rule win_blindingcan_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.blindingcan."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blindingcan"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c745e0d29c1f7b c745e4ef0dfff5 c745e85acd9c1d c745ec36c2f964 c745f0a70d9fae c745f48f2aedf1 c745f8fee389dd }
            // n = 7, score = 300
            //   c745e0d29c1f7b       | mov                 dword ptr [ebp - 0x20], 0x7b1f9cd2
            //   c745e4ef0dfff5       | mov                 dword ptr [ebp - 0x1c], 0xf5ff0def
            //   c745e85acd9c1d       | mov                 dword ptr [ebp - 0x18], 0x1d9ccd5a
            //   c745ec36c2f964       | mov                 dword ptr [ebp - 0x14], 0x64f9c236
            //   c745f0a70d9fae       | mov                 dword ptr [ebp - 0x10], 0xae9f0da7
            //   c745f48f2aedf1       | mov                 dword ptr [ebp - 0xc], 0xf1ed2a8f
            //   c745f8fee389dd       | mov                 dword ptr [ebp - 8], 0xdd89e3fe

        $sequence_1 = { c78560feffff9cab4ad6 c78564feffff67cf2900 c78568feffff02dbaeb5 c7856cfeffffebe25848 c78570feffff94df7544 }
            // n = 5, score = 300
            //   c78560feffff9cab4ad6     | mov    dword ptr [ebp - 0x1a0], 0xd64aab9c
            //   c78564feffff67cf2900     | mov    dword ptr [ebp - 0x19c], 0x29cf67
            //   c78568feffff02dbaeb5     | mov    dword ptr [ebp - 0x198], 0xb5aedb02
            //   c7856cfeffffebe25848     | mov    dword ptr [ebp - 0x194], 0x4858e2eb
            //   c78570feffff94df7544     | mov    dword ptr [ebp - 0x190], 0x4475df94

        $sequence_2 = { c745902cab593c c74594a5337503 c745983e2c2bef c7459c506c3615 c745a07aea9b06 c745a4a603ff93 }
            // n = 6, score = 300
            //   c745902cab593c       | mov                 dword ptr [ebp - 0x70], 0x3c59ab2c
            //   c74594a5337503       | mov                 dword ptr [ebp - 0x6c], 0x37533a5
            //   c745983e2c2bef       | mov                 dword ptr [ebp - 0x68], 0xef2b2c3e
            //   c7459c506c3615       | mov                 dword ptr [ebp - 0x64], 0x15366c50
            //   c745a07aea9b06       | mov                 dword ptr [ebp - 0x60], 0x69bea7a
            //   c745a4a603ff93       | mov                 dword ptr [ebp - 0x5c], 0x93ff03a6

        $sequence_3 = { c785ccfcffffff6fc2bb c785d0fcffff54cdf11d c785d4fcffff53c2aa64 c785d8fcffffd30dedae c785dcfcffff955ef1b3 c785e0fcfffff682fbb9 }
            // n = 6, score = 300
            //   c785ccfcffffff6fc2bb     | mov    dword ptr [ebp - 0x334], 0xbbc26fff
            //   c785d0fcffff54cdf11d     | mov    dword ptr [ebp - 0x330], 0x1df1cd54
            //   c785d4fcffff53c2aa64     | mov    dword ptr [ebp - 0x32c], 0x64aac253
            //   c785d8fcffffd30dedae     | mov    dword ptr [ebp - 0x328], 0xaeed0dd3
            //   c785dcfcffff955ef1b3     | mov    dword ptr [ebp - 0x324], 0xb3f15e95
            //   c785e0fcfffff682fbb9     | mov    dword ptr [ebp - 0x320], 0xb9fb82f6

        $sequence_4 = { 56 57 8bf1 6a2e }
            // n = 4, score = 300
            //   56                   | push                esi
            //   57                   | push                edi
            //   8bf1                 | mov                 esi, ecx
            //   6a2e                 | push                0x2e

        $sequence_5 = { c74598f6e3e7dd c7459c52b86f28 c745a0b5c9a315 c745a453e8ba52 c745a8b67dbc8f }
            // n = 5, score = 300
            //   c74598f6e3e7dd       | mov                 dword ptr [ebp - 0x68], 0xdde7e3f6
            //   c7459c52b86f28       | mov                 dword ptr [ebp - 0x64], 0x286fb852
            //   c745a0b5c9a315       | mov                 dword ptr [ebp - 0x60], 0x15a3c9b5
            //   c745a453e8ba52       | mov                 dword ptr [ebp - 0x5c], 0x52bae853
            //   c745a8b67dbc8f       | mov                 dword ptr [ebp - 0x58], 0x8fbc7db6

        $sequence_6 = { c785f0fcffffb219e08f c785f4fcffff7939d39d c785f8fcffffe25fcedf c785fcfcfffff15112b2 c78500fdffffc2840aa6 }
            // n = 5, score = 300
            //   c785f0fcffffb219e08f     | mov    dword ptr [ebp - 0x310], 0x8fe019b2
            //   c785f4fcffff7939d39d     | mov    dword ptr [ebp - 0x30c], 0x9dd33979
            //   c785f8fcffffe25fcedf     | mov    dword ptr [ebp - 0x308], 0xdfce5fe2
            //   c785fcfcfffff15112b2     | mov    dword ptr [ebp - 0x304], 0xb21251f1
            //   c78500fdffffc2840aa6     | mov    dword ptr [ebp - 0x300], 0xa60a84c2

        $sequence_7 = { c785bcfdffff661fcba8 c785c0fdffffc0f0d181 c785c4fdffff1f08c3d4 c785c8fdffff28edbc6a c785ccfdffff12aff210 c785d0fdffff860f38a4 c785d4fdffffb5d65e3e }
            // n = 7, score = 300
            //   c785bcfdffff661fcba8     | mov    dword ptr [ebp - 0x244], 0xa8cb1f66
            //   c785c0fdffffc0f0d181     | mov    dword ptr [ebp - 0x240], 0x81d1f0c0
            //   c785c4fdffff1f08c3d4     | mov    dword ptr [ebp - 0x23c], 0xd4c3081f
            //   c785c8fdffff28edbc6a     | mov    dword ptr [ebp - 0x238], 0x6abced28
            //   c785ccfdffff12aff210     | mov    dword ptr [ebp - 0x234], 0x10f2af12
            //   c785d0fdffff860f38a4     | mov    dword ptr [ebp - 0x230], 0xa4380f86
            //   c785d4fdffffb5d65e3e     | mov    dword ptr [ebp - 0x22c], 0x3e5ed6b5

        $sequence_8 = { f7fe 8bca e8???????? 85c0 7409 e8???????? }
            // n = 6, score = 200
            //   f7fe                 | idiv                esi
            //   8bca                 | mov                 ecx, edx
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   7409                 | je                  0xb
            //   e8????????           |                     

        $sequence_9 = { 410fb70411 6685c0 740c 668902 4883c202 4d2bc5 75de }
            // n = 7, score = 100
            //   410fb70411           | mov                 esi, edx
            //   6685c0               | xor                 edx, edx
            //   740c                 | dec                 ebp
            //   668902               | test                esp, esp
            //   4883c202             | je                  0xb
            //   4d2bc5               | dec                 ecx
            //   75de                 | mov                 ecx, esp

        $sequence_10 = { 897c2420 ff15???????? 48894308 4885c0 7507 33c0 e9???????? }
            // n = 7, score = 100
            //   897c2420             | dec                 eax
            //   ff15????????         |                     
            //   48894308             | and                 dword ptr [edx], 0
            //   4885c0               | dec                 eax
            //   7507                 | and                 dword ptr [esp + 0x40], 0
            //   33c0                 | dec                 eax
            //   e9????????           |                     

        $sequence_11 = { 488b05???????? 4833c4 48898590010000 48832200 488364244000 488bf2 33d2 }
            // n = 7, score = 100
            //   488b05????????       |                     
            //   4833c4               | xor                 ecx, ecx
            //   48898590010000       | dec                 esp
            //   48832200             | mov                 dword ptr [esp + 0x28], esp
            //   488364244000         | dec                 esp
            //   488bf2               | lea                 eax, [0xffffeb79]
            //   33d2                 | inc                 esp

        $sequence_12 = { 4d85e4 7409 498bcc ff15???????? 8bc3 488b8d80010000 4833cc }
            // n = 7, score = 100
            //   4d85e4               | mov                 dword ptr [esp + 0x20], esp
            //   7409                 | je                  0x67
            //   498bcc               | dec                 eax
            //   ff15????????         |                     
            //   8bc3                 | xor                 eax, esp
            //   488b8d80010000       | dec                 eax
            //   4833cc               | mov                 dword ptr [ebp + 0x190], eax

        $sequence_13 = { 4c8d45c0 4183c9ff 8bc8 488d85c0010000 33d2 89742428 4889442420 }
            // n = 7, score = 100
            //   4c8d45c0             | xor                 eax, eax
            //   4183c9ff             | dec                 esp
            //   8bc8                 | lea                 eax, [ebp - 0x40]
            //   488d85c0010000       | inc                 ecx
            //   33d2                 | or                  ecx, 0xffffffff
            //   89742428             | mov                 ecx, eax
            //   4889442420           | dec                 eax

        $sequence_14 = { 33c9 443925???????? 4c89642428 4c8d0579ebffff 4489642420 7459 ff15???????? }
            // n = 7, score = 100
            //   33c9                 | lea                 eax, [ebp + 0x1c0]
            //   443925????????       |                     
            //   4c89642428           | xor                 edx, edx
            //   4c8d0579ebffff       | mov                 dword ptr [esp + 0x28], esi
            //   4489642420           | dec                 eax
            //   7459                 | mov                 dword ptr [esp + 0x20], eax
            //   ff15????????         |                     

        $sequence_15 = { ff15???????? 488bcf 8bd8 ff15???????? 8bc3 eb02 33c0 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   488bcf               | dec                 eax
            //   8bd8                 | mov                 ecx, edi
            //   ff15????????         |                     
            //   8bc3                 | mov                 ebx, eax
            //   eb02                 | mov                 eax, ebx
            //   33c0                 | jmp                 4

    condition:
        7 of them and filesize < 363520
}

rule win_blindingcan_w0 {
   meta:
       author = "CISA Code & Media Analysis"
       incident = "10135536"
       date = "2018-05-04"
       actor = "Lazarus Group"
       actor_type = "APT"
       category = "malware"
       family = "BLINDINGCAN"
       description = "Detects 32bit HiddenCobra BLINDINGCAN Trojan RAT"
       hash = "1ee75106a9113b116c54e7a5954950065b809e0bb4dd0a91dc76f778508c7954"
       hash = "7dce6f30e974ed97a3ed024d4c62350f9396310603e185a753b63a1f9a2d5799"
       hash = "96721e13bae587c75618566111675dec2d61f9f5d16e173e69bb42ad7cb2dd8a"
       hash = "f71d67659baf0569143874d5d1c5a4d655c7d296b2e86be1b8f931c2335c0cd3"
       source = "https://us-cert.cisa.gov/ncas/analysis-reports/ar20-232a"
       malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.blindingcan"
       malpedia_version = "20200901"
       malpedia_sharing = "TLP:WHITE"
       malpedia_license = ""
   strings:
       $s0 = { C7 45 EC 0D 06 09 2A C7 45 F0 86 48 86 F7 C7 45 F4 0D 01 01 01 C7 45 F8 05 00 03 82 }
       $s1 = { 50 4D 53 2A 2E 74 6D 70 }
       $s2 = { 79 67 60 3C 77 F9 BA 77 7A 56 1B 68 51 26 11 96 B7 98 71 39 82 B0 81 78 }
   condition:
       any of them
}