rule win_former_first_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.former_first_rat"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 56 8945e0 8945e4 8945e8 8945ec 8945f0 }
            // n = 6, score = 200
            //   56                   | push                esi
            //   8945e0               | mov                 dword ptr [ebp - 0x20], eax
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax
            //   8945e8               | mov                 dword ptr [ebp - 0x18], eax
            //   8945ec               | mov                 dword ptr [ebp - 0x14], eax
            //   8945f0               | mov                 dword ptr [ebp - 0x10], eax

        $sequence_1 = { 740c 68???????? bb06000000 eb0a 68???????? }
            // n = 5, score = 200
            //   740c                 | je                  0xe
            //   68????????           |                     
            //   bb06000000           | mov                 ebx, 6
            //   eb0a                 | jmp                 0xc
            //   68????????           |                     

        $sequence_2 = { 8bde e8???????? 85c0 754c }
            // n = 4, score = 200
            //   8bde                 | mov                 ebx, esi
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   754c                 | jne                 0x4e

        $sequence_3 = { 8b0d???????? 3bce 7736 2bf1 b87fe0077e f7ee c1fa08 }
            // n = 7, score = 200
            //   8b0d????????         |                     
            //   3bce                 | cmp                 ecx, esi
            //   7736                 | ja                  0x38
            //   2bf1                 | sub                 esi, ecx
            //   b87fe0077e           | mov                 eax, 0x7e07e07f
            //   f7ee                 | imul                esi
            //   c1fa08               | sar                 edx, 8

        $sequence_4 = { b810100000 e8???????? a1???????? 33c5 8945fc 56 57 }
            // n = 7, score = 200
            //   b810100000           | mov                 eax, 0x1010
            //   e8????????           |                     
            //   a1????????           |                     
            //   33c5                 | xor                 eax, ebp
            //   8945fc               | mov                 dword ptr [ebp - 4], eax
            //   56                   | push                esi
            //   57                   | push                edi

        $sequence_5 = { 8b4c2410 8bde e8???????? 8b4c2418 8d542444 52 bb1c000000 }
            // n = 7, score = 200
            //   8b4c2410             | mov                 ecx, dword ptr [esp + 0x10]
            //   8bde                 | mov                 ebx, esi
            //   e8????????           |                     
            //   8b4c2418             | mov                 ecx, dword ptr [esp + 0x18]
            //   8d542444             | lea                 edx, [esp + 0x44]
            //   52                   | push                edx
            //   bb1c000000           | mov                 ebx, 0x1c

        $sequence_6 = { 753b 56 68???????? 68???????? e8???????? 8bf0 68???????? }
            // n = 7, score = 200
            //   753b                 | jne                 0x3d
            //   56                   | push                esi
            //   68????????           |                     
            //   68????????           |                     
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   68????????           |                     

        $sequence_7 = { 85c0 7513 8b4608 50 68???????? e8???????? 83c408 }
            // n = 7, score = 200
            //   85c0                 | test                eax, eax
            //   7513                 | jne                 0x15
            //   8b4608               | mov                 eax, dword ptr [esi + 8]
            //   50                   | push                eax
            //   68????????           |                     
            //   e8????????           |                     
            //   83c408               | add                 esp, 8

        $sequence_8 = { e8???????? f30f6f00 f3410f7f07 33db f3410f6f07 }
            // n = 5, score = 100
            //   e8????????           |                     
            //   f30f6f00             | inc                 ecx
            //   f3410f7f07           | cmp                 ebx, edi
            //   33db                 | jne                 0x14
            //   f3410f6f07           | movdqu              xmm0, xmmword ptr [eax]

        $sequence_9 = { 488be9 83601800 488d0533e10200 488901 }
            // n = 4, score = 100
            //   488be9               | inc                 ecx
            //   83601800             | movq                qword ptr [edi], mm0
            //   488d0533e10200       | xor                 ebx, ebx
            //   488901               | inc                 ecx

        $sequence_10 = { 4883ec20 488bd9 e8???????? 4c8d1d33d00100 4c891b 488bc3 4883c420 }
            // n = 7, score = 100
            //   4883ec20             | movq                mm0, qword ptr [edi]
            //   488bd9               | dec                 eax
            //   e8????????           |                     
            //   4c8d1d33d00100       | mov                 ebp, ecx
            //   4c891b               | and                 dword ptr [eax + 0x18], 0
            //   488bc3               | dec                 eax
            //   4883c420             | lea                 eax, [0x2e133]

        $sequence_11 = { 498d95cc060000 488d4c2470 e8???????? 4c8bc0 488d542438 }
            // n = 5, score = 100
            //   498d95cc060000       | mov                 ebx, ecx
            //   488d4c2470           | dec                 esp
            //   e8????????           |                     
            //   4c8bc0               | lea                 ebx, [0x1d033]
            //   488d542438           | dec                 esp

        $sequence_12 = { 418bcd 4889742420 ff15???????? 413bc7 7411 45893c24 488bcd }
            // n = 7, score = 100
            //   418bcd               | mov                 dword ptr [ebx], ebx
            //   4889742420           | dec                 eax
            //   ff15????????         |                     
            //   413bc7               | mov                 eax, ebx
            //   7411                 | dec                 eax
            //   45893c24             | add                 esp, 0x20
            //   488bcd               | dec                 esp

        $sequence_13 = { e8???????? c744243003000000 488d542430 488d8c2498000000 e8???????? 488d942498000000 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   c744243003000000     | mov                 dword ptr [esp + 0x308], edi
            //   488d542430           | inc                 esp
            //   488d8c2498000000     | mov                 byte ptr [esp + 0x2f8], bh
            //   e8????????           |                     
            //   488d942498000000     | dec                 eax

        $sequence_14 = { 4c89bc2408030000 4488bc24f8020000 4883bc24e002000010 720d 488b8c24c8020000 e8???????? }
            // n = 6, score = 100
            //   4c89bc2408030000     | dec                 eax
            //   4488bc24f8020000     | mov                 dword ptr [ecx], eax
            //   4883bc24e002000010     | dec    eax
            //   720d                 | sub                 esp, 0x20
            //   488b8c24c8020000     | dec                 eax
            //   e8????????           |                     

        $sequence_15 = { e8???????? 448be8 eb06 8b18 448b6804 413bdf 7512 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   448be8               | inc                 esp
            //   eb06                 | mov                 ebp, eax
            //   8b18                 | jmp                 8
            //   448b6804             | mov                 ebx, dword ptr [eax]
            //   413bdf               | inc                 esp
            //   7512                 | mov                 ebp, dword ptr [eax + 4]

    condition:
        7 of them and filesize < 626688
}