rule win_calmthorn_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.calmthorn."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.calmthorn"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c78548adffff00000000 eb0f 8b8548adffff 83c001 898548adffff 8b8d68f9ffff 51 }
            // n = 7, score = 100
            //   c78548adffff00000000     | mov    dword ptr [ebp - 0x52b8], 0
            //   eb0f                 | jmp                 0x11
            //   8b8548adffff         | mov                 eax, dword ptr [ebp - 0x52b8]
            //   83c001               | add                 eax, 1
            //   898548adffff         | mov                 dword ptr [ebp - 0x52b8], eax
            //   8b8d68f9ffff         | mov                 ecx, dword ptr [ebp - 0x698]
            //   51                   | push                ecx

        $sequence_1 = { e8???????? 83c404 3985dcf3ffff 7d20 8b954cfaffff 83c201 89954cfaffff }
            // n = 7, score = 100
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   3985dcf3ffff         | cmp                 dword ptr [ebp - 0xc24], eax
            //   7d20                 | jge                 0x22
            //   8b954cfaffff         | mov                 edx, dword ptr [ebp - 0x5b4]
            //   83c201               | add                 edx, 1
            //   89954cfaffff         | mov                 dword ptr [ebp - 0x5b4], edx

        $sequence_2 = { 0f57c0 660f13857498ffff eb1e 8b957498ffff 83c201 8b857898ffff 83d000 }
            // n = 7, score = 100
            //   0f57c0               | xorps               xmm0, xmm0
            //   660f13857498ffff     | movlpd              qword ptr [ebp - 0x678c], xmm0
            //   eb1e                 | jmp                 0x20
            //   8b957498ffff         | mov                 edx, dword ptr [ebp - 0x678c]
            //   83c201               | add                 edx, 1
            //   8b857898ffff         | mov                 eax, dword ptr [ebp - 0x6788]
            //   83d000               | adc                 eax, 0

        $sequence_3 = { eb1e 8b85bc86ffff 83c001 8b8dc086ffff 83d100 8985bc86ffff 898dc086ffff }
            // n = 7, score = 100
            //   eb1e                 | jmp                 0x20
            //   8b85bc86ffff         | mov                 eax, dword ptr [ebp - 0x7944]
            //   83c001               | add                 eax, 1
            //   8b8dc086ffff         | mov                 ecx, dword ptr [ebp - 0x7940]
            //   83d100               | adc                 ecx, 0
            //   8985bc86ffff         | mov                 dword ptr [ebp - 0x7944], eax
            //   898dc086ffff         | mov                 dword ptr [ebp - 0x7940], ecx

        $sequence_4 = { 8b959875ffff 83d200 898d9475ffff 89959875ffff 83bd9875ffff00 7722 720c }
            // n = 7, score = 100
            //   8b959875ffff         | mov                 edx, dword ptr [ebp - 0x8a68]
            //   83d200               | adc                 edx, 0
            //   898d9475ffff         | mov                 dword ptr [ebp - 0x8a6c], ecx
            //   89959875ffff         | mov                 dword ptr [ebp - 0x8a68], edx
            //   83bd9875ffff00       | cmp                 dword ptr [ebp - 0x8a68], 0
            //   7722                 | ja                  0x24
            //   720c                 | jb                  0xe

        $sequence_5 = { ebb7 0fb6952cfdffff 83fa01 7552 c7855cbdffff00000000 eb0f 8b855cbdffff }
            // n = 7, score = 100
            //   ebb7                 | jmp                 0xffffffb9
            //   0fb6952cfdffff       | movzx               edx, byte ptr [ebp - 0x2d4]
            //   83fa01               | cmp                 edx, 1
            //   7552                 | jne                 0x54
            //   c7855cbdffff00000000     | mov    dword ptr [ebp - 0x42a4], 0
            //   eb0f                 | jmp                 0x11
            //   8b855cbdffff         | mov                 eax, dword ptr [ebp - 0x42a4]

        $sequence_6 = { ebba 0fb68d5efdffff 83f901 7556 0f57c0 660f1385c472ffff eb1e }
            // n = 7, score = 100
            //   ebba                 | jmp                 0xffffffbc
            //   0fb68d5efdffff       | movzx               ecx, byte ptr [ebp - 0x2a2]
            //   83f901               | cmp                 ecx, 1
            //   7556                 | jne                 0x58
            //   0f57c0               | xorps               xmm0, xmm0
            //   660f1385c472ffff     | movlpd              qword ptr [ebp - 0x8d3c], xmm0
            //   eb1e                 | jmp                 0x20

        $sequence_7 = { 8a95b7fdffff 80c201 8895b7fdffff ebbd 0fb6859efdffff 83f801 7552 }
            // n = 7, score = 100
            //   8a95b7fdffff         | mov                 dl, byte ptr [ebp - 0x249]
            //   80c201               | add                 dl, 1
            //   8895b7fdffff         | mov                 byte ptr [ebp - 0x249], dl
            //   ebbd                 | jmp                 0xffffffbf
            //   0fb6859efdffff       | movzx               eax, byte ptr [ebp - 0x262]
            //   83f801               | cmp                 eax, 1
            //   7552                 | jne                 0x54

        $sequence_8 = { 8b8518f8ffff 0fbe08 85c9 7502 eb02 ebba 0fb69591fdffff }
            // n = 7, score = 100
            //   8b8518f8ffff         | mov                 eax, dword ptr [ebp - 0x7e8]
            //   0fbe08               | movsx               ecx, byte ptr [eax]
            //   85c9                 | test                ecx, ecx
            //   7502                 | jne                 4
            //   eb02                 | jmp                 4
            //   ebba                 | jmp                 0xffffffbc
            //   0fb69591fdffff       | movzx               edx, byte ptr [ebp - 0x26f]

        $sequence_9 = { eb0f 8b8d34f0ffff 83c101 898d34f0ffff 8b9564f6ffff 52 e8???????? }
            // n = 7, score = 100
            //   eb0f                 | jmp                 0x11
            //   8b8d34f0ffff         | mov                 ecx, dword ptr [ebp - 0xfcc]
            //   83c101               | add                 ecx, 1
            //   898d34f0ffff         | mov                 dword ptr [ebp - 0xfcc], ecx
            //   8b9564f6ffff         | mov                 edx, dword ptr [ebp - 0x99c]
            //   52                   | push                edx
            //   e8????????           |                     

    condition:
        7 of them and filesize < 2322432
}