rule win_catb_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.catb."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catb"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 418bcc e8???????? 85c0 0f8484000000 488b442440 488d0d22920300 }
            // n = 6, score = 100
            //   418bcc               | dec                 eax
            //   e8????????           |                     
            //   85c0                 | mov                 eax, dword ptr [ebx]
            //   0f8484000000         | cmp                 dword ptr [eax], 0
            //   488b442440           | dec                 eax
            //   488d0d22920300       | lea                 ecx, [0xffffaac2]

        $sequence_1 = { 4c8d050e9c0300 83e23f 488bcb 48c1f906 488d14d2 498b0cc8 8064d138fd }
            // n = 7, score = 100
            //   4c8d050e9c0300       | dec                 eax
            //   83e23f               | mov                 edx, eax
            //   488bcb               | dec                 eax
            //   48c1f906             | ror                 edx, cl
            //   488d14d2             | dec                 ecx
            //   498b0cc8             | xor                 edx, eax
            //   8064d138fd           | dec                 ebx

        $sequence_2 = { 488d159bdc0000 483950f0 740b 488b10 }
            // n = 4, score = 100
            //   488d159bdc0000       | movups              xmmword ptr [ebp + 0x200], xmm0
            //   483950f0             | dec                 eax
            //   740b                 | mov                 dword ptr [esp + 0x30], esi
            //   488b10               | xor                 edx, edx

        $sequence_3 = { 4c8d0da47f0000 b903000000 4c8d05907f0000 488d15f9750000 e8???????? 4885c0 740f }
            // n = 7, score = 100
            //   4c8d0da47f0000       | dec                 eax
            //   b903000000           | lea                 edx, [0xcf7c]
            //   4c8d05907f0000       | mov                 ecx, 4
            //   488d15f9750000       | mov                 ebx, edi
            //   e8????????           |                     
            //   4885c0               | dec                 eax
            //   740f                 | mov                 dword ptr [esp + 0x20], ebx

        $sequence_4 = { 4533c0 488d0d8e0e0400 baa00f0000 e8???????? 85c0 740a ff05???????? }
            // n = 7, score = 100
            //   4533c0               | dec                 eax
            //   488d0d8e0e0400       | lea                 ecx, [esp + 0x30]
            //   baa00f0000           | dec                 eax
            //   e8????????           |                     
            //   85c0                 | mov                 eax, dword ptr [esp + 0x38]
            //   740a                 | cmp                 dword ptr [eax + 0xc], 0xfde9
            //   ff05????????         |                     

        $sequence_5 = { 4c8d0d6bab0300 4c8bc6 488bd7 488bcb e8???????? }
            // n = 5, score = 100
            //   4c8d0d6bab0300       | dec                 esp
            //   4c8bc6               | lea                 eax, [0x7e7e]
            //   488bd7               | dec                 eax
            //   488bcb               | mov                 edi, ecx
            //   e8????????           |                     

        $sequence_6 = { 4c8d0d922affff 4c8b4570 8b5568 488b4d60 }
            // n = 4, score = 100
            //   4c8d0d922affff       | dec                 eax
            //   4c8b4570             | lea                 eax, [0x398bf]
            //   8b5568               | dec                 edx
            //   488b4d60             | mov                 eax, dword ptr [eax + eax*8]

        $sequence_7 = { 4053 4883ec20 8bd9 4c8d0d05d00000 }
            // n = 4, score = 100
            //   4053                 | lea                 eax, [0x7fbc]
            //   4883ec20             | dec                 eax
            //   8bd9                 | lea                 edx, [0x7fbd]
            //   4c8d0d05d00000       | xor                 ecx, ecx

        $sequence_8 = { 488d0d72190400 e8???????? 488b442438 488905???????? 488d442438 4883c008 }
            // n = 6, score = 100
            //   488d0d72190400       | and                 edx, 0x3f
            //   e8????????           |                     
            //   488b442438           | dec                 eax
            //   488905????????       |                     
            //   488d442438           | sar                 ecx, 6
            //   4883c008             | dec                 eax

        $sequence_9 = { 488bc3 498784f6803c0400 4885c0 7409 }
            // n = 4, score = 100
            //   488bc3               | lea                 ecx, [0xbc90]
            //   498784f6803c0400     | dec                 eax
            //   4885c0               | sub                 esp, 0x18
            //   7409                 | dec                 esp

    condition:
        7 of them and filesize < 593920
}

rule win_catb_w0 {
    meta:
	    description = "detect_CatB_ransomware"
	    author = "@malgamy12"
	    date = "2023/1/4"
        hash = "35a273df61f4506cdb286ecc40415efaa5797379b16d44c240e3ca44714f945b"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.catb"
        malpedia_rule_date = "20230118"
        malpedia_hash = ""
        malpedia_version = "20230118"
        malpedia_license = "DRL 1.1"
        malpedia_sharing = "TLP:WHITE"  

    strings:
        $op1 = {C1 C0 ?? 44 8B C0 8B C8 41 8B D0 48 C1 E9 ?? 83 E1 ?? 48 C1 E8 ?? 48 C1 E1 ?? 83 E0 ?? 48 03 C8 48 C1 EA ?? 83 E2 ?? 48 C1 E2 ?? 42 0F B6 04 19 41 8B C8 48 C1 E9 ?? 83 E1 ?? C1 E0 ?? 48 03 D1 42 0F B6 0C 1A 41 8B D0 C1 E1 ?? 03 C1 48 C1 EA ?? 41 8B C8 48 C1 E2 ?? 48 C1 E9 ?? 83 E1 ?? 48 03 D1 42 0F B6 0C 1A C1 E1 ?? 03 C1 41 8B C8 48 C1 E9 ?? 41 83 E0 ?? 83 E1 ?? 48 C1 E1 ?? 49 03 C8 42 0F B6 0C 19 03 C1}
        $op2 = {44 0F B6 59 ?? 48 8D 3D ?? ?? ?? ?? 44 0F B6 09 48 8B D9 44 0F B6 51 ?? 44 0F B6 41 ?? 4B 8D 14 5B 0F B6 4C 57 ?? 4B 8D 04 49 32 0C 47 4B 8D 04 5B 41 32 C8 41 32 CA 88 0B 4B 8D 0C} 
        $op3 = {52 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 52 41 32 D0 41 32 D1 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 49 44 0F B6 43 ?? 41 32 D3 41 32 D1 44 0F B6 4B ?? 88 53 ?? 0F B6 14 4F 32 54 47 ?? 41 32 D3 4B 8D 04 49 44 0F B6 5B ?? 41 32 D2 44 0F B6 53 ?? 88 53 ?? 4B 8D 0C 5B 0F B6 54 4F ?? 4B 8D 0C 52 32 14 47 4B 8D 04 5B 41 32 D0 41 32 D2 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 52 41 32 D0 41 32 D1 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 49 44 0F B6 43 ?? 41 32 D3 41 32 D1 44 0F B6 4B ?? 88 53 ?? 0F B6 14 4F 32 54 47 ?? 41 32 D3 4B 8D 04 49 44 0F B6 5B ?? 41 32 D2 44 0F B6 53 ?? 88 53 ?? 4B 8D 0C 5B 0F B6 54 4F ?? 4B 8D 0C 52 32 14 47 4B 8D 04 5B 41 32 D0 41 32 D2 88 53 ?? 0F B6 54 4F ?? 32 14 47 41 32 D0 4B 8D 0C 40 41 32 D1 4B 8D 04 52 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 49 44 0F B6 43 ?? 41 32 D3 41 32 D1 44 0F B6 4B ?? 88 53 ?? 0F B6 14 4F 32 54 47 ?? 41 32 D3 4B 8D 04 49 44 0F B6 5B ?? 41 32 D2 44 0F B6 53 ?? 88 53 ?? 4B 8D 0C 5B 0F B6 54 4F ?? 4B 8D 0C 52 32 14 47 4B 8D 04 5B 41 32 D0 41 32 D2 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 52 41 32 D0 41 32 D1 88 53 ?? 0F B6 54 4F ?? 4B 8D 0C 40 32 14 47 4B 8D 04 49 41 32 D3 41 32 D1 88 53 ?? 0F B6 14 4F 32 54 47 ?? 48 8B 7C 24 ?? 41 32 D3 41 32 D2 88 53 ?? 48 8B 5C 24}

    condition:
        uint16(0) == 0x5A4D and all of them
}