rule win_gearshift_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.gearshift."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gearshift"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4c8d4c2444 448d423f 488bcb 488bf8 44896c2444 ff15???????? }
            // n = 6, score = 200
            //   4c8d4c2444           | cmp                 ecx, esp
            //   448d423f             | dec                 eax
            //   488bcb               | mov                 ecx, dword ptr [esi + 0xb8]
            //   488bf8               | dec                 esp
            //   44896c2444           | lea                 esp, [0xb49f]
            //   ff15????????         |                     

        $sequence_1 = { 75c0 4983c514 ba14000000 498bcd }
            // n = 4, score = 200
            //   75c0                 | push                ecx
            //   4983c514             | push                ebx
            //   ba14000000           | movzx               eax, word ptr [ebx + 0x14]
            //   498bcd               | push                ecx

        $sequence_2 = { ff15???????? 448b85c0010000 41b900800000 498bd7 }
            // n = 4, score = 200
            //   ff15????????         |                     
            //   448b85c0010000       | add                 eax, edi
            //   41b900800000         | mov                 edx, dword ptr [ebx - 0x14]
            //   498bd7               | inc                 ecx

        $sequence_3 = { 0f84a3000000 8b8db0010000 e8???????? 4d8bc5 498bd4 488bcb }
            // n = 6, score = 200
            //   0f84a3000000         | xor                 ecx, esp
            //   8b8db0010000         | dec                 eax
            //   e8????????           |                     
            //   4d8bc5               | add                 esp, 0xd8
            //   498bd4               | mov                 eax, 0x10001880
            //   488bcb               | cmp                 dword ptr [eax], 0x9090c3cc

        $sequence_4 = { 83c8ff e9???????? 4c8bfb 4c8be3 488d05363c0300 49c1fc05 }
            // n = 6, score = 200
            //   83c8ff               | lea                 edx, [0x78e3]
            //   e9????????           |                     
            //   4c8bfb               | dec                 eax
            //   4c8be3               | mov                 dword ptr [ecx + eax], edx
            //   488d05363c0300       | dec                 eax
            //   49c1fc05             | add                 edx, 0x30

        $sequence_5 = { ba10000000 498bc8 498bd8 ff15???????? }
            // n = 4, score = 200
            //   ba10000000           | jg                  0xf96
            //   498bc8               | movsx               eax, byte ptr [esp + 8]
            //   498bd8               | add                 eax, 0x20
            //   ff15????????         |                     

        $sequence_6 = { 4881c4c0000000 5f c3 83f804 771d c705????????08000000 }
            // n = 6, score = 200
            //   4881c4c0000000       | dec                 eax
            //   5f                   | mov                 ecx, eax
            //   c3                   | mov                 dword ptr [esp + 0x20], 0x130
            //   83f804               | xor                 eax, eax
            //   771d                 | mov                 edx, 0xec0e4e8e
            //   c705????????08000000     |     

        $sequence_7 = { 488bd8 ff15???????? 488d153bbd0000 488bcb 488905???????? ff15???????? 488d1504be0000 }
            // n = 7, score = 200
            //   488bd8               | mov                 ecx, 0x40
            //   ff15????????         |                     
            //   488d153bbd0000       | dec                 eax
            //   488bcb               | sub                 ecx, eax
            //   488905????????       |                     
            //   ff15????????         |                     
            //   488d1504be0000       | dec                 eax

        $sequence_8 = { 4885c0 7419 488d15b36e0000 488bc8 ff15???????? 4885c0 }
            // n = 6, score = 200
            //   4885c0               | lea                 ecx, [0xffffbd38]
            //   7419                 | inc                 ecx
            //   488d15b36e0000       | cmp                 eax, edi
            //   488bc8               | je                  0x8d5
            //   ff15????????         |                     
            //   4885c0               | cmp                 eax, -2

        $sequence_9 = { 8bf9 85c0 0f8565010000 488d4c2424 33d2 41b898000000 }
            // n = 6, score = 200
            //   8bf9                 | mov                 edi, eax
            //   85c0                 | add                 edi, 0x1c
            //   0f8565010000         | push                edi
            //   488d4c2424           | add                 esp, 8
            //   33d2                 | mov                 eax, 1
            //   41b898000000         | pop                 esi

    condition:
        7 of them and filesize < 540672
}

rule win_gearshift_w0 {
    meta:
        author = "Bundesamt fuer Verfassungsschutz"
        source = "https://www.verfassungsschutz.de/download/anlage-2019-12-bfv-cyber-brief-2019-01.txt"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.gearshift"
        malpedia_version = "20191207"
        malpedia_sharing = "TLP:WHITE"
        malpedia_license = ""
    strings:
        $b1 = { 4C 8D 41 24 33 D2 B9 03 00 1F 00 FF 9? F8 00 00 00 48 85 C0 74 }
        $b2 = { 4C 8B 4? 08 BA 01 00 00 00 49 8B C? FF D0 85 C0 [2-6] C7 4? 1C 01 00 00 00 B8 01 00 00 00 }
        $b3 = { 8B 4B E4 8B 53 EC 41 B8 00 40 00 00 4? 0B C? FF 9? B8 00 00 00 EB }
    condition:
        (2 of ($b*))
}