rule win_catb_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.catb."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catb"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e9???????? 488d0543dd0300 4a8b04e8 42f644f83840 7405 }
            // n = 5, score = 100
            //   e9????????           |                     
            //   488d0543dd0300       | mov                 dword ptr [eax + 0x3a8], edx
            //   4a8b04e8             | dec                 eax
            //   42f644f83840         | mov                 ecx, dword ptr [esp + 0x38]
            //   7405                 | dec                 eax

        $sequence_1 = { 90 488d1db6a90300 488d3537fe0000 48895c2420 }
            // n = 4, score = 100
            //   90                   | lea                 ecx, [ecx + ecx*8]
            //   488d1db6a90300       | dec                 eax
            //   488d3537fe0000       | sar                 eax, 6
            //   48895c2420           | dec                 eax

        $sequence_2 = { 488d159bdc0000 483950f0 740b 488b10 }
            // n = 4, score = 100
            //   488d159bdc0000       | mov                 dword ptr [esp + 0x20], 3
            //   483950f0             | dec                 eax
            //   740b                 | mov                 dword ptr [esp + 0x30], esi
            //   488b10               | dec                 eax

        $sequence_3 = { 428844f13e 4b8b84e0403e0400 42804cf03d04 38558f ebcc ff15???????? 894597 }
            // n = 7, score = 100
            //   428844f13e           | lea                 edx, [0x134d0]
            //   4b8b84e0403e0400     | test                byte ptr [edx + 0x38], 0x20
            //   42804cf03d04         | je                  0x552
            //   38558f               | xor                 edx, edx
            //   ebcc                 | inc                 ecx
            //   ff15????????         |                     
            //   894597               | mov                 ecx, ecx

        $sequence_4 = { 0fb7c0 66f3ab 488d3d10130100 482bfe 8a041f 8803 }
            // n = 6, score = 100
            //   0fb7c0               | cmp                 dword ptr [ecx], eax
            //   66f3ab               | je                  0x6fe
            //   488d3d10130100       | dec                 eax
            //   482bfe               | mov                 ecx, dword ptr [ecx]
            //   8a041f               | dec                 eax
            //   8803                 | lea                 eax, [0x3df2a]

        $sequence_5 = { eb16 b902000000 e8???????? 483bd8 757a 488d3df0d50300 ff05???????? }
            // n = 7, score = 100
            //   eb16                 | dec                 esp
            //   b902000000           | mov                 ebp, edx
            //   e8????????           |                     
            //   483bd8               | dec                 ecx
            //   757a                 | mov                 eax, dword ptr [edi + edi*8 + 0x43818]
            //   488d3df0d50300       | dec                 eax
            //   ff05????????         |                     

        $sequence_6 = { 48ffcb ffc2 0fb603 4280bc087098010000 74e3 440fb603 }
            // n = 6, score = 100
            //   48ffcb               | mov                 esi, ebx
            //   ffc2                 | dec                 ebx
            //   0fb603               | lea                 eax, [ecx + esi*8]
            //   4280bc087098010000     | jne    0x191
            //   74e3                 | movzx               ecx, word ptr [edx + eax*2 + 2]
            //   440fb603             | cmp                 cx, word ptr [edi + eax*2 + 2]

        $sequence_7 = { 8bda 4c8d057e7e0000 488bf9 488d151c750000 }
            // n = 4, score = 100
            //   8bda                 | dec                 eax
            //   4c8d057e7e0000       | shr                 eax, 0x14
            //   488bf9               | cmp                 eax, 0x800
            //   488d151c750000       | jb                  0xb3a

        $sequence_8 = { 488bf8 4885c0 0f8483000000 41b812000000 488d1569550100 488bc8 ff15???????? }
            // n = 7, score = 100
            //   488bf8               | dec                 esp
            //   4885c0               | lea                 esi, [0xffff764a]
            //   0f8483000000         | dec                 ebp
            //   41b812000000         | mov                 esp, ecx
            //   488d1569550100       | dec                 ecx
            //   488bc8               | mov                 ebp, eax
            //   ff15????????         |                     

        $sequence_9 = { 488bc3 498784f6803c0400 4885c0 7409 }
            // n = 4, score = 100
            //   488bc3               | cmp                 ebx, eax
            //   498784f6803c0400     | jne                 0x230
            //   4885c0               | dec                 eax
            //   7409                 | add                 esp, 0x28

    condition:
        7 of them and filesize < 593920
}

rule win_catb_w0 {
    meta:
	    description = "detect_CatB_ransomware"
	    author = "@malgamy12"
	    date = "2023/1/4"
        hash = "35a273df61f4506cdb286ecc40415efaa5797379b16d44c240e3ca44714f945b"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catb"
        malpedia_rule_date = "20230118"
        malpedia_hash = ""
        malpedia_version = "20230118"
        malpedia_license = "DRL 1.1"
        malpedia_sharing = "TLP:WHITE"  

    strings:
        $op1 = {C1 C0 ?? 44 8B C0 8B C8 41 8B D0 48 C1 E9 ?? 83 E1 ?? 48 C1 E8 ?? 48 C1 E1 ?? 83 E0 ?? 48 03 C8 48 C1 EA ?? 83 E2 ?? 48 C1 E2 ?? 42 0F B6 04 19 41 8B C8 48 C1 E9 ?? 83 E1 ?? C1 E0 ?? 48 03 D1 42 0F B6 0C 1A 41 8B D0 C1 E1 ?? 03 C1 48 C1 EA ?? 41 8B C8 48 C1 E2 ?? 48 C1 E9 ?? 83 E1 ?? 48 03 D1 42 0F B6 0C 1A C1 E1 ?? 03 C1 41 8B C8 48 C1 E9 ?? 41 83 E0 ?? 83 E1 ?? 48 C1 E1 ?? 49 03 C8 42 0F B6 0C 19 03 C1}
        $op2 = {44 0F B6 59 ?? 48 8D 3D ?? ?? ?? ?? 44 0F B6 09 48 8B D9 44 0F B6 51 ?? 44 0F B6 41 ?? 4B 8D 14 5B 0F B6 4C 57 ?? 4B 8D 04 49 32 0C 47 4B 8D 04 5B 41 32 C8 41 32 CA 88 0B 4B 8D 0C} 
        $op3 = {52 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 52 41 32 D0 41 32 D1 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 49 44 0F B6 43 ?? 41 32 D3 41 32 D1 44 0F B6 4B ?? 88 53 ?? 0F B6 14 4F 32 54 47 ?? 41 32 D3 4B 8D 04 49 44 0F B6 5B ?? 41 32 D2 44 0F B6 53 ?? 88 53 ?? 4B 8D 0C 5B 0F B6 54 4F ?? 4B 8D 0C 52 32 14 47 4B 8D 04 5B 41 32 D0 41 32 D2 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 52 41 32 D0 41 32 D1 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 49 44 0F B6 43 ?? 41 32 D3 41 32 D1 44 0F B6 4B ?? 88 53 ?? 0F B6 14 4F 32 54 47 ?? 41 32 D3 4B 8D 04 49 44 0F B6 5B ?? 41 32 D2 44 0F B6 53 ?? 88 53 ?? 4B 8D 0C 5B 0F B6 54 4F ?? 4B 8D 0C 52 32 14 47 4B 8D 04 5B 41 32 D0 41 32 D2 88 53 ?? 0F B6 54 4F ?? 32 14 47 41 32 D0 4B 8D 0C 40 41 32 D1 4B 8D 04 52 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 49 44 0F B6 43 ?? 41 32 D3 41 32 D1 44 0F B6 4B ?? 88 53 ?? 0F B6 14 4F 32 54 47 ?? 41 32 D3 4B 8D 04 49 44 0F B6 5B ?? 41 32 D2 44 0F B6 53 ?? 88 53 ?? 4B 8D 0C 5B 0F B6 54 4F ?? 4B 8D 0C 52 32 14 47 4B 8D 04 5B 41 32 D0 41 32 D2 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 52 41 32 D0 41 32 D1 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 49 41 32 D3 41 32 D1 88 53 ?? 0F B6 14 4F 32 54 47 ?? 48 8B 7C 24 ?? 41 32 D3 41 32 D2 88 53 ?? 48 8B 5C 24}

    condition:
        uint16(0) == 0x5A4D and all of them
}