rule win_hikit_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-10-14"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.5.0"
        tool_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hikit"
        malpedia_rule_date = "20201014"
        malpedia_hash = "a7e3bd57eaf12bf3ea29a863c041091ba3af9ac9"
        malpedia_version = "20201014"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 48 8b05???????? 48 8b4040 48 8905???????? 48 }
            // n = 7, score = 100
            //   48                   | dec                 eax
            //   8b05????????         |                     
            //   48                   | dec                 eax
            //   8b4040               | mov                 eax, dword ptr [eax + 0x40]
            //   48                   | dec                 eax
            //   8905????????         |                     
            //   48                   | dec                 eax

        $sequence_1 = { 50 56 e8???????? eb08 8bcf ff15???????? 8b1d???????? }
            // n = 7, score = 100
            //   50                   | push                eax
            //   56                   | push                esi
            //   e8????????           |                     
            //   eb08                 | jmp                 0xa
            //   8bcf                 | mov                 ecx, edi
            //   ff15????????         |                     
            //   8b1d????????         |                     

        $sequence_2 = { e9???????? c745f011041120 3bd1 0f8590feffff 51 8d45f0 50 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   c745f011041120       | mov                 dword ptr [ebp - 0x10], 0x20110411
            //   3bd1                 | cmp                 edx, ecx
            //   0f8590feffff         | jne                 0xfffffe96
            //   51                   | push                ecx
            //   8d45f0               | lea                 eax, [ebp - 0x10]
            //   50                   | push                eax

        $sequence_3 = { 83c410 03c0 894528 8b83980a0000 8b93940a0000 034528 }
            // n = 6, score = 100
            //   83c410               | add                 esp, 0x10
            //   03c0                 | add                 eax, eax
            //   894528               | mov                 dword ptr [ebp + 0x28], eax
            //   8b83980a0000         | mov                 eax, dword ptr [ebx + 0xa98]
            //   8b93940a0000         | mov                 edx, dword ptr [ebx + 0xa94]
            //   034528               | add                 eax, dword ptr [ebp + 0x28]

        $sequence_4 = { 7407 50 ff15???????? 895d0c c7450801000000 8bc6 8b8c2434100000 }
            // n = 7, score = 100
            //   7407                 | je                  9
            //   50                   | push                eax
            //   ff15????????         |                     
            //   895d0c               | mov                 dword ptr [ebp + 0xc], ebx
            //   c7450801000000       | mov                 dword ptr [ebp + 8], 1
            //   8bc6                 | mov                 eax, esi
            //   8b8c2434100000       | mov                 ecx, dword ptr [esp + 0x1034]

        $sequence_5 = { 83bc244801000000 7505 e9???????? 81bc2438010000ea050000 7e0a b801000000 }
            // n = 6, score = 100
            //   83bc244801000000     | cmp                 dword ptr [esp + 0x148], 0
            //   7505                 | jne                 7
            //   e9????????           |                     
            //   81bc2438010000ea050000     | cmp    dword ptr [esp + 0x138], 0x5ea
            //   7e0a                 | jle                 0xc
            //   b801000000           | mov                 eax, 1

        $sequence_6 = { 240f 0fb6c8 48 8b842488000000 0fb6400c c1f804 c1e002 }
            // n = 7, score = 100
            //   240f                 | and                 al, 0xf
            //   0fb6c8               | movzx               ecx, al
            //   48                   | dec                 eax
            //   8b842488000000       | mov                 eax, dword ptr [esp + 0x88]
            //   0fb6400c             | movzx               eax, byte ptr [eax + 0xc]
            //   c1f804               | sar                 eax, 4
            //   c1e002               | shl                 eax, 2

        $sequence_7 = { c744244800000000 c744247c00000000 33c0 6689442468 48 c744245000000000 c744245800000000 }
            // n = 7, score = 100
            //   c744244800000000     | mov                 dword ptr [esp + 0x48], 0
            //   c744247c00000000     | mov                 dword ptr [esp + 0x7c], 0
            //   33c0                 | xor                 eax, eax
            //   6689442468           | mov                 word ptr [esp + 0x68], ax
            //   48                   | dec                 eax
            //   c744245000000000     | mov                 dword ptr [esp + 0x50], 0
            //   c744245800000000     | mov                 dword ptr [esp + 0x58], 0

        $sequence_8 = { 8b7608 5f 85f6 740d 6a01 8d45fc }
            // n = 6, score = 100
            //   8b7608               | mov                 esi, dword ptr [esi + 8]
            //   5f                   | pop                 edi
            //   85f6                 | test                esi, esi
            //   740d                 | je                  0xf
            //   6a01                 | push                1
            //   8d45fc               | lea                 eax, [ebp - 4]

        $sequence_9 = { 57 6a01 57 897e10 c7460cc40a0210 897e20 897e24 }
            // n = 7, score = 100
            //   57                   | push                edi
            //   6a01                 | push                1
            //   57                   | push                edi
            //   897e10               | mov                 dword ptr [esi + 0x10], edi
            //   c7460cc40a0210       | mov                 dword ptr [esi + 0xc], 0x10020ac4
            //   897e20               | mov                 dword ptr [esi + 0x20], edi
            //   897e24               | mov                 dword ptr [esi + 0x24], edi

    condition:
        7 of them and filesize < 573440
}

rule win_hikit_w0 {
	meta:
		author = "31ric"
		description = "Backdoor.Hikit is a Trojan horse that opens a back door on the compromised computer."
		source = "https://github.com/mattulm/sfiles_yara/blob/master/malware/hiddenlynxfiles.yar"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.hikit"
        malpedia_version = "20170517"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

	strings: 
		$f1 = "w7fw.sys" nocase ascii wide
		$f2 = "w7fw_m.inf" nocase ascii wide
		$f3 = "w7fw.inf" nocase ascii wide
		$f4 = "w7fw.cat" nocase ascii wide
		
	condition:
		1 of them
}