rule win_eddiestealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.eddiestealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.eddiestealer"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? ffc7 eb92 b928000000 4883f92b 7727 4c8d054a350500 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   ffc7                 | dec                 eax
            //   eb92                 | neg                 eax
            //   b928000000           | jno                 0x3e7
            //   4883f92b             | dec                 eax
            //   7727                 | lea                 edx, [esp + 0xc0]
            //   4c8d054a350500       | inc                 ecx

        $sequence_1 = { e8???????? 4889f1 4889da e8???????? 488d8c2470020000 e8???????? e9???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4889f1               | dec                 ecx
            //   4889da               | and                 ecx, 0xfffffff0
            //   e8????????           |                     
            //   488d8c2470020000     | dec                 ebp
            //   e8????????           |                     
            //   e9????????           |                     

        $sequence_2 = { 8a8c2470030000 4c8d442470 498900 41884808 488d05a2f70400 4889442420 488d0ddef00400 }
            // n = 7, score = 100
            //   8a8c2470030000       | dec                 eax
            //   4c8d442470           | lea                 edi, [esp + 0x48]
            //   498900               | dec                 eax
            //   41884808             | mov                 ecx, edi
            //   488d05a2f70400       | dec                 eax
            //   4889442420           | mov                 edx, eax
            //   488d0ddef00400       | cmp                 dword ptr [edi], 1

        $sequence_3 = { 740d 83f901 750c 4531d2 4531c9 eb5f 31c0 }
            // n = 7, score = 100
            //   740d                 | dec                 ecx
            //   83f901               | and                 dword ptr [esp + 0x20], 0
            //   750c                 | dec                 esp
            //   4531d2               | mov                 dword ptr [esi], ebp
            //   4531c9               | dec                 eax
            //   eb5f                 | lea                 eax, [0xe7c3]
            //   31c0                 | dec                 eax

        $sequence_4 = { e8???????? 0f57c0 0f29442460 0f29442470 0f1144247c 31d2 488d0d1b170500 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   0f57c0               | jmp                 0x42b
            //   0f29442460           | dec                 eax
            //   0f29442470           | mov                 ebx, dword ptr [esp + 0x228]
            //   0f1144247c           | dec                 esp
            //   31d2                 | mov                 eax, dword ptr [esp + 0x230]
            //   488d0d1b170500       | dec                 esp

        $sequence_5 = { e8???????? 0f57c0 4883a4248000000000 0f29442460 0f29442470 31c9 488d151fda0600 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   0f57c0               | dec                 eax
            //   4883a4248000000000     | mov    ecx, dword ptr [esp + 0x218]
            //   0f29442460           | dec                 esp
            //   0f29442470           | mov                 eax, dword ptr [esp + 0x21e]
            //   31c9                 | dec                 eax
            //   488d151fda0600       | mov                 dword ptr [edx], ecx

        $sequence_6 = { 750f 488d1502f70400 4889f1 e8???????? 488b4608 40883c18 48ffc3 }
            // n = 7, score = 100
            //   750f                 | pop                 eax
            //   488d1502f70400       | dec                 eax
            //   4889f1               | mov                 dword ptr [edi + 0x18], eax
            //   e8????????           |                     
            //   488b4608             | dec                 eax
            //   40883c18             | lea                 ecx, [ebp + 0x140]
            //   48ffc3               | dec                 eax

        $sequence_7 = { e8???????? 4889c7 488928 c7400803000000 4531ff 4983ff0c 7467 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4889c7               | cmp                 ebx, esi
            //   488928               | jae                 0xfb1
            //   c7400803000000       | dec                 eax
            //   4531ff               | add                 edi, edi
            //   4983ff0c             | dec                 eax
            //   7467                 | lea                 edx, [edi + edi*4]

        $sequence_8 = { 48895810 48897018 4c897020 48897828 4c896030 0f28b42440060000 4881c458060000 }
            // n = 7, score = 100
            //   48895810             | not                 ecx
            //   48897018             | setb                cl
            //   4c897020             | cmp                 ax, 0x7d
            //   48897828             | setae               al
            //   4c896030             | or                  al, cl
            //   0f28b42440060000     | inc                 ecx
            //   4881c458060000       | mov                 cl, 6

        $sequence_9 = { e8???????? 4c8b23 f30f7e4308 488b7b10 4889bc2430020000 488dbc2420020000 4c8927 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4c8b23               | dec                 esp
            //   f30f7e4308           | lea                 edi, [esp + 0x98]
            //   488b7b10             | dec                 ebp
            //   4889bc2430020000     | mov                 dword ptr [edi], esi
            //   488dbc2420020000     | dec                 eax
            //   4c8927               | lea                 eax, [0x533e0]

    condition:
        7 of them and filesize < 1316864
}