rule win_kikothac_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.kikothac."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kikothac"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 9c 688f9a75da 668910 c60424cd }
            // n = 4, score = 200
            //   9c                   | pushfd              
            //   688f9a75da           | push                0xda759a8f
            //   668910               | mov                 word ptr [eax], dx
            //   c60424cd             | mov                 byte ptr [esp], 0xcd

        $sequence_1 = { 660fb6f2 66c704242554 0fb6f1 9c 894c2420 ff742404 }
            // n = 6, score = 200
            //   660fb6f2             | movzx               si, dl
            //   66c704242554         | mov                 word ptr [esp], 0x5425
            //   0fb6f1               | movzx               esi, cl
            //   9c                   | pushfd              
            //   894c2420             | mov                 dword ptr [esp + 0x20], ecx
            //   ff742404             | push                dword ptr [esp + 4]

        $sequence_2 = { 59 59 8b7508 8d34f5e0214100 391e }
            // n = 5, score = 200
            //   59                   | pop                 ecx
            //   59                   | pop                 ecx
            //   8b7508               | mov                 esi, dword ptr [ebp + 8]
            //   8d34f5e0214100       | lea                 esi, [esi*8 + 0x4121e0]
            //   391e                 | cmp                 dword ptr [esi], ebx

        $sequence_3 = { 9c 8f442444 9c 89742444 5e 66f7d6 8db3afd65e6a }
            // n = 7, score = 200
            //   9c                   | pushfd              
            //   8f442444             | pop                 dword ptr [esp + 0x44]
            //   9c                   | pushfd              
            //   89742444             | mov                 dword ptr [esp + 0x44], esi
            //   5e                   | pop                 esi
            //   66f7d6               | not                 si
            //   8db3afd65e6a         | lea                 esi, [ebx + 0x6a5ed6af]

        $sequence_4 = { 48 9c 40 00749c40 }
            // n = 4, score = 200
            //   48                   | dec                 eax
            //   9c                   | pushfd              
            //   40                   | inc                 eax
            //   00749c40             | add                 byte ptr [esp + ebx*4 + 0x40], dh

        $sequence_5 = { 8d34e5363be8b1 8b742458 882c24 66c744240865f2 }
            // n = 4, score = 200
            //   8d34e5363be8b1       | lea                 esi, [0xb1e83b36]
            //   8b742458             | mov                 esi, dword ptr [esp + 0x58]
            //   882c24               | mov                 byte ptr [esp], ch
            //   66c744240865f2       | mov                 word ptr [esp + 8], 0xf265

        $sequence_6 = { f5 f6d8 9c 28c3 f9 }
            // n = 5, score = 200
            //   f5                   | cmc                 
            //   f6d8                 | neg                 al
            //   9c                   | pushfd              
            //   28c3                 | sub                 bl, al
            //   f9                   | stc                 

        $sequence_7 = { 89742424 60 894c2440 660fbef0 660fce }
            // n = 5, score = 200
            //   89742424             | mov                 dword ptr [esp + 0x24], esi
            //   60                   | pushal              
            //   894c2440             | mov                 dword ptr [esp + 0x40], ecx
            //   660fbef0             | movsx               si, al
            //   660fce               | bswap               si

        $sequence_8 = { c64424080e 50 38c6 98 }
            // n = 4, score = 200
            //   c64424080e           | mov                 byte ptr [esp + 8], 0xe
            //   50                   | push                eax
            //   38c6                 | cmp                 dh, al
            //   98                   | cwde                

        $sequence_9 = { 9c 8d64242c e9???????? f6dc 8b4500 d2d6 }
            // n = 6, score = 200
            //   9c                   | pushfd              
            //   8d64242c             | lea                 esp, [esp + 0x2c]
            //   e9????????           |                     
            //   f6dc                 | neg                 ah
            //   8b4500               | mov                 eax, dword ptr [ebp]
            //   d2d6                 | rcl                 dh, cl

    condition:
        7 of them and filesize < 581632
}