rule win_bootwreck_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.bootwreck."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bootwreck"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b4514 55 59 8d8a873e2720 f7d1 8b4d10 8d642424 }
            // n = 7, score = 100
            //   8b4514               | mov                 eax, dword ptr [ebp + 0x14]
            //   55                   | push                ebp
            //   59                   | pop                 ecx
            //   8d8a873e2720         | lea                 ecx, [edx + 0x20273e87]
            //   f7d1                 | not                 ecx
            //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
            //   8d642424             | lea                 esp, [esp + 0x24]

        $sequence_1 = { 8d642434 e9???????? 66894500 ff3424 9c 6689742404 8d642450 }
            // n = 7, score = 100
            //   8d642434             | lea                 esp, [esp + 0x34]
            //   e9????????           |                     
            //   66894500             | mov                 word ptr [ebp], ax
            //   ff3424               | push                dword ptr [esp]
            //   9c                   | pushfd              
            //   6689742404           | mov                 word ptr [esp + 4], si
            //   8d642450             | lea                 esp, [esp + 0x50]

        $sequence_2 = { a3???????? c705????????400f7c00 890d???????? 52 e8???????? c20800 56 }
            // n = 7, score = 100
            //   a3????????           |                     
            //   c705????????400f7c00     |     
            //   890d????????         |                     
            //   52                   | push                edx
            //   e8????????           |                     
            //   c20800               | ret                 8
            //   56                   | push                esi

        $sequence_3 = { 216eed 2ccc fd 3c2a 1a88971ebba9 c520 ba8400e73e }
            // n = 7, score = 100
            //   216eed               | and                 dword ptr [esi - 0x13], ebp
            //   2ccc                 | sub                 al, 0xcc
            //   fd                   | std                 
            //   3c2a                 | cmp                 al, 0x2a
            //   1a88971ebba9         | sbb                 cl, byte ptr [eax - 0x5644e169]
            //   c520                 | lds                 esp, ptr [eax]
            //   ba8400e73e           | mov                 edx, 0x3ee70084

        $sequence_4 = { e8???????? 53 85c0 7516 57 55 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   53                   | push                ebx
            //   85c0                 | test                eax, eax
            //   7516                 | jne                 0x18
            //   57                   | push                edi
            //   55                   | push                ebp
            //   e8????????           |                     

        $sequence_5 = { 70e8 32ff 46 33e2 41 2eb910b0f8ab 828dc6785b1254 }
            // n = 7, score = 100
            //   70e8                 | jo                  0xffffffea
            //   32ff                 | xor                 bh, bh
            //   46                   | inc                 esi
            //   33e2                 | xor                 esp, edx
            //   41                   | inc                 ecx
            //   2eb910b0f8ab         | mov                 ecx, 0xabf8b010
            //   828dc6785b1254       | or                  byte ptr [ebp + 0x125b78c6], 0x54

        $sequence_6 = { 9c 47 c6442408a8 c60424ff f8 f5 }
            // n = 6, score = 100
            //   9c                   | pushfd              
            //   47                   | inc                 edi
            //   c6442408a8           | mov                 byte ptr [esp + 8], 0xa8
            //   c60424ff             | mov                 byte ptr [esp], 0xff
            //   f8                   | clc                 
            //   f5                   | cmc                 

        $sequence_7 = { 663dd741 80fce8 895dfc 68451613af e8???????? 66c7442404f560 8d8666da5fb9 }
            // n = 7, score = 100
            //   663dd741             | cmp                 ax, 0x41d7
            //   80fce8               | cmp                 ah, 0xe8
            //   895dfc               | mov                 dword ptr [ebp - 4], ebx
            //   68451613af           | push                0xaf131645
            //   e8????????           |                     
            //   66c7442404f560       | mov                 word ptr [esp + 4], 0x60f5
            //   8d8666da5fb9         | lea                 eax, [esi - 0x46a0259a]

        $sequence_8 = { 66894c2404 ff742428 c23c00 8b893be64300 e8???????? ff742404 9c }
            // n = 7, score = 100
            //   66894c2404           | mov                 word ptr [esp + 4], cx
            //   ff742428             | push                dword ptr [esp + 0x28]
            //   c23c00               | ret                 0x3c
            //   8b893be64300         | mov                 ecx, dword ptr [ecx + 0x43e63b]
            //   e8????????           |                     
            //   ff742404             | push                dword ptr [esp + 4]
            //   9c                   | pushfd              

        $sequence_9 = { 660fbae601 c60424fa f8 c60424eb 01ca f8 39f2 }
            // n = 7, score = 100
            //   660fbae601           | bt                  si, 1
            //   c60424fa             | mov                 byte ptr [esp], 0xfa
            //   f8                   | clc                 
            //   c60424eb             | mov                 byte ptr [esp], 0xeb
            //   01ca                 | add                 edx, ecx
            //   f8                   | clc                 
            //   39f2                 | cmp                 edx, esi

    condition:
        7 of them and filesize < 10821632
}