rule win_karsto_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.karsto_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.karsto_rat"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c744242000000080 4533c9 4533c0 498bce ff15???????? 4c8bf8 4885c0 }
            // n = 7, score = 100
            //   c744242000000080     | lea                 ecx, [ebp - 0x30]
            //   4533c9               | dec                 eax
            //   4533c0               | mov                 ecx, esi
            //   498bce               | dec                 eax
            //   ff15????????         |                     
            //   4c8bf8               | mov                 edi, dword ptr [esi + 0x18]
            //   4885c0               | dec                 eax

        $sequence_1 = { 4883e6e0 488946f8 eb08 e8???????? 488bf0 4c8bc7 }
            // n = 6, score = 100
            //   4883e6e0             | dec                 eax
            //   488946f8             | test                eax, eax
            //   eb08                 | je                  0x206
            //   e8????????           |                     
            //   488bf0               | dec                 eax
            //   4c8bc7               | lea                 edi, [eax + 0x27]

        $sequence_2 = { d2e0 2206 48ffc6 0ad0 8817 48ffc7 498bd9 }
            // n = 7, score = 100
            //   d2e0                 | mov                 byte ptr [edi + ebx], 0
            //   2206                 | dec                 eax
            //   48ffc6               | mov                 ebx, dword ptr [esp + 0x30]
            //   0ad0                 | dec                 eax
            //   8817                 | add                 esp, 0x38
            //   48ffc7               | inc                 ecx
            //   498bd9               | pop                 esi

        $sequence_3 = { 83ff02 0f84b1020000 83f802 0f84a8020000 f7437000010000 440fb67374 742b }
            // n = 7, score = 100
            //   83ff02               | je                  0x71a
            //   0f84b1020000         | cmp                 dl, 0x29
            //   83f802               | je                  0x71a
            //   0f84a8020000         | inc                 ecx
            //   f7437000010000       | test                al, 0x10
            //   440fb67374           | jne                 0x71d
            //   742b                 | movzx               edx, byte ptr [ecx]

        $sequence_4 = { 4883f90f 7603 488b3b 488d05f26a0100 41bc1c000000 4c8d3dc96a0100 }
            // n = 6, score = 100
            //   4883f90f             | mov                 edx, ebx
            //   7603                 | dec                 eax
            //   488b3b               | cmp                 eax, 0xa
            //   488d05f26a0100       | jb                  0x130f
            //   41bc1c000000         | dec                 eax
            //   4c8d3dc96a0100       | add                 eax, -0xa

        $sequence_5 = { 483bd8 773f 48897c2440 488d0419 48894610 488bc6 4983f80f }
            // n = 7, score = 100
            //   483bd8               | dec                 ecx
            //   773f                 | mov                 edx, esp
            //   48897c2440           | dec                 ebp
            //   488d0419             | mov                 dword ptr [ebx - 0x30], ebp
            //   48894610             | dec                 eax
            //   488bc6               | cmp                 eax, edx
            //   4983f80f             | jb                  0x584

        $sequence_6 = { 0f104f10 0f114b10 0f1117 0f115f10 4883c420 415e }
            // n = 6, score = 100
            //   0f104f10             | and                 ebx, dword ptr [eax]
            //   0f114b10             | dec                 ebp
            //   0f1117               | test                edx, edx
            //   0f115f10             | je                  0xb1
            //   4883c420             | or                  esi, ebx
            //   415e                 | inc                 ecx

        $sequence_7 = { ff15???????? 488d4de8 48837d000f 480f474de8 4533c9 4533c0 33d2 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   488d4de8             | mov                 dword ptr [esi], esi
            //   48837d000f           | and                 edi, 0xfffffffd
            //   480f474de8           | dec                 eax
            //   4533c9               | lea                 ecx, [ebp - 0x39]
            //   4533c0               | xorps               xmm0, xmm0
            //   33d2                 | movups              xmmword ptr [ebx], xmm0

        $sequence_8 = { 837b7c5e 488d737c 7569 488b4348 83700c01 488b03 488b5310 }
            // n = 7, score = 100
            //   837b7c5e             | cmp                 ecx, eax
            //   488d737c             | dec                 eax
            //   7569                 | cmovb               edi, eax
            //   488b4348             | dec                 eax
            //   83700c01             | lea                 eax, [edi + 1]
            //   488b03               | dec                 eax
            //   488b5310             | test                eax, eax

        $sequence_9 = { 48ffc1 4883c90f 493bcf 7613 498bff 48b90000000000000080 4883c127 }
            // n = 7, score = 100
            //   48ffc1               | inc                 ecx
            //   4883c90f             | mov                 eax, 0x3c
            //   493bcf               | dec                 eax
            //   7613                 | mov                 ecx, 0x80000001
            //   498bff               | test                eax, eax
            //   48b90000000000000080     | je    0x39a
            //   4883c127             | xorps               xmm0, xmm0

    condition:
        7 of them and filesize < 336896
}