rule win_kins_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.kins."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kins"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 3bc1 72f5 803c1000 752b 8d48fe }
            // n = 5, score = 5000
            //   3bc1                 | cmp                 eax, ecx
            //   72f5                 | jb                  0xfffffff7
            //   803c1000             | cmp                 byte ptr [eax + edx], 0
            //   752b                 | jne                 0x2d
            //   8d48fe               | lea                 ecx, [eax - 2]

        $sequence_1 = { 7f09 c745ec03000000 eb40 3d8c000000 7f09 c745ec04000000 eb30 }
            // n = 7, score = 5000
            //   7f09                 | jg                  0xb
            //   c745ec03000000       | mov                 dword ptr [ebp - 0x14], 3
            //   eb40                 | jmp                 0x42
            //   3d8c000000           | cmp                 eax, 0x8c
            //   7f09                 | jg                  0xb
            //   c745ec04000000       | mov                 dword ptr [ebp - 0x14], 4
            //   eb30                 | jmp                 0x32

        $sequence_2 = { 53 57 8bd9 c745fc02000000 85c0 7507 e8???????? }
            // n = 7, score = 5000
            //   53                   | push                ebx
            //   57                   | push                edi
            //   8bd9                 | mov                 ebx, ecx
            //   c745fc02000000       | mov                 dword ptr [ebp - 4], 2
            //   85c0                 | test                eax, eax
            //   7507                 | jne                 9
            //   e8????????           |                     

        $sequence_3 = { 8bd8 85db 0f8532010000 8b442420 8b08 }
            // n = 5, score = 5000
            //   8bd8                 | mov                 ebx, eax
            //   85db                 | test                ebx, ebx
            //   0f8532010000         | jne                 0x138
            //   8b442420             | mov                 eax, dword ptr [esp + 0x20]
            //   8b08                 | mov                 ecx, dword ptr [eax]

        $sequence_4 = { 315dfc 8b75fc 33f0 0375f4 8db43e0c38e5fd 8b7dfc c1c617 }
            // n = 7, score = 5000
            //   315dfc               | xor                 dword ptr [ebp - 4], ebx
            //   8b75fc               | mov                 esi, dword ptr [ebp - 4]
            //   33f0                 | xor                 esi, eax
            //   0375f4               | add                 esi, dword ptr [ebp - 0xc]
            //   8db43e0c38e5fd       | lea                 esi, [esi + edi - 0x21ac7f4]
            //   8b7dfc               | mov                 edi, dword ptr [ebp - 4]
            //   c1c617               | rol                 esi, 0x17

        $sequence_5 = { 7518 837df401 74e6 8b4510 50 8d4dec 51 }
            // n = 7, score = 5000
            //   7518                 | jne                 0x1a
            //   837df401             | cmp                 dword ptr [ebp - 0xc], 1
            //   74e6                 | je                  0xffffffe8
            //   8b4510               | mov                 eax, dword ptr [ebp + 0x10]
            //   50                   | push                eax
            //   8d4dec               | lea                 ecx, [ebp - 0x14]
            //   51                   | push                ecx

        $sequence_6 = { 8d7c2448 e8???????? 8bd8 85db 0f8560010000 8b5c2428 8d442458 }
            // n = 7, score = 5000
            //   8d7c2448             | lea                 edi, [esp + 0x48]
            //   e8????????           |                     
            //   8bd8                 | mov                 ebx, eax
            //   85db                 | test                ebx, ebx
            //   0f8560010000         | jne                 0x166
            //   8b5c2428             | mov                 ebx, dword ptr [esp + 0x28]
            //   8d442458             | lea                 eax, [esp + 0x58]

        $sequence_7 = { 035df8 8db433e0e62cfe c1c60a 03f0 }
            // n = 4, score = 5000
            //   035df8               | add                 ebx, dword ptr [ebp - 8]
            //   8db433e0e62cfe       | lea                 esi, [ebx + esi - 0x1d31920]
            //   c1c60a               | rol                 esi, 0xa
            //   03f0                 | add                 esi, eax

        $sequence_8 = { 889dd4fbffff ffd0 85c0 7523 3975fc }
            // n = 5, score = 5000
            //   889dd4fbffff         | mov                 byte ptr [ebp - 0x42c], bl
            //   ffd0                 | call                eax
            //   85c0                 | test                eax, eax
            //   7523                 | jne                 0x25
            //   3975fc               | cmp                 dword ptr [ebp - 4], esi

        $sequence_9 = { 8bd8 85db 0f856c040000 8d742478 e8???????? 8bd8 }
            // n = 6, score = 5000
            //   8bd8                 | mov                 ebx, eax
            //   85db                 | test                ebx, ebx
            //   0f856c040000         | jne                 0x472
            //   8d742478             | lea                 esi, [esp + 0x78]
            //   e8????????           |                     
            //   8bd8                 | mov                 ebx, eax

    condition:
        7 of them and filesize < 548864
}