rule win_emotet_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2019-11-26"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator 0.1a"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
        malpedia_version = "20190204"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach will be published in the near future here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */

    strings:
        $sequence_0 = { 83c020 eb03 0fb7c0 69d23f000100 }
            // n = 4, score = 1600
            //   83c020               | add                 eax, 0x20
            //   eb03                 | jmp                 5
            //   0fb7c0               | movzx               eax, ax
            //   69d23f000100         | imul                edx, edx, 0x1003f

        $sequence_1 = { c1e807 46 83f87f 77f7 }
            // n = 4, score = 1500
            //   c1e807               | shr                 eax, 7
            //   46                   | inc                 esi
            //   83f87f               | cmp                 eax, 0x7f
            //   77f7                 | ja                  0xfffffff9

        $sequence_2 = { 3903 5f 5e 0f95c0 5b 8be5 }
            // n = 6, score = 1300
            //   3903                 | cmp                 dword ptr [ebx], eax
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   0f95c0               | setne               al
            //   5b                   | pop                 ebx
            //   8be5                 | mov                 esp, ebp

        $sequence_3 = { 03d0 0fb701 6685c0 75d6 }
            // n = 4, score = 1300
            //   03d0                 | add                 edx, eax
            //   0fb701               | movzx               eax, word ptr [ecx]
            //   6685c0               | test                ax, ax
            //   75d6                 | jne                 0xffffffd8

        $sequence_4 = { 0fb7c0 69d23f000100 83c102 03d0 0fb701 }
            // n = 5, score = 1300
            //   0fb7c0               | movzx               eax, ax
            //   69d23f000100         | imul                edx, edx, 0x1003f
            //   83c102               | add                 ecx, 2
            //   03d0                 | add                 edx, eax
            //   0fb701               | movzx               eax, word ptr [ecx]

        $sequence_5 = { 6685c0 7430 8d9b00000000 6683f841 720e 6683f85a }
            // n = 6, score = 1300
            //   6685c0               | test                ax, ax
            //   7430                 | je                  0x32
            //   8d9b00000000         | lea                 ebx, [ebx]
            //   6683f841             | cmp                 ax, 0x41
            //   720e                 | jb                  0x10
            //   6683f85a             | cmp                 ax, 0x5a

        $sequence_6 = { 8d5801 f6c30f 7406 83e3f0 }
            // n = 4, score = 1300
            //   8d5801               | lea                 ebx, [eax + 1]
            //   f6c30f               | test                bl, 0xf
            //   7406                 | je                  8
            //   83e3f0               | and                 ebx, 0xfffffff0

        $sequence_7 = { 0fb701 33d2 6685c0 7430 }
            // n = 4, score = 1300
            //   0fb701               | movzx               eax, word ptr [ecx]
            //   33d2                 | xor                 edx, edx
            //   6685c0               | test                ax, ax
            //   7430                 | je                  0x32

        $sequence_8 = { 2b4770 8901 8b477c 85c0 7448 }
            // n = 5, score = 1200
            //   2b4770               | sub                 eax, dword ptr [edi + 0x70]
            //   8901                 | mov                 dword ptr [ecx], eax
            //   8b477c               | mov                 eax, dword ptr [edi + 0x7c]
            //   85c0                 | test                eax, eax
            //   7448                 | je                  0x4a

        $sequence_9 = { 8b4d0c 8bc2 0bc1 83f8ff }
            // n = 4, score = 1200
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8bc2                 | mov                 eax, edx
            //   0bc1                 | or                  eax, ecx
            //   83f8ff               | cmp                 eax, -1

        $sequence_10 = { 8b4508 894dcc 8d4dc8 8945c8 }
            // n = 4, score = 1200
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   894dcc               | mov                 dword ptr [ebp - 0x34], ecx
            //   8d4dc8               | lea                 ecx, [ebp - 0x38]
            //   8945c8               | mov                 dword ptr [ebp - 0x38], eax

        $sequence_11 = { ff15???????? 017758 83c40c 29775c 8b477c }
            // n = 5, score = 1200
            //   ff15????????         |                     
            //   017758               | add                 dword ptr [edi + 0x58], esi
            //   83c40c               | add                 esp, 0xc
            //   29775c               | sub                 dword ptr [edi + 0x5c], esi
            //   8b477c               | mov                 eax, dword ptr [edi + 0x7c]

        $sequence_12 = { 7907 83c107 3bf7 72e8 }
            // n = 4, score = 1100
            //   7907                 | jns                 9
            //   83c107               | add                 ecx, 7
            //   3bf7                 | cmp                 esi, edi
            //   72e8                 | jb                  0xffffffea

        $sequence_13 = { 83f87f 760d 8d642400 c1e807 }
            // n = 4, score = 900
            //   83f87f               | cmp                 eax, 0x7f
            //   760d                 | jbe                 0xf
            //   8d642400             | lea                 esp, [esp]
            //   c1e807               | shr                 eax, 7

        $sequence_14 = { b901000000 83f87f 7609 c1e807 41 83f87f 77f7 }
            // n = 7, score = 900
            //   b901000000           | mov                 ecx, 1
            //   83f87f               | cmp                 eax, 0x7f
            //   7609                 | jbe                 0xb
            //   c1e807               | shr                 eax, 7
            //   41                   | inc                 ecx
            //   83f87f               | cmp                 eax, 0x7f
            //   77f7                 | ja                  0xfffffff9

        $sequence_15 = { 6a00 6aff 50 51 ff15???????? }
            // n = 5, score = 800
            //   6a00                 | push                0
            //   6aff                 | push                -1
            //   50                   | push                eax
            //   51                   | push                ecx
            //   ff15????????         |                     

        $sequence_16 = { 50 6a00 6a01 6a00 ff15???????? a3???????? }
            // n = 6, score = 800
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6a01                 | push                1
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   a3????????           |                     

        $sequence_17 = { 8b5d08 b8afa96e5e 56 57 }
            // n = 4, score = 700
            //   8b5d08               | mov                 ebx, dword ptr [ebp + 8]
            //   b8afa96e5e           | mov                 eax, 0x5e6ea9af
            //   56                   | push                esi
            //   57                   | push                edi

        $sequence_18 = { 56 ff15???????? 8bf8 85ff 743a }
            // n = 5, score = 700
            //   56                   | push                esi
            //   ff15????????         |                     
            //   8bf8                 | mov                 edi, eax
            //   85ff                 | test                edi, edi
            //   743a                 | je                  0x3c

        $sequence_19 = { 53 56 8bf1 bb00c34c84 }
            // n = 4, score = 600
            //   53                   | push                ebx
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx
            //   bb00c34c84           | mov                 ebx, 0x844cc300

        $sequence_20 = { 8bec 83ec14 53 8b5d08 b8afa96e5e }
            // n = 5, score = 600
            //   8bec                 | mov                 ebp, esp
            //   83ec14               | sub                 esp, 0x14
            //   53                   | push                ebx
            //   8b5d08               | mov                 ebx, dword ptr [ebp + 8]
            //   b8afa96e5e           | mov                 eax, 0x5e6ea9af

        $sequence_21 = { 6a03 6a00 6a00 ff7508 53 }
            // n = 5, score = 500
            //   6a03                 | push                3
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   ff7508               | push                dword ptr [ebp + 8]
            //   53                   | push                ebx

        $sequence_22 = { 8b45f0 8b8880000000 8b55f4 01ca 89d6 83c60c 8b7df4 }
            // n = 7, score = 500
            //   8b45f0               | mov                 eax, dword ptr [ebp - 0x10]
            //   8b8880000000         | mov                 ecx, dword ptr [eax + 0x80]
            //   8b55f4               | mov                 edx, dword ptr [ebp - 0xc]
            //   01ca                 | add                 edx, ecx
            //   89d6                 | mov                 esi, edx
            //   83c60c               | add                 esi, 0xc
            //   8b7df4               | mov                 edi, dword ptr [ebp - 0xc]

        $sequence_23 = { 89d6 83c604 8b7de0 8b4c0f04 83f900 }
            // n = 5, score = 500
            //   89d6                 | mov                 esi, edx
            //   83c604               | add                 esi, 4
            //   8b7de0               | mov                 edi, dword ptr [ebp - 0x20]
            //   8b4c0f04             | mov                 ecx, dword ptr [edi + ecx + 4]
            //   83f900               | cmp                 ecx, 0

        $sequence_24 = { 8bf1 bb00c34c84 57 33ff }
            // n = 4, score = 500
            //   8bf1                 | mov                 esi, ecx
            //   bb00c34c84           | mov                 ebx, 0x844cc300
            //   57                   | push                edi
            //   33ff                 | xor                 edi, edi

        $sequence_25 = { 0f97c7 08fb f6c301 89f0 }
            // n = 4, score = 500
            //   0f97c7               | seta                bh
            //   08fb                 | or                  bl, bh
            //   f6c301               | test                bl, 1
            //   89f0                 | mov                 eax, esi

        $sequence_26 = { 0fb74c3814 03c7 53 55 8b6c240c 56 8d740118 }
            // n = 7, score = 500
            //   0fb74c3814           | movzx               ecx, word ptr [eax + edi + 0x14]
            //   03c7                 | add                 eax, edi
            //   53                   | push                ebx
            //   55                   | push                ebp
            //   8b6c240c             | mov                 ebp, dword ptr [esp + 0xc]
            //   56                   | push                esi
            //   8d740118             | lea                 esi, [ecx + eax + 0x18]

        $sequence_27 = { 8b5de8 39df 0f97c3 8945a8 }
            // n = 4, score = 500
            //   8b5de8               | mov                 ebx, dword ptr [ebp - 0x18]
            //   39df                 | cmp                 edi, ebx
            //   0f97c3               | seta                bl
            //   8945a8               | mov                 dword ptr [ebp - 0x58], eax

        $sequence_28 = { 8b450c 8b4d08 31d2 8945f4 894df0 }
            // n = 5, score = 500
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   31d2                 | xor                 edx, edx
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   894df0               | mov                 dword ptr [ebp - 0x10], ecx

        $sequence_29 = { 8b45e8 83c001 3dff000000 8945ec }
            // n = 4, score = 500
            //   8b45e8               | mov                 eax, dword ptr [ebp - 0x18]
            //   83c001               | add                 eax, 1
            //   3dff000000           | cmp                 eax, 0xff
            //   8945ec               | mov                 dword ptr [ebp - 0x14], eax

        $sequence_30 = { 83ec10 53 6a00 8d45fc }
            // n = 4, score = 500
            //   83ec10               | sub                 esp, 0x10
            //   53                   | push                ebx
            //   6a00                 | push                0
            //   8d45fc               | lea                 eax, [ebp - 4]

        $sequence_31 = { 83ec48 53 56 57 6a44 }
            // n = 5, score = 500
            //   83ec48               | sub                 esp, 0x48
            //   53                   | push                ebx
            //   56                   | push                esi
            //   57                   | push                edi
            //   6a44                 | push                0x44

        $sequence_32 = { 8b7020 8b7840 89c3 83c33c }
            // n = 4, score = 300
            //   8b7020               | mov                 esi, dword ptr [eax + 0x20]
            //   8b7840               | mov                 edi, dword ptr [eax + 0x40]
            //   89c3                 | mov                 ebx, eax
            //   83c33c               | add                 ebx, 0x3c

        $sequence_33 = { 31f6 89720c 897208 897204 }
            // n = 4, score = 200
            //   31f6                 | xor                 esi, esi
            //   89720c               | mov                 dword ptr [edx + 0xc], esi
            //   897208               | mov                 dword ptr [edx + 8], esi
            //   897204               | mov                 dword ptr [edx + 4], esi

        $sequence_34 = { 31c9 89e2 31f6 89720c }
            // n = 4, score = 200
            //   31c9                 | xor                 ecx, ecx
            //   89e2                 | mov                 edx, esp
            //   31f6                 | xor                 esi, esi
            //   89720c               | mov                 dword ptr [edx + 0xc], esi

        $sequence_35 = { 48 8d4c2440 48 89442420 ff15???????? 48 }
            // n = 6, score = 100
            //   48                   | dec                 eax
            //   8d4c2440             | lea                 ecx, [esp + 0x40]
            //   48                   | dec                 eax
            //   89442420             | mov                 dword ptr [esp + 0x20], eax
            //   ff15????????         |                     
            //   48                   | dec                 eax

        $sequence_36 = { 52 56 b828000000 e8???????? 84c0 }
            // n = 5, score = 100
            //   52                   | push                edx
            //   56                   | push                esi
            //   b828000000           | mov                 eax, 0x28
            //   e8????????           |                     
            //   84c0                 | test                al, al

        $sequence_37 = { 41 83c4fc 45 8bc4 e8???????? 48 8b8dd8000000 }
            // n = 7, score = 100
            //   41                   | inc                 ecx
            //   83c4fc               | add                 esp, -4
            //   45                   | inc                 ebp
            //   8bc4                 | mov                 eax, esp
            //   e8????????           |                     
            //   48                   | dec                 eax
            //   8b8dd8000000         | mov                 ecx, dword ptr [ebp + 0xd8]

        $sequence_38 = { 745c 0fb74e14 8b450c 8b54312c 8938 8b4508 8d7c3118 }
            // n = 7, score = 100
            //   745c                 | je                  0x5e
            //   0fb74e14             | movzx               ecx, word ptr [esi + 0x14]
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8b54312c             | mov                 edx, dword ptr [ecx + esi + 0x2c]
            //   8938                 | mov                 dword ptr [eax], edi
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   8d7c3118             | lea                 edi, [ecx + esi + 0x18]

        $sequence_39 = { 51 ff15???????? 85c0 740c 8b55e4 46 663b7206 }
            // n = 7, score = 100
            //   51                   | push                ecx
            //   ff15????????         |                     
            //   85c0                 | test                eax, eax
            //   740c                 | je                  0xe
            //   8b55e4               | mov                 edx, dword ptr [ebp - 0x1c]
            //   46                   | inc                 esi
            //   663b7206             | cmp                 si, word ptr [edx + 6]

        $sequence_40 = { 7463 6683f80b 7573 0fb706 c1e010 99 8bf8 }
            // n = 7, score = 100
            //   7463                 | je                  0x65
            //   6683f80b             | cmp                 ax, 0xb
            //   7573                 | jne                 0x75
            //   0fb706               | movzx               eax, word ptr [esi]
            //   c1e010               | shl                 eax, 0x10
            //   99                   | cdq                 
            //   8bf8                 | mov                 edi, eax

        $sequence_41 = { 8b45f4 83c0fc 50 8d4b04 51 57 }
            // n = 6, score = 100
            //   8b45f4               | mov                 eax, dword ptr [ebp - 0xc]
            //   83c0fc               | add                 eax, -4
            //   50                   | push                eax
            //   8d4b04               | lea                 ecx, [ebx + 4]
            //   51                   | push                ecx
            //   57                   | push                edi

        $sequence_42 = { 89e8 894c247c 8b8c2480000000 01c8 83c1c0 81f9c00f0000 }
            // n = 6, score = 100
            //   89e8                 | mov                 eax, ebp
            //   894c247c             | mov                 dword ptr [esp + 0x7c], ecx
            //   8b8c2480000000       | mov                 ecx, dword ptr [esp + 0x80]
            //   01c8                 | add                 eax, ecx
            //   83c1c0               | add                 ecx, -0x40
            //   81f9c00f0000         | cmp                 ecx, 0xfc0

        $sequence_43 = { 8b542444 8b723c 8b7e3c 89f3 }
            // n = 4, score = 100
            //   8b542444             | mov                 edx, dword ptr [esp + 0x44]
            //   8b723c               | mov                 esi, dword ptr [edx + 0x3c]
            //   8b7e3c               | mov                 edi, dword ptr [esi + 0x3c]
            //   89f3                 | mov                 ebx, esi

        $sequence_44 = { f20f11942480000000 f20f114c2458 89442454 0f84fcfeffff e9???????? }
            // n = 5, score = 100
            //   f20f11942480000000     | movsd    qword ptr [esp + 0x80], xmm2
            //   f20f114c2458         | movsd               qword ptr [esp + 0x58], xmm1
            //   89442454             | mov                 dword ptr [esp + 0x54], eax
            //   0f84fcfeffff         | je                  0xffffff02
            //   e9????????           |                     

        $sequence_45 = { 81c490030000 5b c3 32c0 48 81c490030000 }
            // n = 6, score = 100
            //   81c490030000         | add                 esp, 0x390
            //   5b                   | pop                 ebx
            //   c3                   | ret                 
            //   32c0                 | xor                 al, al
            //   48                   | dec                 eax
            //   81c490030000         | add                 esp, 0x390

        $sequence_46 = { 8b442444 890424 f20f11442410 e8???????? 31c9 8b542444 8b723c }
            // n = 7, score = 100
            //   8b442444             | mov                 eax, dword ptr [esp + 0x44]
            //   890424               | mov                 dword ptr [esp], eax
            //   f20f11442410         | movsd               qword ptr [esp + 0x10], xmm0
            //   e8????????           |                     
            //   31c9                 | xor                 ecx, ecx
            //   8b542444             | mov                 edx, dword ptr [esp + 0x44]
            //   8b723c               | mov                 esi, dword ptr [edx + 0x3c]

        $sequence_47 = { f20f11442470 894c246c ffd2 83ec10 }
            // n = 4, score = 100
            //   f20f11442470         | movsd               qword ptr [esp + 0x70], xmm0
            //   894c246c             | mov                 dword ptr [esp + 0x6c], ecx
            //   ffd2                 | call                edx
            //   83ec10               | sub                 esp, 0x10

    condition:
        7 of them
}