rule win_danbot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.danbot."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.danbot"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 48891d???????? 48893d???????? 881d???????? 410f1007 0f1105???????? 410f104f10 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   48891d????????       |                     
            //   48893d????????       |                     
            //   881d????????         |                     
            //   410f1007             | mov                 ecx, dword ptr [edi]
            //   0f1105????????       |                     
            //   410f104f10           | jmp                 0x17d

        $sequence_1 = { 7507 4d3916 742f eb05 4d3916 7528 44385708 }
            // n = 7, score = 200
            //   7507                 | nop                 
            //   4d3916               | dec                 eax
            //   742f                 | lea                 eax, [esp + 0x1b0]
            //   eb05                 | dec                 eax
            //   4d3916               | mov                 dword ptr [esp + 0x48], eax
            //   7528                 | dec                 eax
            //   44385708             | lea                 eax, [esp + 0x1d0]

        $sequence_2 = { 498bd7 488bcf e8???????? 84c0 75ca 4c8b6c2448 488b4c2428 }
            // n = 7, score = 200
            //   498bd7               | movups              xmmword ptr [esp + 0xb8], xmm1
            //   488bcf               | dec                 ecx
            //   e8????????           |                     
            //   84c0                 | mov                 dword ptr [esp + 0x10], ebx
            //   75ca                 | mov                 byte ptr [esp + 0xa8], bl
            //   4c8b6c2448           | inc                 esp
            //   488b4c2428           | lea                 eax, [ebx + 3]

        $sequence_3 = { ba01000000 488d4df0 e8???????? 0f1000 f3410f7f06 488b742468 8ac3 }
            // n = 7, score = 200
            //   ba01000000           | mov                 eax, edx
            //   488d4df0             | dec                 eax
            //   e8????????           |                     
            //   0f1000               | lea                 ecx, [0x51a4d]
            //   f3410f7f06           | dec                 eax
            //   488b742468           | mov                 dword ptr [ebx], ecx
            //   8ac3                 | dec                 eax

        $sequence_4 = { e8???????? ba01000000 488bce ffd3 90 488365cf00 48c745d70f000000 }
            // n = 7, score = 200
            //   e8????????           |                     
            //   ba01000000           | mov                 eax, dword ptr [ebx + 0x9c]
            //   488bce               | cmp                 eax, 0x106
            //   ffd3                 | jae                 0x13a3
            //   90                   | inc                 esp
            //   488365cf00           | mov                 esi, edx
            //   48c745d70f000000     | dec                 eax

        $sequence_5 = { 48ffc2 4d8bc6 488b4de0 e8???????? 4885db 0f8446fbffff 488d55e0 }
            // n = 7, score = 200
            //   48ffc2               | jne                 0xae1
            //   4d8bc6               | dec                 eax
            //   488b4de0             | add                 eax, 2
            //   e8????????           |                     
            //   4885db               | dec                 ecx
            //   0f8446fbffff         | mov                 dword ptr [esi], eax
            //   488d55e0             | or                  eax, 4

        $sequence_6 = { 747d 48837b1808 7205 488b03 eb03 488bc3 488b4b10 }
            // n = 7, score = 200
            //   747d                 | nop                 
            //   48837b1808           | dec                 eax
            //   7205                 | mov                 edx, dword ptr [esp + 0x198]
            //   488b03               | dec                 eax
            //   eb03                 | cmp                 edx, 0x10
            //   488bc3               | jb                  0x1bd
            //   488b4b10             | dec                 eax

        $sequence_7 = { eb09 8b4748 498bd3 482bd1 8bc8 413bc9 410f47c9 }
            // n = 7, score = 200
            //   eb09                 | arpl                word ptr [eax + 4], cx
            //   8b4748               | jne                 0x12dc
            //   498bd3               | dec                 esp
            //   482bd1               | lea                 ecx, [esp + 0x60]
            //   8bc8                 | dec                 ecx
            //   413bc9               | add                 ecx, ecx
            //   410f47c9             | inc                 ebp

        $sequence_8 = { 8d43d5 a8fd 750f 488b07 8a18 48ffc0 }
            // n = 6, score = 200
            //   8d43d5               | dec                 eax
            //   a8fd                 | or                  eax, 0xffffffff
            //   750f                 | dec                 eax
            //   488b07               | cmp                 dword ptr [esp + 0x28], 3
            //   8a18                 | jne                 0x8df
            //   48ffc0               | dec                 esp

        $sequence_9 = { e9???????? 8b4b48 c1e10c 81e900780000 44398bb0000000 7d22 8b93ac000000 }
            // n = 7, score = 200
            //   e9????????           |                     
            //   8b4b48               | mov                 edx, esp
            //   c1e10c               | dec                 eax
            //   81e900780000         | mov                 ecx, esi
            //   44398bb0000000       | nop                 
            //   7d22                 | dec                 eax
            //   8b93ac000000         | lea                 eax, [0x423a7]

    condition:
        7 of them and filesize < 1492992
}