rule win_faketc_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.faketc."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.faketc"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c781f886000000000000 8b55f8 c7820487000000000000 8b45f8 c7805804000000000000 8b4df8 c7817004000005000000 }
            // n = 7, score = 100
            //   c781f886000000000000     | mov    dword ptr [ecx + 0x86f8], 0
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]
            //   c7820487000000000000     | mov    dword ptr [edx + 0x8704], 0
            //   8b45f8               | mov                 eax, dword ptr [ebp - 8]
            //   c7805804000000000000     | mov    dword ptr [eax + 0x458], 0
            //   8b4df8               | mov                 ecx, dword ptr [ebp - 8]
            //   c7817004000005000000     | mov    dword ptr [ecx + 0x470], 5

        $sequence_1 = { e8???????? bd10000000 33db 8d4c247c c684247012000005 e8???????? c684247012000004 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   bd10000000           | mov                 ebp, 0x10
            //   33db                 | xor                 ebx, ebx
            //   8d4c247c             | lea                 ecx, [esp + 0x7c]
            //   c684247012000005     | mov                 byte ptr [esp + 0x1270], 5
            //   e8????????           |                     
            //   c684247012000004     | mov                 byte ptr [esp + 0x1270], 4

        $sequence_2 = { e8???????? c7442424d0f14900 c744241840d24c00 c744241c14000000 e9???????? 8d942494000000 52 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   c7442424d0f14900     | mov                 dword ptr [esp + 0x24], 0x49f1d0
            //   c744241840d24c00     | mov                 dword ptr [esp + 0x18], 0x4cd240
            //   c744241c14000000     | mov                 dword ptr [esp + 0x1c], 0x14
            //   e9????????           |                     
            //   8d942494000000       | lea                 edx, [esp + 0x94]
            //   52                   | push                edx

        $sequence_3 = { eb35 8b45e4 50 68???????? 8b4de0 51 e8???????? }
            // n = 7, score = 100
            //   eb35                 | jmp                 0x37
            //   8b45e4               | mov                 eax, dword ptr [ebp - 0x1c]
            //   50                   | push                eax
            //   68????????           |                     
            //   8b4de0               | mov                 ecx, dword ptr [ebp - 0x20]
            //   51                   | push                ecx
            //   e8????????           |                     

        $sequence_4 = { ffd7 e9???????? 8d950cfdffff 8995a0fdffff 8bf2 c645fc1a e8???????? }
            // n = 7, score = 100
            //   ffd7                 | call                edi
            //   e9????????           |                     
            //   8d950cfdffff         | lea                 edx, [ebp - 0x2f4]
            //   8995a0fdffff         | mov                 dword ptr [ebp - 0x260], edx
            //   8bf2                 | mov                 esi, edx
            //   c645fc1a             | mov                 byte ptr [ebp - 4], 0x1a
            //   e8????????           |                     

        $sequence_5 = { d0bed0b2d0b0 d0bdd0bdd18b d0b520d182d0 bed0bcd0b0 3c2f 636f6e 7472 }
            // n = 7, score = 100
            //   d0bed0b2d0b0         | sar                 byte ptr [esi - 0x4f2f4d30], 1
            //   d0bdd0bdd18b         | sar                 byte ptr [ebp - 0x742e4230], 1
            //   d0b520d182d0         | sal                 byte ptr [ebp - 0x2f7d2ee0], 1
            //   bed0bcd0b0           | mov                 esi, 0xb0d0bcd0
            //   3c2f                 | cmp                 al, 0x2f
            //   636f6e               | arpl                word ptr [edi + 0x6e], bp
            //   7472                 | je                  0x74

        $sequence_6 = { e8???????? 83c40c e9???????? 8d9584f6ffff 52 8b4510 50 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   e9????????           |                     
            //   8d9584f6ffff         | lea                 edx, [ebp - 0x97c]
            //   52                   | push                edx
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   50                   | push                eax

        $sequence_7 = { 8b74240c 8b16 8d4c2420 51 8d4608 52 e8???????? }
            // n = 7, score = 100
            //   8b74240c             | mov                 esi, dword ptr [esp + 0xc]
            //   8b16                 | mov                 edx, dword ptr [esi]
            //   8d4c2420             | lea                 ecx, [esp + 0x20]
            //   51                   | push                ecx
            //   8d4608               | lea                 eax, [esi + 8]
            //   52                   | push                edx
            //   e8????????           |                     

        $sequence_8 = { e8???????? 8b4af4 33c8 e8???????? b8???????? e9???????? 8d85d4f9ffff }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8b4af4               | mov                 ecx, dword ptr [edx - 0xc]
            //   33c8                 | xor                 ecx, eax
            //   e8????????           |                     
            //   b8????????           |                     
            //   e9????????           |                     
            //   8d85d4f9ffff         | lea                 eax, [ebp - 0x62c]

        $sequence_9 = { eb0a c785bcfeffff01000000 8b8dbcfeffff 898dc4feffff eb1d 0fb655e4 85d2 }
            // n = 7, score = 100
            //   eb0a                 | jmp                 0xc
            //   c785bcfeffff01000000     | mov    dword ptr [ebp - 0x144], 1
            //   8b8dbcfeffff         | mov                 ecx, dword ptr [ebp - 0x144]
            //   898dc4feffff         | mov                 dword ptr [ebp - 0x13c], ecx
            //   eb1d                 | jmp                 0x1f
            //   0fb655e4             | movzx               edx, byte ptr [ebp - 0x1c]
            //   85d2                 | test                edx, edx

    condition:
        7 of them and filesize < 6864896
}