rule win_cookiebag_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.cookiebag."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.cookiebag"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b8de4feffff e9???????? 8b8de4feffff e9???????? 8b8d08ffffff e9???????? 8d8d1cffffff }
            // n = 7, score = 100
            //   8b8de4feffff         | mov                 ecx, dword ptr [ebp - 0x11c]
            //   e9????????           |                     
            //   8b8de4feffff         | mov                 ecx, dword ptr [ebp - 0x11c]
            //   e9????????           |                     
            //   8b8d08ffffff         | mov                 ecx, dword ptr [ebp - 0xf8]
            //   e9????????           |                     
            //   8d8d1cffffff         | lea                 ecx, [ebp - 0xe4]

        $sequence_1 = { 49 51 68???????? 8d4c2448 e8???????? 8a4c2470 53 }
            // n = 7, score = 100
            //   49                   | dec                 ecx
            //   51                   | push                ecx
            //   68????????           |                     
            //   8d4c2448             | lea                 ecx, [esp + 0x48]
            //   e8????????           |                     
            //   8a4c2470             | mov                 cl, byte ptr [esp + 0x70]
            //   53                   | push                ebx

        $sequence_2 = { 85c0 7505 b8???????? 8078fffe 732e 6a01 8bcf }
            // n = 7, score = 100
            //   85c0                 | test                eax, eax
            //   7505                 | jne                 7
            //   b8????????           |                     
            //   8078fffe             | cmp                 byte ptr [eax - 1], 0xfe
            //   732e                 | jae                 0x30
            //   6a01                 | push                1
            //   8bcf                 | mov                 ecx, edi

        $sequence_3 = { 85c0 0f85f6000000 8b6d00 8b3d???????? 83fdff 7403 55 }
            // n = 7, score = 100
            //   85c0                 | test                eax, eax
            //   0f85f6000000         | jne                 0xfc
            //   8b6d00               | mov                 ebp, dword ptr [ebp]
            //   8b3d????????         |                     
            //   83fdff               | cmp                 ebp, -1
            //   7403                 | je                  5
            //   55                   | push                ebp

        $sequence_4 = { 52 50 ff15???????? 85c0 7e45 55 8dbef0000000 }
            // n = 7, score = 100
            //   52                   | push                edx
            //   50                   | push                eax
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   7e45                 | jle                 0x47
            //   55                   | push                ebp
            //   8dbef0000000         | lea                 edi, [esi + 0xf0]

        $sequence_5 = { 52 8bce e8???????? 83ec10 8d44245c 8bcc 89642434 }
            // n = 7, score = 100
            //   52                   | push                edx
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   83ec10               | sub                 esp, 0x10
            //   8d44245c             | lea                 eax, [esp + 0x5c]
            //   8bcc                 | mov                 ecx, esp
            //   89642434             | mov                 dword ptr [esp + 0x34], esp

        $sequence_6 = { 0f845e140000 8b4330 85c0 7505 b8???????? 8b5350 8bcb }
            // n = 7, score = 100
            //   0f845e140000         | je                  0x1464
            //   8b4330               | mov                 eax, dword ptr [ebx + 0x30]
            //   85c0                 | test                eax, eax
            //   7505                 | jne                 7
            //   b8????????           |                     
            //   8b5350               | mov                 edx, dword ptr [ebx + 0x50]
            //   8bcb                 | mov                 ecx, ebx

        $sequence_7 = { 8d4c2424 55 885c2470 e8???????? 84c0 7423 8b7c2424 }
            // n = 7, score = 100
            //   8d4c2424             | lea                 ecx, [esp + 0x24]
            //   55                   | push                ebp
            //   885c2470             | mov                 byte ptr [esp + 0x70], bl
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   7423                 | je                  0x25
            //   8b7c2424             | mov                 edi, dword ptr [esp + 0x24]

        $sequence_8 = { 8b2d???????? 8b4308 56 57 8bf8 3bef 8d7158 }
            // n = 7, score = 100
            //   8b2d????????         |                     
            //   8b4308               | mov                 eax, dword ptr [ebx + 8]
            //   56                   | push                esi
            //   57                   | push                edi
            //   8bf8                 | mov                 edi, eax
            //   3bef                 | cmp                 ebp, edi
            //   8d7158               | lea                 esi, [ecx + 0x58]

        $sequence_9 = { 7302 8be8 85ed 7633 8b4efc 2bc5 50 }
            // n = 7, score = 100
            //   7302                 | jae                 4
            //   8be8                 | mov                 ebp, eax
            //   85ed                 | test                ebp, ebp
            //   7633                 | jbe                 0x35
            //   8b4efc               | mov                 ecx, dword ptr [esi - 4]
            //   2bc5                 | sub                 eax, ebp
            //   50                   | push                eax

    condition:
        7 of them and filesize < 311296
}