rule win_duuzer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.duuzer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.duuzer"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83f804 7408 83c8ff e9???????? }
            // n = 4, score = 200
            //   83f804               | cmp                 eax, 4
            //   7408                 | je                  0xa
            //   83c8ff               | or                  eax, 0xffffffff
            //   e9????????           |                     

        $sequence_1 = { 0145f0 1155f4 85c9 7533 }
            // n = 4, score = 100
            //   0145f0               | cmp                 eax, -0x75
            //   1155f4               | jne                 0x175
            //   85c9                 | xor                 eax, eax
            //   7533                 | dec                 esp

        $sequence_2 = { 4c89742408 4d8bf0 488bf2 4c8bd1 418d5c2410 4439a1f4160000 0f84ba030000 }
            // n = 7, score = 100
            //   4c89742408           | mov                 ebx, esi
            //   4d8bf0               | inc                 edx
            //   488bf2               | lea                 eax, [esi + ebp]
            //   4c8bd1               | inc                 ecx
            //   418d5c2410           | mov                 eax, 0x10
            //   4439a1f4160000       | dec                 esp
            //   0f84ba030000         | mov                 dword ptr [ebx + 0x60], esi

        $sequence_3 = { 4c89742430 4c8d85a0600000 4183c9ff 33d2 }
            // n = 4, score = 100
            //   4c89742430           | dec                 eax
            //   4c8d85a0600000       | mov                 dword ptr [esp + 0x60], edi
            //   4183c9ff             | nop                 
            //   33d2                 | dec                 esp

        $sequence_4 = { 4c897360 48894358 eb03 498bde }
            // n = 4, score = 100
            //   4c897360             | dec                 esp
            //   48894358             | mov                 dword ptr [ebx + 0x60], esi
            //   eb03                 | dec                 eax
            //   498bde               | mov                 dword ptr [ebx + 0x58], eax

        $sequence_5 = { 014dec 83bf8400000000 7708 398780000000 }
            // n = 4, score = 100
            //   014dec               | ror                 dword ptr [edx - 0x75f877fa], 1
            //   83bf8400000000       | inc                 esi
            //   7708                 | add                 al, ah
            //   398780000000         | xor                 eax, 0x36040041

        $sequence_6 = { 01442410 3bfb 75c4 8b4630 }
            // n = 4, score = 100
            //   01442410             | mov                 dword ptr [esp + 0x28], edi
            //   3bfb                 | dec                 esp
            //   75c4                 | mov                 dword ptr [esp + 0x30], esi
            //   8b4630               | dec                 esp

        $sequence_7 = { 4c89742428 41b116 488bca 448bc2 }
            // n = 4, score = 100
            //   4c89742428           | dec                 eax
            //   41b116               | mov                 dword ptr [esp + 0x50], esi
            //   488bca               | dec                 esp
            //   448bc2               | mov                 dword ptr [esp + 0x20], esi

        $sequence_8 = { 4c89742420 41be04000000 4d3be6 0f86dd000000 }
            // n = 4, score = 100
            //   4c89742420           | dec                 eax
            //   41be04000000         | mov                 dword ptr [ebx + 0x58], eax
            //   4d3be6               | jmp                 5
            //   0f86dd000000         | dec                 ecx

        $sequence_9 = { 4c89742420 ff15???????? 8bf8 8d4801 }
            // n = 4, score = 100
            //   4c89742420           | cmp                 dword ptr [ecx + 0x16f4], esp
            //   ff15????????         |                     
            //   8bf8                 | je                  0x3d2
            //   8d4801               | dec                 esp

        $sequence_10 = { 00f4 c640001c c740008a460323 d188470383ee }
            // n = 4, score = 100
            //   00f4                 | dec                 esp
            //   c640001c             | mov                 dword ptr [esp + 0x30], esi
            //   c740008a460323       | dec                 esp
            //   d188470383ee         | lea                 eax, [ebp + 0x60a0]

        $sequence_11 = { 4c89742430 e8???????? 83f88b 0f856c010000 }
            // n = 4, score = 100
            //   4c89742430           | dec                 esp
            //   e8????????           |                     
            //   83f88b               | mov                 dword ptr [esp + 0x28], esi
            //   0f856c010000         | inc                 ecx

        $sequence_12 = { 014dec 66837dec00 0f8efc010000 0fbf45ec }
            // n = 4, score = 100
            //   014dec               | dec                 esp
            //   66837dec00           | lea                 esp, [0x1ca24]
            //   0f8efc010000         | dec                 esp
            //   0fbf45ec             | mov                 dword ptr [esp + 0x50], edi

        $sequence_13 = { 00e0 3541000436 41 0023 }
            // n = 4, score = 100
            //   00e0                 | dec                 esp
            //   3541000436           | mov                 dword ptr [esp + 0x30], esi
            //   41                   | dec                 esp
            //   0023                 | lea                 eax, [ebp + 0x60a0]

        $sequence_14 = { 010b 014e4c 014e48 014e54 }
            // n = 4, score = 100
            //   010b                 | inc                 ecx
            //   014e4c               | or                  ecx, 0xffffffff
            //   014e48               | xor                 edx, edx
            //   014e54               | xor                 ecx, ecx

    condition:
        7 of them and filesize < 491520
}