rule win_emotet_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2018-11-23"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator 0.1a"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
        malpedia_version = "20180607"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach will be published in the near future here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */

    strings:
        $sequence_0 = { c1e807 41 83f87f 77f7 }
            // n = 4, score = 8000
            //   c1e807               | shr                 eax, 7
            //   41                   | inc                 ecx
            //   83f87f               | cmp                 eax, 0x7f
            //   77f7                 | ja                  0x1e72a18

        $sequence_1 = { c1e807 46 83f87f 77f7 }
            // n = 4, score = 8000
            //   c1e807               | shr                 eax, 7
            //   46                   | inc                 esi
            //   83f87f               | cmp                 eax, 0x7f
            //   77f7                 | ja                  0x1e72a00

        $sequence_2 = { b901000000 83f87f 7609 c1e807 }
            // n = 4, score = 6000
            //   b901000000           | mov                 ecx, 1
            //   83f87f               | cmp                 eax, 0x7f
            //   7609                 | jbe                 0x1e72a21
            //   c1e807               | shr                 eax, 7

        $sequence_3 = { c1e807 42 83f87f 77f7 }
            // n = 4, score = 6000
            //   c1e807               | shr                 eax, 7
            //   42                   | inc                 edx
            //   83f87f               | cmp                 eax, 0x7f
            //   77f7                 | ja                  0x1e72997

        $sequence_4 = { 83f87f 7609 c1e807 41 }
            // n = 4, score = 6000
            //   83f87f               | cmp                 eax, 0x7f
            //   7609                 | jbe                 0x1e72a21
            //   c1e807               | shr                 eax, 7
            //   41                   | inc                 ecx

        $sequence_5 = { 7907 83c107 3bf7 72e8 }
            // n = 4, score = 6000
            //   7907                 | jns                 0x1e72ab0
            //   83c107               | add                 ecx, 7
            //   3bf7                 | cmp                 esi, edi
            //   72e8                 | jb                  0x1e72a98

        $sequence_6 = { 7609 c1e807 41 83f87f }
            // n = 4, score = 6000
            //   7609                 | jbe                 0x1e72a21
            //   c1e807               | shr                 eax, 7
            //   41                   | inc                 ecx
            //   83f87f               | cmp                 eax, 0x7f

        $sequence_7 = { 7609 c1e807 41 83f87f 77f7 }
            // n = 5, score = 6000
            //   7609                 | jbe                 0x1e72a21
            //   c1e807               | shr                 eax, 7
            //   41                   | inc                 ecx
            //   83f87f               | cmp                 eax, 0x7f
            //   77f7                 | ja                  0x1e72a18

        $sequence_8 = { b901000000 83f87f 7609 c1e807 41 }
            // n = 5, score = 6000
            //   b901000000           | mov                 ecx, 1
            //   83f87f               | cmp                 eax, 0x7f
            //   7609                 | jbe                 0x1e72a21
            //   c1e807               | shr                 eax, 7
            //   41                   | inc                 ecx

        $sequence_9 = { 83f87f 7609 c1e807 41 83f87f }
            // n = 5, score = 6000
            //   83f87f               | cmp                 eax, 0x7f
            //   7609                 | jbe                 0x1e72a21
            //   c1e807               | shr                 eax, 7
            //   41                   | inc                 ecx
            //   83f87f               | cmp                 eax, 0x7f

    condition:
        7 of them
}