rule win_gacrux_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.gacrux."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gacrux"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { b8f892c087 e9???????? 837c242010 0f82cc000000 ba01000000 41 b84f0df9f3 }
            // n = 7, score = 300
            //   b8f892c087           | mov                 eax, 0x87c092f8
            //   e9????????           |                     
            //   837c242010           | cmp                 dword ptr [esp + 0x20], 0x10
            //   0f82cc000000         | jb                  0xd2
            //   ba01000000           | mov                 edx, 1
            //   41                   | inc                 ecx
            //   b84f0df9f3           | mov                 eax, 0xf3f90d4f

        $sequence_1 = { 8aee 45 88700d 41 8ace }
            // n = 5, score = 300
            //   8aee                 | mov                 ch, dh
            //   45                   | inc                 ebp
            //   88700d               | mov                 byte ptr [eax + 0xd], dh
            //   41                   | inc                 ecx
            //   8ace                 | mov                 cl, dh

        $sequence_2 = { 3c7c 7518 48 63cd e8???????? }
            // n = 5, score = 300
            //   3c7c                 | cmp                 al, 0x7c
            //   7518                 | jne                 0x1a
            //   48                   | dec                 eax
            //   63cd                 | arpl                bp, cx
            //   e8????????           |                     

        $sequence_3 = { 3bc8 48 0f47ce eb1e 45 0fb70a 41 }
            // n = 7, score = 300
            //   3bc8                 | cmp                 ecx, eax
            //   48                   | dec                 eax
            //   0f47ce               | cmova               ecx, esi
            //   eb1e                 | jmp                 0x20
            //   45                   | inc                 ebp
            //   0fb70a               | movzx               ecx, word ptr [edx]
            //   41                   | inc                 ecx

        $sequence_4 = { 48 85f6 743b ba01000000 41 b84e323bf7 e8???????? }
            // n = 7, score = 300
            //   48                   | dec                 eax
            //   85f6                 | test                esi, esi
            //   743b                 | je                  0x3d
            //   ba01000000           | mov                 edx, 1
            //   41                   | inc                 ecx
            //   b84e323bf7           | mov                 eax, 0xf73b324e
            //   e8????????           |                     

        $sequence_5 = { b8e697a595 e8???????? 4c 8bc5 }
            // n = 4, score = 300
            //   b8e697a595           | mov                 eax, 0x95a597e6
            //   e8????????           |                     
            //   4c                   | dec                 esp
            //   8bc5                 | mov                 eax, ebp

        $sequence_6 = { 40 53 48 83ec20 ba01000000 41 b8817dda68 }
            // n = 7, score = 300
            //   40                   | inc                 eax
            //   53                   | push                ebx
            //   48                   | dec                 eax
            //   83ec20               | sub                 esp, 0x20
            //   ba01000000           | mov                 edx, 1
            //   41                   | inc                 ecx
            //   b8817dda68           | mov                 eax, 0x68da7d81

        $sequence_7 = { 8d4b40 83631000 ba40000000 48 }
            // n = 4, score = 300
            //   8d4b40               | lea                 ecx, [ebx + 0x40]
            //   83631000             | and                 dword ptr [ebx + 0x10], 0
            //   ba40000000           | mov                 edx, 0x40
            //   48                   | dec                 eax

        $sequence_8 = { 49 8bce ffd0 48 833f00 }
            // n = 5, score = 300
            //   49                   | dec                 ecx
            //   8bce                 | mov                 ecx, esi
            //   ffd0                 | call                eax
            //   48                   | dec                 eax
            //   833f00               | cmp                 dword ptr [edi], 0

        $sequence_9 = { 8b0d???????? 8bd5 44 0fb605???????? 44 8b0d???????? }
            // n = 6, score = 300
            //   8b0d????????         |                     
            //   8bd5                 | mov                 edx, ebp
            //   44                   | inc                 esp
            //   0fb605????????       |                     
            //   44                   | inc                 esp
            //   8b0d????????         |                     

    condition:
        7 of them and filesize < 122880
}