rule win_eagerbee_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.eagerbee."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eagerbee"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { d3e0 ffc8 23c3 d3eb 03f8 418bc0 2b442418 }
            // n = 7, score = 100
            //   d3e0                 | mov                 dword ptr [esp + 0x38], eax
            //   ffc8                 | dec                 esp
            //   23c3                 | mov                 ecx, dword ptr [esp + 0x48]
            //   d3eb                 | dec                 ecx
            //   03f8                 | add                 ecx, 1
            //   418bc0               | movzx               ecx, byte ptr [esp + 0x50]
            //   2b442418             | dec                 eax

        $sequence_1 = { 448b9f94000000 488b0f 44899f84000000 e8???????? 4c8b1f 41837b1800 0f8422ffffff }
            // n = 7, score = 100
            //   448b9f94000000       | je                  0x452
            //   488b0f               | dec                 eax
            //   44899f84000000       | lea                 ecx, [0x16e13]
            //   e8????????           |                     
            //   4c8b1f               | dec                 eax
            //   41837b1800           | cmp                 eax, ecx
            //   0f8422ffffff         | je                  0x452

        $sequence_2 = { 664489bc24a2000000 664489b424a6000000 6689b424a8000000 6644898424aa000000 6644898c24ac000000 6644899424ae000000 }
            // n = 6, score = 100
            //   664489bc24a2000000     | mov    edi, edi
            //   664489b424a6000000     | inc    ecx
            //   6689b424a8000000     | cmp                 ebx, edi
            //   6644898424aa000000     | jle    0xf6e
            //   6644898c24ac000000     | jmp    0xef9
            //   6644899424ae000000     | or    dword ptr [ecx + 0x1f7], 0xffffffff

        $sequence_3 = { 4c896038 498bd4 4d3be4 7411 8378280f 740b 33c9 }
            // n = 7, score = 100
            //   4c896038             | mov                 ebx, esi
            //   498bd4               | dec                 eax
            //   4d3be4               | lea                 edx, [0x19983]
            //   7411                 | xor                 ecx, ecx
            //   8378280f             | dec                 eax
            //   740b                 | mov                 edi, eax
            //   33c9                 | jle                 0x8c3

        $sequence_4 = { 4084f6 0f8583010000 488b542450 8a0b 4533f6 80f90a 488d2d1c500100 }
            // n = 7, score = 100
            //   4084f6               | mov                 dword ptr [eax + 0x18], esi
            //   0f8583010000         | push                edi
            //   488b542450           | dec                 eax
            //   8a0b                 | sub                 esp, 0x50
            //   4533f6               | dec                 eax
            //   80f90a               | and                 dword ptr [eax - 0x28], 0
            //   488d2d1c500100       | inc                 ecx

        $sequence_5 = { c644247479 c644247570 c644247674 c64424774d c644247865 c644247973 }
            // n = 6, score = 100
            //   c644247479           | arpl                word ptr [edi + 0x149c], ax
            //   c644247570           | mov                 dword ptr [edi + eax*4 + 0xba8], ecx
            //   c644247674           | inc                 ecx
            //   c64424774d           | mov                 ecx, ebp
            //   c644247865           | mov                 dword ptr [esp + 0x24], ecx
            //   c644247973           | jge                 0x722

        $sequence_6 = { 488d4c2440 40886c2441 c64424426e 40887c2443 c644244461 }
            // n = 5, score = 100
            //   488d4c2440           | inc                 esp
            //   40886c2441           | lea                 eax, [edx + 0x30]
            //   c64424426e           | dec                 eax
            //   40887c2443           | lea                 ecx, [esp + 0xc8]
            //   c644244461           | dec                 eax

        $sequence_7 = { 8389f7010000ff 0fb7842458010000 4883c150 89818b000000 e8???????? 488b3d???????? 488d1524a00100 }
            // n = 7, score = 100
            //   8389f7010000ff       | mov                 byte ptr [esp + 0x64], 0x79
            //   0fb7842458010000     | mov                 byte ptr [esp + 0x65], 0x70
            //   4883c150             | mov                 byte ptr [esp + 0x66], 0x74
            //   89818b000000         | mov                 byte ptr [esp + 0x67], 0x4d
            //   e8????????           |                     
            //   488b3d????????       |                     
            //   488d1524a00100       | mov                 byte ptr [esp + 0x68], 0x65

        $sequence_8 = { 85d2 7fed d1e9 6642890c8e 49ffc1 4d3bca }
            // n = 6, score = 100
            //   85d2                 | mov                 eax, 0x8000
            //   7fed                 | dec                 eax
            //   d1e9                 | mov                 ecx, edi
            //   6642890c8e           | call                dword ptr [eax + 0x209]
            //   49ffc1               | mov                 edx, dword ptr [esp + 0xd0]
            //   4d3bca               | xor                 edx, edx

        $sequence_9 = { 8905???????? e8???????? 488d0d5bf90000 48891d???????? e8???????? 488d15a4a80100 }
            // n = 6, score = 100
            //   8905????????         |                     
            //   e8????????           |                     
            //   488d0d5bf90000       | dec                 eax
            //   48891d????????       |                     
            //   e8????????           |                     
            //   488d15a4a80100       | mov                 ecx, ebx

    condition:
        7 of them and filesize < 422912
}

rule win_eagerbee_w0 {
    meta:
        author = "Elastic Security"
        creation_date = "2023-09-04"
        last_modified = "2023-09-20"
        threat_name = "Windows.Trojan.EagerBee"
        reference_sample = "339e4fdbccb65b0b06a1421c719300a8da844789a2016d58e8ce4227cb5dc91b"
        license = "Elastic License v2"
        os = "windows"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eagerbee"
        malpedia_rule_date = "20231009"
        malpedia_hash = ""
        malpedia_version = "20231009"
        malpedia_license = ""
        malpedia_sharing = "TLP:WHITE"

    strings:
        $dexor_config_file = { 48 FF C0 8D 51 FF 44 30 00 49 03 C4 49 2B D4 ?? ?? 48 8D 4F 01 48 }
        $parse_config = { 80 7C 14 20 3A ?? ?? ?? ?? ?? ?? 45 03 C4 49 03 D4 49 63 C0 48 3B C1 }
        $parse_proxy1 = { 44 88 7C 24 31 44 88 7C 24 32 48 F7 D1 C6 44 24 33 70 C6 44 24 34 3D 88 5C 24 35 48 83 F9 01 }
        $parse_proxy2 = { 33 C0 48 8D BC 24 F0 00 00 00 49 8B CE F2 AE 8B D3 48 F7 D1 48 83 E9 01 48 8B F9 }

    condition:
        2 of them
}