rule win_khrat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.khrat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.khrat"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 7743 3b854cfeffff 771b 8bc8 56 51 }
            // n = 6, score = 100
            //   7743                 | ja                  0x45
            //   3b854cfeffff         | cmp                 eax, dword ptr [ebp - 0x1b4]
            //   771b                 | ja                  0x1d
            //   8bc8                 | mov                 ecx, eax
            //   56                   | push                esi
            //   51                   | push                ecx

        $sequence_1 = { 66c7060000 6683430202 0fb74b02 51 }
            // n = 4, score = 100
            //   66c7060000           | mov                 word ptr [esi], 0
            //   6683430202           | add                 word ptr [ebx + 2], 2
            //   0fb74b02             | movzx               ecx, word ptr [ebx + 2]
            //   51                   | push                ecx

        $sequence_2 = { 0bff 7412 56 e8???????? c64430ff00 b801000000 eb02 }
            // n = 7, score = 100
            //   0bff                 | or                  edi, edi
            //   7412                 | je                  0x14
            //   56                   | push                esi
            //   e8????????           |                     
            //   c64430ff00           | mov                 byte ptr [eax + esi - 1], 0
            //   b801000000           | mov                 eax, 1
            //   eb02                 | jmp                 4

        $sequence_3 = { 0bc0 0f8530020000 8d859cfbffff 50 6a00 ffb5b4fbffff }
            // n = 6, score = 100
            //   0bc0                 | or                  eax, eax
            //   0f8530020000         | jne                 0x236
            //   8d859cfbffff         | lea                 eax, dword ptr [ebp - 0x464]
            //   50                   | push                eax
            //   6a00                 | push                0
            //   ffb5b4fbffff         | push                dword ptr [ebp - 0x44c]

        $sequence_4 = { 6a01 6a00 8d85fcfcffff 50 ffb5f8fcffff e8???????? ffb5f8fcffff }
            // n = 7, score = 100
            //   6a01                 | push                1
            //   6a00                 | push                0
            //   8d85fcfcffff         | lea                 eax, dword ptr [ebp - 0x304]
            //   50                   | push                eax
            //   ffb5f8fcffff         | push                dword ptr [ebp - 0x308]
            //   e8????????           |                     
            //   ffb5f8fcffff         | push                dword ptr [ebp - 0x308]

        $sequence_5 = { 66c746284100 66c7462a3800 66c7462c3000 66c7462e4200 }
            // n = 4, score = 100
            //   66c746284100         | mov                 word ptr [esi + 0x28], 0x41
            //   66c7462a3800         | mov                 word ptr [esi + 0x2a], 0x38
            //   66c7462c3000         | mov                 word ptr [esi + 0x2c], 0x30
            //   66c7462e4200         | mov                 word ptr [esi + 0x2e], 0x42

        $sequence_6 = { 55 8bec 81c4ecfaffff 8d75f0 c70652756e64 }
            // n = 5, score = 100
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   81c4ecfaffff         | add                 esp, 0xfffffaec
            //   8d75f0               | lea                 esi, dword ptr [ebp - 0x10]
            //   c70652756e64         | mov                 dword ptr [esi], 0x646e7552

        $sequence_7 = { e8???????? 0bc0 741a 8d45e0 50 68???????? e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   0bc0                 | or                  eax, eax
            //   741a                 | je                  0x1c
            //   8d45e0               | lea                 eax, dword ptr [ebp - 0x20]
            //   50                   | push                eax
            //   68????????           |                     
            //   e8????????           |                     

        $sequence_8 = { 8d730b 8d3ddc5b0010 56 57 }
            // n = 4, score = 100
            //   8d730b               | lea                 esi, dword ptr [ebx + 0xb]
            //   8d3ddc5b0010         | lea                 edi, dword ptr [0x10005bdc]
            //   56                   | push                esi
            //   57                   | push                edi

        $sequence_9 = { 66c746043800 66c746063800 66c746083500 66c7460a3100 66c7460c3200 66c7460e3000 66c746104500 }
            // n = 7, score = 100
            //   66c746043800         | mov                 word ptr [esi + 4], 0x38
            //   66c746063800         | mov                 word ptr [esi + 6], 0x38
            //   66c746083500         | mov                 word ptr [esi + 8], 0x35
            //   66c7460a3100         | mov                 word ptr [esi + 0xa], 0x31
            //   66c7460c3200         | mov                 word ptr [esi + 0xc], 0x32
            //   66c7460e3000         | mov                 word ptr [esi + 0xe], 0x30
            //   66c746104500         | mov                 word ptr [esi + 0x10], 0x45

    condition:
        7 of them and filesize < 57344
}