecx
            //   4c8bc0               | sub                 eax, edx
            //   488d0de6340000       | inc                 ecx
            //   e8????????           |                     
            //   85c0                 | inc                 edx

        $sequence_8 = { 480fbfc6 488d3d41100100 b9e8030000 8935???????? }
            // n = 4, score = 100
            //   480fbfc6             | lea                 eax, [ecx + 2]
            //   488d3d41100100       | inc                 edx
            //   b9e8030000           | mov                 byte ptr [eax + edx], bl
            //   8935????????         |                     

        $sequence_9 = { 48897010 48897818 4c897020 55 488d68c8 4881ec30010000 4c8bd1 }
            // n = 7, score = 100
            //   48897010             | jb                  0x1dd1
            //   48897818             | inc                 ebp
            //   4c897020             | test                eax, eax
            //   55                   | je                  0x1cc7
            //   488d68c8             | dec                 eax
            //   4881ec30010000       | mov                 ebx, ecx
            //   4c8bd1               | dec                 eax

    condition:
        7 of them and filesize < 181248
}