rule win_fishmaster_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.fishmaster."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.fishmaster"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4883f81f 7736 498bc8 e8???????? 48c7471000000000 }
            // n = 5, score = 100
            //   4883f81f             | dec                 eax
            //   7736                 | lea                 ecx, [0x2b1c]
            //   498bc8               | jmp                 0x3b9
            //   e8????????           |                     
            //   48c7471000000000     | int3                

        $sequence_1 = { e8???????? 488bc3 4c8b4318 4983f810 }
            // n = 4, score = 100
            //   e8????????           |                     
            //   488bc3               | dec                 edx
            //   4c8b4318             | lea                 ecx, [esi + eax]
            //   4983f810             | jmp                 0x152

        $sequence_2 = { 7203 498b06 40883c08 c644080100 e9???????? 440fb6cf }
            // n = 6, score = 100
            //   7203                 | inc                 esp
            //   498b06               | mov                 edi, edi
            //   40883c08             | jmp                 0x5a
            //   c644080100           | inc                 esp
            //   e9????????           |                     
            //   440fb6cf             | lea                 edi, [ecx - 0x47]

        $sequence_3 = { 488d156e220000 488bcb ff15???????? 488d156e220000 488bcb ff15???????? 4c8be8 }
            // n = 7, score = 100
            //   488d156e220000       | jb                  0x1e0
            //   488bcb               | xor                 edi, edi
            //   ff15????????         |                     
            //   488d156e220000       | dec                 esp
            //   488bcb               | mov                 esp, dword ptr [esp + 0x60]
            //   ff15????????         |                     
            //   4c8be8               | dec                 ebp

        $sequence_4 = { 4157 4883ec60 488bfa 488bd9 33f6 897098 488970b0 }
            // n = 7, score = 100
            //   4157                 | mov                 edi, eax
            //   4883ec60             | dec                 esp
            //   488bfa               | mov                 dword ptr [esp + 0x30], esi
            //   488bd9               | inc                 esp
            //   33f6                 | mov                 dword ptr [esp + 0x28], esi
            //   897098               | dec                 eax
            //   488970b0             | lea                 edx, [0x30d5]

        $sequence_5 = { 48837f1810 7203 488b07 488d4c2438 }
            // n = 4, score = 100
            //   48837f1810           | xor                 edx, edx
            //   7203                 | inc                 esp
            //   488b07               | mov                 dword ptr [esp + 0xa0], eax
            //   488d4c2438           | dec                 eax

        $sequence_6 = { 0fb65310 8d42ff 3cfd 7718 88940d84000000 4883c314 }
            // n = 6, score = 100
            //   0fb65310             | xor                 edx, edx
            //   8d42ff               | test                eax, eax
            //   3cfd                 | dec                 eax
            //   7718                 | cmove               edx, ebx
            //   88940d84000000       | dec                 eax
            //   4883c314             | lea                 ecx, [0x3125]

        $sequence_7 = { 46383400 75f7 488d9580000000 488d4d20 e8???????? }
            // n = 5, score = 100
            //   46383400             | inc                 ebp
            //   75f7                 | mov                 edx, esi
            //   488d9580000000       | dec                 ebp
            //   488d4d20             | mov                 ecx, esi
            //   e8????????           |                     

        $sequence_8 = { 480f434c2440 420fb6440803 4288440904 488d442440 48837c245810 480f43442440 488d4c2440 }
            // n = 7, score = 100
            //   480f434c2440         | ja                  0x2e0
            //   420fb6440803         | inc                 esp
            //   4288440904           | lea                 edi, [ecx + 4]
            //   488d442440           | jmp                 0x2f1
            //   48837c245810         | cmp                 cl, 0x2b
            //   480f43442440         | jne                 0x2ea
            //   488d4c2440           | inc                 esp

        $sequence_9 = { 4c8b45f8 488d15ce200000 488bcf ff15???????? 488bf8 4c89742430 4489742428 }
            // n = 7, score = 100
            //   4c8b45f8             | lea                 eax, [ecx + 4]
            //   488d15ce200000       | jmp                 0x496
            //   488bcf               | inc                 esp
            //   ff15????????         |                     
            //   488bf8               | lea                 eax, [ecx - 0x41]
            //   4c89742430           | jmp                 0x4b6
            //   4489742428           | lea                 eax, [ecx - 0x61]

    condition:
        7 of them and filesize < 812032
}