rule win_hikit_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hikit"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6a01 3bc6 740c 83c03c 50 }
            // n = 5, score = 100
            //   6a01                 | push                1
            //   3bc6                 | cmp                 eax, esi
            //   740c                 | je                  0xe
            //   83c03c               | add                 eax, 0x3c
            //   50                   | push                eax

        $sequence_1 = { 8d8c2478020000 51 8d9378020000 6800080000 52 e8???????? 83c40c }
            // n = 7, score = 100
            //   8d8c2478020000       | lea                 ecx, [esp + 0x278]
            //   51                   | push                ecx
            //   8d9378020000         | lea                 edx, [ebx + 0x278]
            //   6800080000           | push                0x800
            //   52                   | push                edx
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_2 = { 03c0 52 33c9 e9???????? 8b5718 8b4e34 899668020000 }
            // n = 7, score = 100
            //   03c0                 | add                 eax, eax
            //   52                   | push                edx
            //   33c9                 | xor                 ecx, ecx
            //   e9????????           |                     
            //   8b5718               | mov                 edx, dword ptr [edi + 0x18]
            //   8b4e34               | mov                 ecx, dword ptr [esi + 0x34]
            //   899668020000         | mov                 dword ptr [esi + 0x268], edx

        $sequence_3 = { b9f4010000 f7f9 48 8b442450 89908c000000 e9???????? 48 }
            // n = 7, score = 100
            //   b9f4010000           | mov                 ecx, 0x1f4
            //   f7f9                 | idiv                ecx
            //   48                   | dec                 eax
            //   8b442450             | mov                 eax, dword ptr [esp + 0x50]
            //   89908c000000         | mov                 dword ptr [eax + 0x8c], edx
            //   e9????????           |                     
            //   48                   | dec                 eax

        $sequence_4 = { 8b45dc 895dc0 8b08 50 ff5114 bf20a00400 }
            // n = 6, score = 100
            //   8b45dc               | mov                 eax, dword ptr [ebp - 0x24]
            //   895dc0               | mov                 dword ptr [ebp - 0x40], ebx
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   50                   | push                eax
            //   ff5114               | call                dword ptr [ecx + 0x14]
            //   bf20a00400           | mov                 edi, 0x4a020

        $sequence_5 = { 8d8c24780a0000 51 8d9378020000 52 8d842480020000 }
            // n = 5, score = 100
            //   8d8c24780a0000       | lea                 ecx, [esp + 0xa78]
            //   51                   | push                ecx
            //   8d9378020000         | lea                 edx, [ebx + 0x278]
            //   52                   | push                edx
            //   8d842480020000       | lea                 eax, [esp + 0x280]

        $sequence_6 = { 48 8b442460 48 8b4008 48 c70000000000 }
            // n = 6, score = 100
            //   48                   | dec                 eax
            //   8b442460             | mov                 eax, dword ptr [esp + 0x60]
            //   48                   | dec                 eax
            //   8b4008               | mov                 eax, dword ptr [eax + 8]
            //   48                   | dec                 eax
            //   c70000000000         | mov                 dword ptr [eax], 0

        $sequence_7 = { 8bf1 68fe070000 50 8d8c2482020000 51 89742418 6689842484020000 }
            // n = 7, score = 100
            //   8bf1                 | mov                 esi, ecx
            //   68fe070000           | push                0x7fe
            //   50                   | push                eax
            //   8d8c2482020000       | lea                 ecx, [esp + 0x282]
            //   51                   | push                ecx
            //   89742418             | mov                 dword ptr [esp + 0x18], esi
            //   6689842484020000     | mov                 word ptr [esp + 0x284], ax

        $sequence_8 = { 83c424 8acc 66894b02 8b4704 8b4dfc 0fc8 894144 }
            // n = 7, score = 100
            //   83c424               | add                 esp, 0x24
            //   8acc                 | mov                 cl, ah
            //   66894b02             | mov                 word ptr [ebx + 2], cx
            //   8b4704               | mov                 eax, dword ptr [edi + 4]
            //   8b4dfc               | mov                 ecx, dword ptr [ebp - 4]
            //   0fc8                 | bswap               eax
            //   894144               | mov                 dword ptr [ecx + 0x44], eax

        $sequence_9 = { 50 6a00 6a00 8b8de07fffff 51 8d95e87fffff 52 }
            // n = 7, score = 100
            //   50                   | push                eax
            //   6a00                 | push                0
            //   6a00                 | push                0
            //   8b8de07fffff         | mov                 ecx, dword ptr [ebp - 0x8020]
            //   51                   | push                ecx
            //   8d95e87fffff         | lea                 edx, [ebp - 0x8018]
            //   52                   | push                edx

    condition:
        7 of them and filesize < 573440
}

rule win_hikit_w0 {
	meta:
		author = "31ric"
		description = "Backdoor.Hikit is a Trojan horse that opens a back door on the compromised computer."
		source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/hiddenlynxfiles.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hikit"
        malpedia_version = "20170517"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

	strings: 
		$f1 = "w7fw.sys" nocase ascii wide
		$f2 = "w7fw_m.inf" nocase ascii wide
		$f3 = "w7fw.inf" nocase ascii wide
		$f4 = "w7fw.cat" nocase ascii wide
		
	condition:
		1 of them
}