rule win_ceeloader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.ceeloader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ceeloader"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 89d6 81e635913d02 89b424ec030000 8bb424ec030000 c1e601 89b424e8030000 44039c24e8030000 }
            // n = 7, score = 100
            //   89d6                 | pop                 edx
            //   81e635913d02         | cmp                 ebx, ebp
            //   89b424ec030000       | or                  ebx, edx
            //   8bb424ec030000       | mov                 ebx, esi
            //   c1e601               | or                  edx, ebx
            //   89b424e8030000       | or                  edx, ebx
            //   44039c24e8030000     | cmp                 ecx, esi

        $sequence_1 = { 4c8d0562cd0a00 488d1563cd0a00 b901000000 e8???????? 488bd8 4885c0 7417 }
            // n = 7, score = 100
            //   4c8d0562cd0a00       | or                  eax, dword ptr [esp + 0xb9c]
            //   488d1563cd0a00       | mov                 dword ptr [esp + 0x670], eax
            //   b901000000           | mov                 eax, dword ptr [esp + 0xcd4]
            //   e8????????           |                     
            //   488bd8               | shr                 eax, 8
            //   4885c0               | mov                 dword ptr [esp + 0xcd0], eax
            //   7417                 | mov                 eax, dword ptr [esp + 0xcd0]

        $sequence_2 = { ff15???????? 898424f80a0000 66c78424f60a00000000 66c78424f40a00000000 48c78424e80a000000000000 4c8b8424e80a0000 668b9424f40a0000 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   898424f80a0000       | mov                 edx, eax
            //   66c78424f60a00000000     | dec    eax
            //   66c78424f40a00000000     | mov    dword ptr [esp + 0xa8], eax
            //   48c78424e80a000000000000     | inc    ecx
            //   4c8b8424e80a0000     | mov                 eax, 0xc8
            //   668b9424f40a0000     | mov                 dword ptr [esp + 0xbc], ecx

        $sequence_3 = { c784249002000075380000 c784248c020000c5360000 c78424880200005a380000 c7842484020000ff6f0000 c7842480020000123e0000 c784247c02000043360000 c78424780200001f220000 }
            // n = 7, score = 100
            //   c784249002000075380000     | mov    edx, eax
            //   c784248c020000c5360000     | inc    ecx
            //   c78424880200005a380000     | and    edx, 0x24b27f5
            //   c7842484020000ff6f0000     | inc    esp
            //   c7842480020000123e0000     | mov    dword ptr [esp + 0x4a0], edx
            //   c784247c02000043360000     | inc    esp
            //   c78424780200001f220000     | mov    edx, dword ptr [esp + 0x4a0]

        $sequence_4 = { 488945cf 488945d7 488d05cc660700 488945ff 488d05d1660700 4889450f 488d05d6660700 }
            // n = 7, score = 100
            //   488945cf             | mov                 dword ptr [ebx + 0x50], 6
            //   488945d7             | dec                 eax
            //   488d05cc660700       | mov                 dword ptr [ebx + 0x48], ecx
            //   488945ff             | mov                 byte ptr [ebx + 0x54], 0
            //   488d05d1660700       | mov                 dword ptr [ebx + 0x50], eax
            //   4889450f             | jmp                 0x175a
            //   488d05d6660700       | dec                 eax

        $sequence_5 = { 8bc6 0bda 8bde 0bd3 3bce 33f5 0bc3 }
            // n = 7, score = 100
            //   8bc6                 | mov                 ebx, esi
            //   0bda                 | or                  edx, ebx
            //   8bde                 | cmp                 ecx, esi
            //   0bd3                 | and                 edi, ebp
            //   3bce                 | and                 eax, edi
            //   33f5                 | or                  edi, edi
            //   0bc3                 | or                  ebx, edx

        $sequence_6 = { 41c1ea05 44899424f4040000 442b8c24f4040000 44898c24f0040000 448b8c24f0040000 4189c2 4181e2b1524402 }
            // n = 7, score = 100
            //   41c1ea05             | inc                 ebp
            //   44899424f4040000     | mov                 eax, edx
            //   442b8c24f4040000     | dec                 esp
            //   44898c24f0040000     | lea                 ecx, [esp + 0x154]
            //   448b8c24f0040000     | dec                 eax
            //   4189c2               | mov                 ecx, edx
            //   4181e2b1524402       | dec                 eax

        $sequence_7 = { 0fbe05???????? 83f06c 88c1 884c2445 0fbe05???????? 83f06f 88c1 }
            // n = 7, score = 100
            //   0fbe05????????       |                     
            //   83f06c               | inc                 esp
            //   88c1                 | mov                 dword ptr [esp + 0x354], ebx
            //   884c2445             | inc                 esp
            //   0fbe05????????       |                     
            //   83f06f               | mov                 ebx, dword ptr [esp + 0x354]
            //   88c1                 | inc                 ecx

        $sequence_8 = { 41c1e405 4489a42458040000 4403bc2458040000 4489bc2454040000 448bbc2454040000 4589dc 4181e45d386101 }
            // n = 7, score = 100
            //   41c1e405             | mov                 ecx, edx
            //   4489a42458040000     | dec                 eax
            //   4403bc2458040000     | lea                 edx, [0xc2648]
            //   4489bc2454040000     | inc                 ecx
            //   448bbc2454040000     | mov                 eax, 7
            //   4589dc               | dec                 esp
            //   4181e45d386101       | lea                 ecx, [esp + 0x1f0]

        $sequence_9 = { 44698424a0090000ab000000 448984249c090000 448b84249c090000 41c1e80c 4489842498090000 446b84249809000003 4489842494090000 }
            // n = 7, score = 100
            //   44698424a0090000ab000000     | mov    edx, dword ptr [esp + 0x100]
            //   448984249c090000     | dec                 eax
            //   448b84249c090000     | mov                 dword ptr [esp + 0x60], ecx
            //   41c1e80c             | dec                 eax
            //   4489842498090000     | mov                 ecx, edx
            //   446b84249809000003     | dec    eax
            //   4489842494090000     | lea                 edx, [0xc6f12]

    condition:
        7 of them and filesize < 2321408
}