rule win_dustman_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.dustman."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.dustman"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 488d1566a10000 488d0d57a10000 e8???????? 488b4308 833800 750e }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488d1566a10000       | mov                 dword ptr [esp + 0x28], esi
            //   488d0d57a10000       | nop                 dword ptr [eax + eax]
            //   e8????????           |                     
            //   488b4308             | nop                 
            //   833800               | dec                 esp
            //   750e                 | mov                 ecx, edi

        $sequence_1 = { 884824 488b4d28 0fb60c01 884825 488b4d30 }
            // n = 5, score = 100
            //   884824               | xor                 eax, eax
            //   488b4d28             | dec                 eax
            //   0fb60c01             | mov                 edi, ebx
            //   884825               | dec                 eax
            //   488b4d30             | sub                 esp, 0x40

        $sequence_2 = { 4903cb 48898df0000000 488bca 492bca 4c8d9ddf010000 }
            // n = 5, score = 100
            //   4903cb               | mov                 ecx, dword ptr [ebp + 0x128]
            //   48898df0000000       | movzx               ecx, byte ptr [ecx + eax]
            //   488bca               | mov                 byte ptr [eax + 0x45], cl
            //   492bca               | movzx               ecx, byte ptr [ecx + eax]
            //   4c8d9ddf010000       | mov                 byte ptr [eax + 0x45], cl

        $sequence_3 = { 4c8d0df1820000 488bd9 488d15e7820000 b916000000 4c8d05d3820000 e8???????? }
            // n = 6, score = 100
            //   4c8d0df1820000       | lea                 ecx, [eax + edx]
            //   488bd9               | inc                 sp
            //   488d15e7820000       | mov                 dword ptr [ebp + 0x180], esi
            //   b916000000           | inc                 ebp
            //   4c8d05d3820000       | lea                 eax, [esi + 6]
            //   e8????????           |                     

        $sequence_4 = { c5f1eb0d???????? 4c8d0d36850000 c5f35cca c4c173590cc1 4c8d0d05750000 }
            // n = 5, score = 100
            //   c5f1eb0d????????     |                     
            //   4c8d0d36850000       | lea                 ebx, [ebp + 0x1c9]
            //   c5f35cca             | dec                 ecx
            //   c4c173590cc1         | add                 ecx, ebx
            //   4c8d0d05750000       | dec                 eax

        $sequence_5 = { 782e 3b0d???????? 7326 4863c9 488d153cde0000 488bc1 83e13f }
            // n = 7, score = 100
            //   782e                 | mov                 ecx, edi
            //   3b0d????????         |                     
            //   7326                 | mov                 ecx, eax
            //   4863c9               | xor                 edx, edx
            //   488d153cde0000       | mov                 eax, 0x1400000
            //   488bc1               | dec                 esp
            //   83e13f               | mov                 esp, ecx

        $sequence_6 = { 48898d18010000 488bca 492bca 4c8d9de4010000 4903cb 48898d20010000 488bca }
            // n = 7, score = 100
            //   48898d18010000       | dec                 eax
            //   488bca               | mov                 ecx, dword ptr [ebp + 0x78]
            //   492bca               | movzx               ecx, byte ptr [ecx + eax]
            //   4c8d9de4010000       | mov                 byte ptr [eax + 0x2f], cl
            //   4903cb               | dec                 eax
            //   48898d20010000       | mov                 ecx, dword ptr [ebp + 0x80]
            //   488bca               | movzx               ecx, byte ptr [ecx + eax]

        $sequence_7 = { 4156 4157 4883ec20 488b6918 4d8bf0 488bf9 4c3bc5 }
            // n = 7, score = 100
            //   4156                 | mov                 ecx, edx
            //   4157                 | dec                 ecx
            //   4883ec20             | sub                 ecx, edx
            //   488b6918             | dec                 eax
            //   4d8bf0               | lea                 esi, [ebp + 0x1a2]
            //   488bf9               | dec                 eax
            //   4c3bc5               | add                 esi, ecx

        $sequence_8 = { 4c8d9db3010000 4903cb 48894d98 488bca 492bca }
            // n = 5, score = 100
            //   4c8d9db3010000       | inc                 esp
            //   4903cb               | lea                 eax, [edx + 0x28]
            //   48894d98             | dec                 ecx
            //   488bca               | add                 ecx, eax
            //   492bca               | dec                 eax

        $sequence_9 = { e8???????? 85c0 0f8403010000 488d0586e10000 4a8b04e8 }
            // n = 5, score = 100
            //   e8????????           |                     
            //   85c0                 | mov                 ebx, ecx
            //   0f8403010000         | dec                 eax
            //   488d0586e10000       | lea                 edi, [0xfffef87c]
            //   4a8b04e8             | dec                 eax

    condition:
        7 of them and filesize < 368640
}