rule win_kdcsponge_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.kdcsponge."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kdcsponge"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 80b9b104000001 c6810904000008 0f85bf000000 80b9ad04000000 c781a004000002000000 c7416002001100 7552 }
            // n = 7, score = 100
            //   80b9b104000001       | dec                 eax
            //   c6810904000008       | mov                 ebx, ecx
            //   0f85bf000000         | jne                 0x1acb
            //   80b9ad04000000       | dec                 eax
            //   c781a004000002000000     | mov    ecx, dword ptr [ecx + 0x46c]
            //   c7416002001100       | dec                 eax
            //   7552                 | test                ecx, ecx

        $sequence_1 = { 488b8228040000 4885c0 7507 488b8230040000 4883c002 4803c1 }
            // n = 6, score = 100
            //   488b8228040000       | movsd               qword ptr [ecx], xmm0
            //   4885c0               | mov                 byte ptr [ecx + 8], al
            //   7507                 | dec                 eax
            //   488b8230040000       | mov                 ecx, ebx
            //   4883c002             | dec                 eax
            //   4803c1               | lea                 eax, [ebx - 1]

        $sequence_2 = { 7507 c681c504000006 c7814004000003000000 c781ca04000004000000 e9???????? e9???????? 3c01 }
            // n = 7, score = 100
            //   7507                 | add                 ecx, eax
            //   c681c504000006       | inc                 esp
            //   c7814004000003000000     | add    eax, esi
            //   c781ca04000004000000     | inc    ebp
            //   e9????????           |                     
            //   e9????????           |                     
            //   3c01                 | add                 eax, ecx

        $sequence_3 = { 0f85d5000000 80b9ad04000001 0f85bf000000 f681ae04000008 0f84b2000000 488b896c040000 }
            // n = 6, score = 100
            //   0f85d5000000         | mov                 byte ptr [ebx + 0x4bf], dh
            //   80b9ad04000001       | shr                 dl, 7
            //   0f85bf000000         | mov                 byte ptr [ebx + 0x4a4], dl
            //   f681ae04000008       | movzx               ecx, byte ptr [eax + 2]
            //   0f84b2000000         | shr                 cl, 3
            //   488b896c040000       | and                 cl, 0xf

        $sequence_4 = { 898520030000 e8???????? 488d0db15ffcff 48c1e602 0fb784b9c0550400 488d91b04c0400 488d8d24030000 }
            // n = 7, score = 100
            //   898520030000         | mov                 dword ptr [ebp - 0x30], 0x245c8948
            //   e8????????           |                     
            //   488d0db15ffcff       | dec                 eax
            //   48c1e602             | lea                 edx, [ebp - 0x30]
            //   0fb784b9c0550400     | dec                 eax
            //   488d91b04c0400       | lea                 ecx, [0x2675d]
            //   488d8d24030000       | dec                 eax

        $sequence_5 = { 488b542450 488b4e08 e8???????? 488d4c2440 ff15???????? 0fb74504 ffc7 }
            // n = 7, score = 100
            //   488b542450           | dec                 eax
            //   488b4e08             | test                ecx, ecx
            //   e8????????           |                     
            //   488d4c2440           | je                  0x1d3e
            //   ff15????????         |                     
            //   0fb74504             | dec                 eax
            //   ffc7                 | mov                 eax, dword ptr [ebx + 0x420]

        $sequence_6 = { 448d4020 c745c048895c24 488d55c0 c745c420555657 488d0df1480200 c745c841544155 c745cc41564157 }
            // n = 7, score = 100
            //   448d4020             | je                  0x17d2
            //   c745c048895c24       | shr                 ecx, 3
            //   488d55c0             | and                 ecx, 7
            //   c745c420555657       | mov                 dword ptr [ebx + 0x45c], ecx
            //   488d0df1480200       | jne                 0x1779
            //   c745c841544155       | mov                 dword ptr [ebx + 0x440], 0x67
            //   c745cc41564157       | jmp                 0x17e7

        $sequence_7 = { c6830804000001 f20f1005???????? 8b05???????? c7436003000100 eb24 83f807 753d }
            // n = 7, score = 100
            //   c6830804000001       | ret                 
            //   f20f1005????????     |                     
            //   8b05????????         |                     
            //   c7436003000100       | dec                 eax
            //   eb24                 | inc                 dword ptr [edx + 0x420]
            //   83f807               | dec                 eax
            //   753d                 | inc                 eax

        $sequence_8 = { 7507 c681c504000006 ba65000000 c744243004000000 448bca c744242804000000 448bc2 }
            // n = 7, score = 100
            //   7507                 | dec                 ecx
            //   c681c504000006       | mov                 ebx, ebx
            //   ba65000000           | dec                 esp
            //   c744243004000000     | lea                 ecx, [0x2cd24]
            //   448bca               | nop                 dword ptr [eax]
            //   c744242804000000     | inc                 esp
            //   448bc2               | add                 eax, ecx

        $sequence_9 = { c6470801 e9???????? 41b803000000 488d1578f90000 488bcb e8???????? 85c0 }
            // n = 7, score = 100
            //   c6470801             | jne                 0x652
            //   e9????????           |                     
            //   41b803000000         | dec                 eax
            //   488d1578f90000       | lea                 ecx, [ebx + 0x110]
            //   488bcb               | mov                 dword ptr [ebx + 0x440], 6
            //   e8????????           |                     
            //   85c0                 | dec                 eax

    condition:
        7 of them and filesize < 720896
}