rule win_bravonc_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.bravonc."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bravonc"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7e62 eb03 8b45f8 2b45f4 3b4628 7f55 8b4d0c }
            // n = 7, score = 100
            //   7e62                 | jle                 0x64
            //   eb03                 | jmp                 5
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   2b45f4               | sub                 eax, dword ptr [ebp - 0xc]
            //   3b4628               | cmp                 eax, dword ptr [esi + 0x28]
            //   7f55                 | jg                  0x57
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]

        $sequence_1 = { 3b5d0c 7c92 5f 5e }
            // n = 4, score = 100
            //   3b5d0c               | cmp                 ebx, dword ptr [ebp + 0xc]
            //   7c92                 | jl                  0xffffff94
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_2 = { 8d8568ffffff 6a14 50 8d857cffffff 50 e8???????? }
            // n = 6, score = 100
            //   8d8568ffffff         | lea                 eax, [ebp - 0x98]
            //   6a14                 | push                0x14
            //   50                   | push                eax
            //   8d857cffffff         | lea                 eax, [ebp - 0x84]
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_3 = { 0bca 8b96c0000000 034a30 034df0 8d9c01dcbc1b8f 895df0 e8???????? }
            // n = 7, score = 100
            //   0bca                 | or                  ecx, edx
            //   8b96c0000000         | mov                 edx, dword ptr [esi + 0xc0]
            //   034a30               | add                 ecx, dword ptr [edx + 0x30]
            //   034df0               | add                 ecx, dword ptr [ebp - 0x10]
            //   8d9c01dcbc1b8f       | lea                 ebx, [ecx + eax - 0x70e44324]
            //   895df0               | mov                 dword ptr [ebp - 0x10], ebx
            //   e8????????           |                     

        $sequence_4 = { 894634 e9???????? c70609000000 c74718a8e24000 eb91 837df4fd eb4c }
            // n = 7, score = 100
            //   894634               | mov                 dword ptr [esi + 0x34], eax
            //   e9????????           |                     
            //   c70609000000         | mov                 dword ptr [esi], 9
            //   c74718a8e24000       | mov                 dword ptr [edi + 0x18], 0x40e2a8
            //   eb91                 | jmp                 0xffffff93
            //   837df4fd             | cmp                 dword ptr [ebp - 0xc], -3
            //   eb4c                 | jmp                 0x4e

        $sequence_5 = { 8d4dcc e8???????? 83c8ff 8b4df4 5f 5e 5b }
            // n = 7, score = 100
            //   8d4dcc               | lea                 ecx, [ebp - 0x34]
            //   e8????????           |                     
            //   83c8ff               | or                  eax, 0xffffffff
            //   8b4df4               | mov                 ecx, dword ptr [ebp - 0xc]
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   5b                   | pop                 ebx

        $sequence_6 = { ff15???????? 59 8bf0 ff15???????? 03f0 ff15???????? 03f0 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   59                   | pop                 ecx
            //   8bf0                 | mov                 esi, eax
            //   ff15????????         |                     
            //   03f0                 | add                 esi, eax
            //   ff15????????         |                     
            //   03f0                 | add                 esi, eax

        $sequence_7 = { c7461890e34000 eb1a 83f8fd 7509 }
            // n = 4, score = 100
            //   c7461890e34000       | mov                 dword ptr [esi + 0x18], 0x40e390
            //   eb1a                 | jmp                 0x1c
            //   83f8fd               | cmp                 eax, -3
            //   7509                 | jne                 0xb

        $sequence_8 = { 59 0f8cb8000000 8d450b 6a01 50 8d8d98efffff 885d0b }
            // n = 7, score = 100
            //   59                   | pop                 ecx
            //   0f8cb8000000         | jl                  0xbe
            //   8d450b               | lea                 eax, [ebp + 0xb]
            //   6a01                 | push                1
            //   50                   | push                eax
            //   8d8d98efffff         | lea                 ecx, [ebp - 0x1068]
            //   885d0b               | mov                 byte ptr [ebp + 0xb], bl

        $sequence_9 = { 5b 8d4de0 53 57 e8???????? }
            // n = 5, score = 100
            //   5b                   | pop                 ebx
            //   8d4de0               | lea                 ecx, [ebp - 0x20]
            //   53                   | push                ebx
            //   57                   | push                edi
            //   e8????????           |                     

    condition:
        7 of them and filesize < 131072
}