rule win_go_red_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.go_red."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.go_red"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { ffd1 488b0c24 48894c243f 0f10442401 0f11442440 488b4c243f 48894c242e }
            // n = 7, score = 100
            //   ffd1                 | dec                 eax
            //   488b0c24             | lea                 esi, [0x22fa25]
            //   48894c243f           | nop                 dword ptr [eax + eax]
            //   0f10442401           | jmp                 0xa04
            //   0f11442440           | dec                 eax
            //   488b4c243f           | mov                 dword ptr [esp + 0x160], eax
            //   48894c242e           | dec                 eax

        $sequence_1 = { eb06 41b801000000 4c8b5c2448 4d85db 7446 4531e4 eb11 }
            // n = 7, score = 100
            //   eb06                 | dec                 ecx
            //   41b801000000         | cmp                 eax, 3
            //   4c8b5c2448           | jne                 0x43b
            //   4d85db               | dec                 esp
            //   7446                 | lea                 eax, [esi + 3]
            //   4531e4               | dec                 esp
            //   eb11                 | cmp                 ebx, eax

        $sequence_2 = { ffd1 4889c1 4889df 31db 31c0 4885c9 0f859d000000 }
            // n = 7, score = 100
            //   ffd1                 | dec                 eax
            //   4889c1               | mov                 edx, dword ptr [esp + 0xd0]
            //   4889df               | jmp                 0x1fc
            //   31db                 | dec                 eax
            //   31c0                 | lea                 ecx, [esi + 4]
            //   4885c9               | dec                 eax
            //   0f859d000000         | mov                 dword ptr [esp + 0x58], ecx

        $sequence_3 = { ffd1 4889842498000000 48899c24a8000000 488b0d???????? 0f1f8000000000 483905???????? 7529 }
            // n = 7, score = 100
            //   ffd1                 | mov                 eax, dword ptr [esp + 0x48]
            //   4889842498000000     | dec                 eax
            //   48899c24a8000000     | mov                 ecx, dword ptr [esp + 0x50]
            //   488b0d????????       |                     
            //   0f1f8000000000       | jmp                 0x1c1d
            //   483905????????       |                     
            //   7529                 | dec                 eax

        $sequence_4 = { ffd2 4885c0 0f84e1050000 4c8d4804 4889c1 4c89c8 4883f9ff }
            // n = 7, score = 100
            //   ffd2                 | mov                 ecx, edx
            //   4885c0               | dec                 eax
            //   0f84e1050000         | mov                 edx, dword ptr [esp + 0x28]
            //   4c8d4804             | dec                 eax
            //   4889c1               | mov                 ebx, dword ptr [esp + 0x48]
            //   4c89c8               | jmp                 0xa0f
            //   4883f9ff             | dec                 esp

        $sequence_5 = { f6c304 750f 488b9c24f0070000 498918 49895808 488b15???????? 488b0a }
            // n = 7, score = 100
            //   f6c304               | dec                 eax
            //   750f                 | lea                 ecx, [esp + 0xe0]
            //   488b9c24f0070000     | dec                 eax
            //   498918               | mov                 ecx, dword ptr [esp + 0xd8]
            //   49895808             | dec                 eax
            //   488b15????????       |                     
            //   488b0a               | mov                 ebx, dword ptr [esp + 0x208]

        $sequence_6 = { eb1a 440fb64c3420 418d1411 8d528d 88543c20 4488443420 4883c002 }
            // n = 7, score = 100
            //   eb1a                 | jmp                 0x262
            //   440fb64c3420         | dec                 eax
            //   418d1411             | lea                 edi, [eax + 8]
            //   8d528d               | dec                 eax
            //   88543c20             | mov                 eax, dword ptr [esp + 0xa8]
            //   4488443420           | inc                 esp
            //   4883c002             | movups              xmmword ptr [esp + 0x100], xmm7

        $sequence_7 = { ffd1 8984247c020000 488d05aa71aa00 e8???????? 8b8c247c020000 8908 488b8c24b8020000 }
            // n = 7, score = 100
            //   ffd1                 | jbe                 0x14a8
            //   8984247c020000       | jmp                 0x105b
            //   488d05aa71aa00       | dec                 esp
            //   e8????????           |                     
            //   8b8c247c020000       | mov                 dword ptr [esp + 0x50], ecx
            //   8908                 | dec                 eax
            //   488b8c24b8020000     | mov                 dword ptr [esp + 0x48], edx

        $sequence_8 = { f20f100d???????? 660f2ec1 7731 f20f100d???????? 660f2ec8 7723 31c0 }
            // n = 7, score = 100
            //   f20f100d????????     |                     
            //   660f2ec1             | jmp                 0x604
            //   7731                 | mov                 dword ptr [esp + 0x1c], eax
            //   f20f100d????????     |                     
            //   660f2ec8             | dec                 eax
            //   7723                 | mov                 eax, dword ptr [esp + 0x50]
            //   31c0                 | dec                 eax

        $sequence_9 = { ffd2 488905???????? 833d????????00 7509 48891d???????? eb0c 488d3dcf14bb01 }
            // n = 7, score = 100
            //   ffd2                 | mov                 dword ptr [esp + 0x88], esi
            //   488905????????       |                     
            //   833d????????00       |                     
            //   7509                 | dec                 eax
            //   48891d????????       |                     
            //   eb0c                 | mov                 dword ptr [esp + 0x40], edx
            //   488d3dcf14bb01       | dec                 eax

    condition:
        7 of them and filesize < 85566464
}