rule win_bumblebee_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.bumblebee."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bdd 48895c2458 488b4a08 4885c9 7443 }
            // n = 5, score = 2300
            //   8bdd                 | movzx               ecx, byte ptr [eax + edi*4 + 0x1bf3a2]
            //   48895c2458           | movzx               esi, byte ptr [eax + edi*4 + 0x1bf3a3]
            //   488b4a08             | mov                 ebx, ecx
            //   4885c9               | dec                 eax
            //   7443                 | shl                 ebx, 2

        $sequence_1 = { 33c0 890424 488902 48894208 }
            // n = 4, score = 2300
            //   33c0                 | mov                 dword ptr [esp + 0x130], eax
            //   890424               | je                  0x1f46
            //   488902               | sub                 eax, 0x57381ae9
            //   48894208             | mov                 dword ptr [ebp - 0x144], eax

        $sequence_2 = { 488b4dc8 e8???????? 488b4dc8 49894d00 }
            // n = 4, score = 2300
            //   488b4dc8             | dec                 eax
            //   e8????????           |                     
            //   488b4dc8             | mov                 dword ptr [esp + 0x28], eax
            //   49894d00             | dec                 esp

        $sequence_3 = { e8???????? 4885db 7410 488b4608 }
            // n = 4, score = 2300
            //   e8????????           |                     
            //   4885db               | mov                 eax, dword ptr [ecx + eax*4 + 0x76930]
            //   7410                 | dec                 ecx
            //   488b4608             | add                 eax, ecx

        $sequence_4 = { 48895c2458 488b4a08 4885c9 7443 488b01 488d542450 ff5028 }
            // n = 7, score = 2300
            //   48895c2458           | dec                 eax
            //   488b4a08             | lea                 eax, [0xd3372]
            //   4885c9               | dec                 eax
            //   7443                 | mov                 dword ptr [ebp - 0x20], eax
            //   488b01               | dec                 eax
            //   488d542450           | lea                 eax, [0xd32f7]
            //   ff5028               | dec                 eax

        $sequence_5 = { 85c0 740d 836500fe 488b4d48 }
            // n = 4, score = 2300
            //   85c0                 | mov                 edi, 0xffffffff
            //   740d                 | add                 dword ptr [eax], eax
            //   836500fe             | add                 byte ptr [eax - 0x73], cl
            //   488b4d48             | lea                 esp, [eax + 2]

        $sequence_6 = { 7410 488b4d48 49890e eb0b }
            // n = 4, score = 2300
            //   7410                 | dec                 ecx
            //   488b4d48             | mov                 ecx, esi
            //   49890e               | dec                 esp
            //   eb0b                 | mov                 eax, edi

        $sequence_7 = { 4883ec38 48c7442420feffffff 83c8ff f00fc105???????? 83f801 7507 ff15???????? }
            // n = 7, score = 2300
            //   4883ec38             | mov                 dword ptr [esp + 0x20], 0xfffffffe
            //   48c7442420feffffff     | dec    eax
            //   83c8ff               | mov                 eax, edx
            //   f00fc105????????     |                     
            //   83f801               | dec                 eax
            //   7507                 | mov                 ebx, ecx
            //   ff15????????         |                     

        $sequence_8 = { 483bc1 7706 e8???????? cc 488bc8 e8???????? 488d5827 }
            // n = 7, score = 2300
            //   483bc1               | mov                 ebx, dword ptr [esp + 0x68]
            //   7706                 | dec                 eax
            //   e8????????           |                     
            //   cc                   | mov                 ebp, dword ptr [esp + 0x70]
            //   488bc8               | dec                 eax
            //   e8????????           |                     
            //   488d5827             | mov                 esi, dword ptr [esp + 0x78]

        $sequence_9 = { ff15???????? 33c0 f00fc105???????? 85c0 }
            // n = 4, score = 2300
            //   ff15????????         |                     
            //   33c0                 | je                  0x3e2
            //   f00fc105????????     |                     
            //   85c0                 | dec                 eax

    condition:
        7 of them and filesize < 4825088
}

rule win_bumblebee_w0 {
    meta:
        author = "@AndreGironda"
        description = "BumbleBee / win.bumblebee"
        reference_md5 = "e6a046d1baa7cd2100bdf48102b8a144"
	    date = "March 29, 2022"
	    tlp = "White"

    malpedia_rule_date = "20220330"
    malpedia_hash = ""
	malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.bumblebee"
	malpedia_version = "20220330"
	malpedia_license = "CC BY-NC-SA 4.0"
	malpedia_sharing = "TLP:WHITE"
    strings:
	$hex_140001d53 = { 48 8b 05 06 44 00 00 41 81 ea 06 28 00 00 49 31 80 48 02 00 00 49 8b 80 c8 00 00 00 48 05 28 01 00 00 48 01 41 08 49 8b }
	$hex_18000927a = { 48 8d 4c 24 50 e8 cc cc ff ff 90 4c 8d 45 b0 48 8d 54 24 50 48 8d 8d 00 01 00 00 e8 26 d3 ff ff 90 48 8b 44 24 68 48 83 f8 10 72 4a 48 ff c0 48 }
    condition:
        any of them
}