rule win_emotet_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-08-17"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.4.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.emotet"
        malpedia_rule_date = "20200817"
        malpedia_hash = "8c895fd01eccb47a6225bcb1a3ba53cbb98644c5"
        malpedia_version = "20200817"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using yara-signator.
     * The code and documentation / approach is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 0fb7c0 83c020 eb03 0fb7c0 69d23f000100 }
            // n = 5, score = 1800
            //   0fb7c0               | movzx               eax, ax
            //   83c020               | add                 eax, 0x20
            //   eb03                 | jmp                 5
            //   0fb7c0               | movzx               eax, ax
            //   69d23f000100         | imul                edx, edx, 0x1003f

        $sequence_1 = { 3903 5f 5e 0f95c0 5b 8be5 }
            // n = 6, score = 1600
            //   3903                 | cmp                 dword ptr [ebx], eax
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi
            //   0f95c0               | setne               al
            //   5b                   | pop                 ebx
            //   8be5                 | mov                 esp, ebp

        $sequence_2 = { 8d5801 f6c30f 7406 83e3f0 83c310 }
            // n = 5, score = 1500
            //   8d5801               | lea                 ebx, [eax + 1]
            //   f6c30f               | test                bl, 0xf
            //   7406                 | je                  8
            //   83e3f0               | and                 ebx, 0xfffffff0
            //   83c310               | add                 ebx, 0x10

        $sequence_3 = { c1e807 46 83f87f 77f7 }
            // n = 4, score = 1500
            //   c1e807               | shr                 eax, 7
            //   46                   | inc                 esi
            //   83f87f               | cmp                 eax, 0x7f
            //   77f7                 | ja                  0xfffffff9

        $sequence_4 = { 03878c000000 50 ff15???????? 017758 }
            // n = 4, score = 1400
            //   03878c000000         | add                 eax, dword ptr [edi + 0x8c]
            //   50                   | push                eax
            //   ff15????????         |                     
            //   017758               | add                 dword ptr [edi + 0x58], esi

        $sequence_5 = { 83c40c 8b4d0c 8bc2 0bc1 83f8ff }
            // n = 5, score = 1400
            //   83c40c               | add                 esp, 0xc
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8bc2                 | mov                 eax, edx
            //   0bc1                 | or                  eax, ecx
            //   83f8ff               | cmp                 eax, -1

        $sequence_6 = { 8945fc 8d45f8 6a04 50 ff760c }
            // n = 5, score = 1400
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   8d45f8               | lea                 eax, [ebp - 8]
            //   6a04                 | push                4
            //   50                   | push                eax
            //   ff760c               | push                dword ptr [esi + 0xc]

        $sequence_7 = { 8901 8b477c 85c0 7448 }
            // n = 4, score = 1400
            //   8901                 | mov                 dword ptr [ecx], eax
            //   8b477c               | mov                 eax, dword ptr [edi + 0x7c]
            //   85c0                 | test                eax, eax
            //   7448                 | je                  0x4a

        $sequence_8 = { 8b4508 894dcc 8d4dc8 8945c8 8975d4 8955d8 }
            // n = 6, score = 1400
            //   8b4508               | mov                 eax, dword ptr [ebp + 8]
            //   894dcc               | mov                 dword ptr [ebp - 0x34], ecx
            //   8d4dc8               | lea                 ecx, [ebp - 0x38]
            //   8945c8               | mov                 dword ptr [ebp - 0x38], eax
            //   8975d4               | mov                 dword ptr [ebp - 0x2c], esi
            //   8955d8               | mov                 dword ptr [ebp - 0x28], edx

        $sequence_9 = { 8bf1 ff15???????? 8b17 83c40c 8b4d0c }
            // n = 5, score = 1400
            //   8bf1                 | mov                 esi, ecx
            //   ff15????????         |                     
            //   8b17                 | mov                 edx, dword ptr [edi]
            //   83c40c               | add                 esp, 0xc
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]

        $sequence_10 = { 56 57 8b780c 8bd9 83c70c 8b37 }
            // n = 6, score = 1100
            //   56                   | push                esi
            //   57                   | push                edi
            //   8b780c               | mov                 edi, dword ptr [eax + 0xc]
            //   8bd9                 | mov                 ebx, ecx
            //   83c70c               | add                 edi, 0xc
            //   8b37                 | mov                 esi, dword ptr [edi]

        $sequence_11 = { 7907 83c107 3bf7 72e8 }
            // n = 4, score = 1100
            //   7907                 | jns                 9
            //   83c107               | add                 ecx, 7
            //   3bf7                 | cmp                 esi, edi
            //   72e8                 | jb                  0xffffffea

        $sequence_12 = { c745fc04000000 50 8d45f8 81ca00000020 50 52 51 }
            // n = 7, score = 1000
            //   c745fc04000000       | mov                 dword ptr [ebp - 4], 4
            //   50                   | push                eax
            //   8d45f8               | lea                 eax, [ebp - 8]
            //   81ca00000020         | or                  edx, 0x20000000
            //   50                   | push                eax
            //   52                   | push                edx
            //   51                   | push                ecx

        $sequence_13 = { f7d8 1bc0 2345f8 8be5 5d }
            // n = 5, score = 900
            //   f7d8                 | neg                 eax
            //   1bc0                 | sbb                 eax, eax
            //   2345f8               | and                 eax, dword ptr [ebp - 8]
            //   8be5                 | mov                 esp, ebp
            //   5d                   | pop                 ebp

        $sequence_14 = { 83f87f 7609 c1e807 41 }
            // n = 4, score = 900
            //   83f87f               | cmp                 eax, 0x7f
            //   7609                 | jbe                 0xb
            //   c1e807               | shr                 eax, 7
            //   41                   | inc                 ecx

        $sequence_15 = { 83f87f 760d 8d642400 c1e807 }
            // n = 4, score = 900
            //   83f87f               | cmp                 eax, 0x7f
            //   760d                 | jbe                 0xf
            //   8d642400             | lea                 esp, [esp]
            //   c1e807               | shr                 eax, 7

        $sequence_16 = { c60158 41 803900 75dd }
            // n = 4, score = 800
            //   c60158               | mov                 byte ptr [ecx], 0x58
            //   41                   | inc                 ecx
            //   803900               | cmp                 byte ptr [ecx], 0
            //   75dd                 | jne                 0xffffffdf

        $sequence_17 = { 50 6a00 6a01 6a00 ff15???????? a3???????? }
            // n = 6, score = 800
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6a01                 | push                1
            //   6a00                 | push                0
            //   ff15????????         |                     
            //   a3????????           |                     

        $sequence_18 = { 3c5a 7e03 c60158 41 }
            // n = 4, score = 800
            //   3c5a                 | cmp                 al, 0x5a
            //   7e03                 | jle                 5
            //   c60158               | mov                 byte ptr [ecx], 0x58
            //   41                   | inc                 ecx

        $sequence_19 = { 7e13 3c61 7c04 3c7a }
            // n = 4, score = 800
            //   7e13                 | jle                 0x15
            //   3c61                 | cmp                 al, 0x61
            //   7c04                 | jl                  6
            //   3c7a                 | cmp                 al, 0x7a

        $sequence_20 = { 6a00 6aff 50 51 ff15???????? }
            // n = 5, score = 800
            //   6a00                 | push                0
            //   6aff                 | push                -1
            //   50                   | push                eax
            //   51                   | push                ecx
            //   ff15????????         |                     

        $sequence_21 = { 52 52 52 68???????? 52 }
            // n = 5, score = 800
            //   52                   | push                edx
            //   52                   | push                edx
            //   52                   | push                edx
            //   68????????           |                     
            //   52                   | push                edx

        $sequence_22 = { 3c30 7c04 3c39 7e13 }
            // n = 4, score = 800
            //   3c30                 | cmp                 al, 0x30
            //   7c04                 | jl                  6
            //   3c39                 | cmp                 al, 0x39
            //   7e13                 | jle                 0x15

        $sequence_23 = { 7c04 3c7a 7e0b 3c41 7c04 3c5a 7e03 }
            // n = 7, score = 800
            //   7c04                 | jl                  6
            //   3c7a                 | cmp                 al, 0x7a
            //   7e0b                 | jle                 0xd
            //   3c41                 | cmp                 al, 0x41
            //   7c04                 | jl                  6
            //   3c5a                 | cmp                 al, 0x5a
            //   7e03                 | jle                 5

        $sequence_24 = { 83ec48 53 56 57 6a44 }
            // n = 5, score = 700
            //   83ec48               | sub                 esp, 0x48
            //   53                   | push                ebx
            //   56                   | push                esi
            //   57                   | push                edi
            //   6a44                 | push                0x44

        $sequence_25 = { 56 ff15???????? 8bf8 85ff 743a }
            // n = 5, score = 700
            //   56                   | push                esi
            //   ff15????????         |                     
            //   8bf8                 | mov                 edi, eax
            //   85ff                 | test                edi, edi
            //   743a                 | je                  0x3c

        $sequence_26 = { 8b5d08 b8afa96e5e 56 57 }
            // n = 4, score = 700
            //   8b5d08               | mov                 ebx, dword ptr [ebp + 8]
            //   b8afa96e5e           | mov                 eax, 0x5e6ea9af
            //   56                   | push                esi
            //   57                   | push                edi

        $sequence_27 = { 0fb70a 8bc1 81e100f00000 25ff0f0000 }
            // n = 4, score = 700
            //   0fb70a               | movzx               ecx, word ptr [edx]
            //   8bc1                 | mov                 eax, ecx
            //   81e100f00000         | and                 ecx, 0xf000
            //   25ff0f0000           | and                 eax, 0xfff

        $sequence_28 = { 8b450c 8b4918 8908 33c0 }
            // n = 4, score = 700
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   8b4918               | mov                 ecx, dword ptr [ecx + 0x18]
            //   8908                 | mov                 dword ptr [eax], ecx
            //   33c0                 | xor                 eax, eax

        $sequence_29 = { 53 56 8bf1 bb00c34c84 }
            // n = 4, score = 600
            //   53                   | push                ebx
            //   56                   | push                esi
            //   8bf1                 | mov                 esi, ecx
            //   bb00c34c84           | mov                 ebx, 0x844cc300

        $sequence_30 = { 8bec 83ec14 53 8b5d08 b8afa96e5e }
            // n = 5, score = 600
            //   8bec                 | mov                 ebp, esp
            //   83ec14               | sub                 esp, 0x14
            //   53                   | push                ebx
            //   8b5d08               | mov                 ebx, dword ptr [ebp + 8]
            //   b8afa96e5e           | mov                 eax, 0x5e6ea9af

        $sequence_31 = { 57 00b807000000 008b45fc33d2 00b871800780 00558b ec }
            // n = 6, score = 500
            //   57                   | push                edi
            //   00b807000000         | add                 byte ptr [eax + 7], bh
            //   008b45fc33d2         | add                 byte ptr [ebx - 0x2dcc03bb], cl
            //   00b871800780         | add                 byte ptr [eax - 0x7ff87f8f], bh
            //   00558b               | add                 byte ptr [ebp - 0x75], dl
            //   ec                   | in                  al, dx

        $sequence_32 = { 83c604 8b7de0 8b4c0f04 83f900 }
            // n = 4, score = 500
            //   83c604               | add                 esi, 4
            //   8b7de0               | mov                 edi, dword ptr [ebp - 0x20]
            //   8b4c0f04             | mov                 ecx, dword ptr [edi + ecx + 4]
            //   83f900               | cmp                 ecx, 0

        $sequence_33 = { 00b871800780 00558b ec 8b450c 00558b ec }
            // n = 6, score = 500
            //   00b871800780         | add                 byte ptr [eax - 0x7ff87f8f], bh
            //   00558b               | add                 byte ptr [ebp - 0x75], dl
            //   ec                   | in                  al, dx
            //   8b450c               | mov                 eax, dword ptr [ebp + 0xc]
            //   00558b               | add                 byte ptr [ebp - 0x75], dl
            //   ec                   | in                  al, dx

        $sequence_34 = { 83ec10 53 6a00 8d45fc }
            // n = 4, score = 500
            //   83ec10               | sub                 esp, 0x10
            //   53                   | push                ebx
            //   6a00                 | push                0
            //   8d45fc               | lea                 eax, [ebp - 4]

        $sequence_35 = { 8b4d0c 8b5508 befbffffff c600e9 29d6 01ce 897001 }
            // n = 7, score = 500
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   befbffffff           | mov                 esi, 0xfffffffb
            //   c600e9               | mov                 byte ptr [eax], 0xe9
            //   29d6                 | sub                 esi, edx
            //   01ce                 | add                 esi, ecx
            //   897001               | mov                 dword ptr [eax + 1], esi

        $sequence_36 = { 51 52 01c8 01d0 50 e8???????? 5a }
            // n = 7, score = 500
            //   51                   | push                ecx
            //   52                   | push                edx
            //   01c8                 | add                 eax, ecx
            //   01d0                 | add                 eax, edx
            //   50                   | push                eax
            //   e8????????           |                     
            //   5a                   | pop                 edx

        $sequence_37 = { 83fe00 8945f0 894dec 8955e8 8975e4 }
            // n = 5, score = 500
            //   83fe00               | cmp                 esi, 0
            //   8945f0               | mov                 dword ptr [ebp - 0x10], eax
            //   894dec               | mov                 dword ptr [ebp - 0x14], ecx
            //   8955e8               | mov                 dword ptr [ebp - 0x18], edx
            //   8975e4               | mov                 dword ptr [ebp - 0x1c], esi

        $sequence_38 = { 6a00 6a03 6a00 6a00 ff7508 53 50 }
            // n = 7, score = 500
            //   6a00                 | push                0
            //   6a03                 | push                3
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   ff7508               | push                dword ptr [ebp + 8]
            //   53                   | push                ebx
            //   50                   | push                eax

        $sequence_39 = { 8bf1 bb00c34c84 57 33ff }
            // n = 4, score = 500
            //   8bf1                 | mov                 esi, ecx
            //   bb00c34c84           | mov                 ebx, 0x844cc300
            //   57                   | push                edi
            //   33ff                 | xor                 edi, edi

        $sequence_40 = { 8b7020 8b7840 89c3 83c33c }
            // n = 4, score = 300
            //   8b7020               | mov                 esi, dword ptr [eax + 0x20]
            //   8b7840               | mov                 edi, dword ptr [eax + 0x40]
            //   89c3                 | mov                 ebx, eax
            //   83c33c               | add                 ebx, 0x3c

        $sequence_41 = { 31c9 89e2 31f6 89720c 897208 897204 }
            // n = 6, score = 200
            //   31c9                 | xor                 ecx, ecx
            //   89e2                 | mov                 edx, esp
            //   31f6                 | xor                 esi, esi
            //   89720c               | mov                 dword ptr [edx + 0xc], esi
            //   897208               | mov                 dword ptr [edx + 8], esi
            //   897204               | mov                 dword ptr [edx + 4], esi

        $sequence_42 = { e8???????? 84c0 75ba bf???????? e8???????? }
            // n = 5, score = 100
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   75ba                 | jne                 0xffffffbc
            //   bf????????           |                     
            //   e8????????           |                     

        $sequence_43 = { 48 8d0dcb4e0000 c744242880000000 89542420 45 }
            // n = 5, score = 100
            //   48                   | dec                 eax
            //   8d0dcb4e0000         | lea                 ecx, [0x4ecb]
            //   c744242880000000     | mov                 dword ptr [esp + 0x28], 0x80
            //   89542420             | mov                 dword ptr [esp + 0x20], edx
            //   45                   | inc                 ebp

        $sequence_44 = { 84c0 75ed 48 8d4c2420 e8???????? 48 8d4c2420 }
            // n = 7, score = 100
            //   84c0                 | test                al, al
            //   75ed                 | jne                 0xffffffef
            //   48                   | dec                 eax
            //   8d4c2420             | lea                 ecx, [esp + 0x20]
            //   e8????????           |                     
            //   48                   | dec                 eax
            //   8d4c2420             | lea                 ecx, [esp + 0x20]

        $sequence_45 = { 48 85c0 743e 8b5c2430 }
            // n = 4, score = 100
            //   48                   | dec                 eax
            //   85c0                 | test                eax, eax
            //   743e                 | je                  0x40
            //   8b5c2430             | mov                 ebx, dword ptr [esp + 0x30]

        $sequence_46 = { 7409 57 50 8ac3 e8???????? 5f }
            // n = 6, score = 100
            //   7409                 | je                  0xb
            //   57                   | push                edi
            //   50                   | push                eax
            //   8ac3                 | mov                 al, bl
            //   e8????????           |                     
            //   5f                   | pop                 edi

        $sequence_47 = { 50 8d8584fbffff 50 6a21 51 e8???????? 5f }
            // n = 7, score = 100
            //   50                   | push                eax
            //   8d8584fbffff         | lea                 eax, [ebp - 0x47c]
            //   50                   | push                eax
            //   6a21                 | push                0x21
            //   51                   | push                ecx
            //   e8????????           |                     
            //   5f                   | pop                 edi

        $sequence_48 = { 81fa50450000 0f44c1 89442460 8b442460 }
            // n = 4, score = 100
            //   81fa50450000         | cmp                 edx, 0x4550
            //   0f44c1               | cmove               eax, ecx
            //   89442460             | mov                 dword ptr [esp + 0x60], eax
            //   8b442460             | mov                 eax, dword ptr [esp + 0x60]

        $sequence_49 = { c3 83ec10 8b442414 8d0d6c30d800 31d2 890c24 }
            // n = 6, score = 100
            //   c3                   | ret                 
            //   83ec10               | sub                 esp, 0x10
            //   8b442414             | mov                 eax, dword ptr [esp + 0x14]
            //   8d0d6c30d800         | lea                 ecx, [0xd8306c]
            //   31d2                 | xor                 edx, edx
            //   890c24               | mov                 dword ptr [esp], ecx

        $sequence_50 = { e8???????? 3d00100000 745f e8???????? e8???????? 84c0 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   3d00100000           | cmp                 eax, 0x1000
            //   745f                 | je                  0x61
            //   e8????????           |                     
            //   e8????????           |                     
            //   84c0                 | test                al, al

        $sequence_51 = { f20f11442470 894c246c ffd2 83ec10 }
            // n = 4, score = 100
            //   f20f11442470         | movsd               qword ptr [esp + 0x70], xmm0
            //   894c246c             | mov                 dword ptr [esp + 0x6c], ecx
            //   ffd2                 | call                edx
            //   83ec10               | sub                 esp, 0x10

        $sequence_52 = { 8b6c2478 01dd 8b5924 89442424 89d8 c1e81e 83e001 }
            // n = 7, score = 100
            //   8b6c2478             | mov                 ebp, dword ptr [esp + 0x78]
            //   01dd                 | add                 ebp, ebx
            //   8b5924               | mov                 ebx, dword ptr [ecx + 0x24]
            //   89442424             | mov                 dword ptr [esp + 0x24], eax
            //   89d8                 | mov                 eax, ebx
            //   c1e81e               | shr                 eax, 0x1e
            //   83e001               | and                 eax, 1

        $sequence_53 = { e8???????? 0fb6d8 ff15???????? 48 8bce e8???????? 48 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   0fb6d8               | movzx               ebx, al
            //   ff15????????         |                     
            //   48                   | dec                 eax
            //   8bce                 | mov                 ecx, esi
            //   e8????????           |                     
            //   48                   | dec                 eax

        $sequence_54 = { f20f11842490000000 8984248c000000 0f843affffff e9???????? 8b442454 }
            // n = 5, score = 100
            //   f20f11842490000000     | movsd    qword ptr [esp + 0x90], xmm0
            //   8984248c000000       | mov                 dword ptr [esp + 0x8c], eax
            //   0f843affffff         | je                  0xffffff40
            //   e9????????           |                     
            //   8b442454             | mov                 eax, dword ptr [esp + 0x54]

        $sequence_55 = { c701???????? 8b4c241c 89442418 ffd1 83ec04 }
            // n = 5, score = 100
            //   c701????????         |                     
            //   8b4c241c             | mov                 ecx, dword ptr [esp + 0x1c]
            //   89442418             | mov                 dword ptr [esp + 0x18], eax
            //   ffd1                 | call                ecx
            //   83ec04               | sub                 esp, 4

    condition:
        7 of them and filesize < 253952
}