rule win_crypt0l0cker_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.crypt0l0cker."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.crypt0l0cker"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 85c0 742b 57 50 6a00 ff35???????? ff15???????? }
            // n = 7, score = 100
            //   85c0                 | test                eax, eax
            //   742b                 | je                  0x2d
            //   57                   | push                edi
            //   50                   | push                eax
            //   6a00                 | push                0
            //   ff35????????         |                     
            //   ff15????????         |                     

        $sequence_1 = { 897dfc 8b15???????? 8b149514d1a800 8d8d44ffffff e8???????? 8d8d44ffffff }
            // n = 6, score = 100
            //   897dfc               | mov                 dword ptr [ebp - 4], edi
            //   8b15????????         |                     
            //   8b149514d1a800       | mov                 edx, dword ptr [edx*4 + 0xa8d114]
            //   8d8d44ffffff         | lea                 ecx, [ebp - 0xbc]
            //   e8????????           |                     
            //   8d8d44ffffff         | lea                 ecx, [ebp - 0xbc]

        $sequence_2 = { 6a05 68152eeba0 6a19 e8???????? 8bc8 83c420 85c9 }
            // n = 7, score = 100
            //   6a05                 | push                5
            //   68152eeba0           | push                0xa0eb2e15
            //   6a19                 | push                0x19
            //   e8????????           |                     
            //   8bc8                 | mov                 ecx, eax
            //   83c420               | add                 esp, 0x20
            //   85c9                 | test                ecx, ecx

        $sequence_3 = { 5e c3 85ff b8???????? 0f45c7 50 e8???????? }
            // n = 7, score = 100
            //   5e                   | pop                 esi
            //   c3                   | ret                 
            //   85ff                 | test                edi, edi
            //   b8????????           |                     
            //   0f45c7               | cmovne              eax, edi
            //   50                   | push                eax
            //   e8????????           |                     

        $sequence_4 = { 5b 85ff 7e18 8b0e 83c1fc 03ca 8b01 }
            // n = 7, score = 100
            //   5b                   | pop                 ebx
            //   85ff                 | test                edi, edi
            //   7e18                 | jle                 0x1a
            //   8b0e                 | mov                 ecx, dword ptr [esi]
            //   83c1fc               | add                 ecx, -4
            //   03ca                 | add                 ecx, edx
            //   8b01                 | mov                 eax, dword ptr [ecx]

        $sequence_5 = { 85f6 747c 83ec0c 8bd3 8bce ff75f0 e8???????? }
            // n = 7, score = 100
            //   85f6                 | test                esi, esi
            //   747c                 | je                  0x7e
            //   83ec0c               | sub                 esp, 0xc
            //   8bd3                 | mov                 edx, ebx
            //   8bce                 | mov                 ecx, esi
            //   ff75f0               | push                dword ptr [ebp - 0x10]
            //   e8????????           |                     

        $sequence_6 = { 33db 3b75f8 6a01 58 0f42d8 8b4508 895df8 }
            // n = 7, score = 100
            //   33db                 | xor                 ebx, ebx
            //   3b75f8               | cmp                 esi, dword ptr [ebp - 8]
            //   6a01                 | push                1
            //   58                   | pop                 eax
            //   0f42d8               | cmovb               ebx, eax
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   895df8               | mov                 dword ptr [ebp - 8], ebx

        $sequence_7 = { 335d04 0fb6460a c1e208 0bd0 0fb6460b c1e208 0bd0 }
            // n = 7, score = 100
            //   335d04               | xor                 ebx, dword ptr [ebp + 4]
            //   0fb6460a             | movzx               eax, byte ptr [esi + 0xa]
            //   c1e208               | shl                 edx, 8
            //   0bd0                 | or                  edx, eax
            //   0fb6460b             | movzx               eax, byte ptr [esi + 0xb]
            //   c1e208               | shl                 edx, 8
            //   0bd0                 | or                  edx, eax

        $sequence_8 = { 5d c3 6a2c e8???????? 59 85c0 7501 }
            // n = 7, score = 100
            //   5d                   | pop                 ebp
            //   c3                   | ret                 
            //   6a2c                 | push                0x2c
            //   e8????????           |                     
            //   59                   | pop                 ecx
            //   85c0                 | test                eax, eax
            //   7501                 | jne                 3

        $sequence_9 = { 8bf8 85ff 7478 8bd6 8bcf e8???????? 8bcf }
            // n = 7, score = 100
            //   8bf8                 | mov                 edi, eax
            //   85ff                 | test                edi, edi
            //   7478                 | je                  0x7a
            //   8bd6                 | mov                 edx, esi
            //   8bcf                 | mov                 ecx, edi
            //   e8????????           |                     
            //   8bcf                 | mov                 ecx, edi

    condition:
        7 of them and filesize < 917504
}