rule win_ghostemperor_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.ghostemperor."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.ghostemperor"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ff15???????? 89f0 4883c420 5b 5d 5f }
            // n = 6, score = 200
            //   ff15????????         |                     
            //   89f0                 | dec                 eax
            //   4883c420             | mov                 eax, dword ptr [ebp + 0x10]
            //   5b                   | mov                 eax, dword ptr [eax + 0x4c]
            //   5d                   | rol                 eax, 5
            //   5f                   | xor                 eax, 0x7b8803ae

        $sequence_1 = { 44894648 49c1e003 488d5108 e8???????? 8b4648 85c0 }
            // n = 6, score = 200
            //   44894648             | add                 ebx, ecx
            //   49c1e003             | add                 ebx, eax
            //   488d5108             | add                 eax, 0x4fa9727
            //   e8????????           |                     
            //   8b4648               | xor                 eax, 0x65a63713
            //   85c0                 | mov                 dword ptr [ebp - 0xc], eax

        $sequence_2 = { c3 4489d6 83e603 4929f3 4e8d0cd9 4a8d04da 4529da }
            // n = 7, score = 200
            //   c3                   | mov                 dword ptr [ebp - 0xc], eax
            //   4489d6               | dec                 eax
            //   83e603               | mov                 eax, dword ptr [ebp + 0x10]
            //   4929f3               | mov                 eax, dword ptr [eax + 0x4c]
            //   4e8d0cd9             | add                 eax, 0x4fa9727
            //   4a8d04da             | xor                 eax, 0x65a63713
            //   4529da               | mov                 dword ptr [ebp - 0xc], eax

        $sequence_3 = { 4889ce b920000000 e8???????? 4889c7 0f57c0 }
            // n = 5, score = 200
            //   4889ce               | dec                 eax
            //   b920000000           | mov                 eax, dword ptr [ebp + 0x70]
            //   e8????????           |                     
            //   4889c7               | add                 eax, 0x4d38f052
            //   0f57c0               | xor                 eax, 0x877f258e

        $sequence_4 = { 4989d6 4889ce 498b4808 4885c9 740d e8???????? 48c7470800000000 }
            // n = 7, score = 200
            //   4989d6               | add                 ebx, ecx
            //   4889ce               | add                 ecx, edx
            //   498b4808             | mov                 edx, ecx
            //   4885c9               | shl                 edx, 5
            //   740d                 | mov                 ebx, ecx
            //   e8????????           |                     
            //   48c7470800000000     | sub                 ebx, edx

        $sequence_5 = { 4585d2 0f84b9000000 418d42ff 4c8d5801 4983fb04 7222 }
            // n = 6, score = 200
            //   4585d2               | add                 eax, 0x4d38f052
            //   0f84b9000000         | xor                 eax, 0x877f258e
            //   418d42ff             | mov                 dword ptr [ebp + 0x30], eax
            //   4c8d5801             | dec                 eax
            //   4983fb04             | mov                 eax, dword ptr [ebp + 0x70]
            //   7222                 | mov                 byte ptr [eax + 0xc], 0

        $sequence_6 = { 89ce c1ee1d c1e103 09ce }
            // n = 4, score = 200
            //   89ce                 | mov                 dword ptr [ebp + 0x30], eax
            //   c1ee1d               | dec                 eax
            //   c1e103               | mov                 eax, dword ptr [ebp + 0x70]
            //   09ce                 | mov                 byte ptr [eax + 0xc], 0

        $sequence_7 = { 4989c9 4889d0 458d5aff 41f6c203 7427 4489d1 83e103 }
            // n = 7, score = 200
            //   4989c9               | add                 eax, 0x4d38f052
            //   4889d0               | xor                 eax, 0x877f258e
            //   458d5aff             | mov                 dword ptr [ebp + 0x30], eax
            //   41f6c203             | dec                 eax
            //   7427                 | mov                 eax, dword ptr [ebp + 0x70]
            //   4489d1               | add                 eax, 0x4d38f052
            //   83e103               | xor                 eax, 0x877f258e

        $sequence_8 = { 7567 8b542450 33c9 ff15???????? 488bf8 }
            // n = 5, score = 100
            //   7567                 | mov                 edx, esi
            //   8b542450             | mov                 esi, eax
            //   33c9                 | test                eax, eax
            //   ff15????????         |                     
            //   488bf8               | jns                 0x30

        $sequence_9 = { 00c2 488b8568020000 8854080c 488b85b0020000 }
            // n = 4, score = 100
            //   00c2                 | add                 cl, al
            //   488b8568020000       | dec                 eax
            //   8854080c             | mov                 eax, dword ptr [ebp + 0x268]
            //   488b85b0020000       | dec                 eax

        $sequence_10 = { 0fb78316010000 c1e208 0bd1 0fb6c8 }
            // n = 4, score = 100
            //   0fb78316010000       | jb                  0xfffffff2
            //   c1e208               | jmp                 0x22
            //   0bd1                 | dec                 eax
            //   0fb6c8               | test                eax, eax

        $sequence_11 = { 052797fa04 351337a665 8945f4 488b4510 }
            // n = 4, score = 100
            //   052797fa04           | dec                 eax
            //   351337a665           | sub                 esp, 0x20
            //   8945f4               | add                 ebx, eax
            //   488b4510             | imul                ecx, ebx, 0x3e8

        $sequence_12 = { 01c3 69cbe8030000 81c130750000 4883ec20 }
            // n = 4, score = 100
            //   01c3                 | add                 eax, 2
            //   69cbe8030000         | dec                 eax
            //   81c130750000         | mov                 dword ptr [ebp + 0xc8], eax
            //   4883ec20             | add                 dl, al

        $sequence_13 = { 0552f0384d 358e257f87 894530 488b4570 }
            // n = 4, score = 100
            //   0552f0384d           | sub                 esp, 0x20
            //   358e257f87           | inc                 ecx
            //   894530               | call                esi
            //   488b4570             | dec                 eax

        $sequence_14 = { 4885c0 7405 493bc0 7538 0f31 48c1e220 488d0db130ffff }
            // n = 7, score = 100
            //   4885c0               | dec                 eax
            //   7405                 | mov                 edi, eax
            //   493bc0               | inc                 eax
            //   7538                 | dec                 eax
            //   0f31                 | add                 edx, 0x100
            //   48c1e220             | inc                 ecx
            //   488d0db130ffff       | cmp                 eax, eax

        $sequence_15 = { c7858c000000bf00d200 0f108580000000 c78590000000f0000000 8b8590000000 }
            // n = 4, score = 100
            //   c7858c000000bf00d200     | je    0xa
            //   0f108580000000       | dec                 ecx
            //   c78590000000f0000000     | cmp    eax, eax
            //   8b8590000000         | jne                 0x3d

        $sequence_16 = { ffc0 4881c200010000 413bc0 72ed eb1b }
            // n = 5, score = 100
            //   ffc0                 | dec                 esp
            //   4881c200010000       | lea                 eax, [esp + 0x70]
            //   413bc0               | jne                 0x69
            //   72ed                 | mov                 edx, dword ptr [esp + 0x50]
            //   eb1b                 | xor                 ecx, ecx

        $sequence_17 = { 8bf0 85c0 792e 4c8d442470 }
            // n = 4, score = 100
            //   8bf0                 | inc                 esp
            //   85c0                 | mov                 eax, ebp
            //   792e                 | mov                 dword ptr [esp + 0x40], eax
            //   4c8d442470           | dec                 ecx

        $sequence_18 = { 05f226dac9 35bcfe1eea 894534 488b4550 }
            // n = 4, score = 100
            //   05f226dac9           | inc                 ecx
            //   35bcfe1eea           | call                esi
            //   894534               | add                 ebx, ecx
            //   488b4550             | add                 ebx, eax

        $sequence_19 = { 01c1 89ca c1ea1f c1f904 }
            // n = 4, score = 100
            //   01c1                 | mov                 eax, ecx
            //   89ca                 | add                 dl, al
            //   c1ea1f               | dec                 eax
            //   c1f904               | mov                 eax, dword ptr [ebp + 0x268]

        $sequence_20 = { 01d1 89ca c1e205 89cb }
            // n = 4, score = 100
            //   01d1                 | sar                 ecx, 4
            //   89ca                 | add                 ecx, eax
            //   c1e205               | mov                 edx, ecx
            //   89cb                 | shr                 edx, 0x1f

        $sequence_21 = { 48897c2448 448bc5 89442440 498bd6 }
            // n = 4, score = 100
            //   48897c2448           | movzx               eax, word ptr [ebp + ecx - 0x29]
            //   448bc5               | mov                 word ptr [ebp + ecx + 0x17], ax
            //   89442440             | dec                 eax
            //   498bd6               | mov                 dword ptr [esp + 0x48], edi

        $sequence_22 = { 00c1 488b8568020000 488b95b0020000 884c100c }
            // n = 4, score = 100
            //   00c1                 | movzx               eax, word ptr [ebx + 0x116]
            //   488b8568020000       | shl                 edx, 8
            //   488b95b0020000       | or                  edx, ecx
            //   884c100c             | movzx               ecx, al

        $sequence_23 = { 4983f90f 72bf 66895df5 c745f701000000 488bcb 0fb7440dd7 6689440d17 }
            // n = 7, score = 100
            //   4983f90f             | dec                 ecx
            //   72bf                 | cmp                 ecx, 0xf
            //   66895df5             | jb                  0xffffffc1
            //   c745f701000000       | mov                 word ptr [ebp - 0xb], bx
            //   488bcb               | mov                 dword ptr [ebp - 9], 1
            //   0fb7440dd7           | dec                 eax
            //   6689440d17           | mov                 ecx, ebx

    condition:
        7 of them and filesize < 1115136
}