rule win_kiwistealer_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.kiwistealer."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.kiwistealer"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c60300 33c0 49894610 498b5e18 49894618 4885db 7429 }
            // n = 7, score = 100
            //   c60300               | dec                 eax
            //   33c0                 | mov                 dword ptr [edx + 0x28], eax
            //   49894610             | mov                 ecx, 0x50
            //   498b5e18             | dec                 eax
            //   49894618             | mov                 ecx, eax
            //   4885db               | dec                 eax
            //   7429                 | mov                 dword ptr [esp + 0x5d0], eax

        $sequence_1 = { 0f118c24c0010000 4c896010 48c740180f000000 c60000 41b810000000 488d15ef5d0100 488d8c24b0010000 }
            // n = 7, score = 100
            //   0f118c24c0010000     | dec                 eax
            //   4c896010             | cmp                 dword ptr [edx + 0x18], 0x10
            //   48c740180f000000     | jb                  0x6cf
            //   c60000               | movups              xmmword ptr [ecx], xmm0
            //   41b810000000         | dec                 eax
            //   488d15ef5d0100       | mov                 dword ptr [ecx + 0x10], eax
            //   488d8c24b0010000     | movdqu              xmmword ptr [ebp - 0x51], xmm0

        $sequence_2 = { e9???????? 80bd5802000000 4c89b42438030000 7429 41f6c710 7423 4533f6 }
            // n = 7, score = 100
            //   e9????????           |                     
            //   80bd5802000000       | cmp                 dword ptr [eax], eax
            //   4c89b42438030000     | dec                 eax
            //   7429                 | cmp                 dword ptr [ebx + 0x80], 0
            //   41f6c710             | dec                 eax
            //   7423                 | mov                 dword ptr [esp + 0xb0], ebp
            //   4533f6               | je                  0x1df

        $sequence_3 = { 48b99be0c5251ed2af8f 448902 488bda 483bc1 741d 48b90ddf7e257a11abb2 483bc1 }
            // n = 7, score = 100
            //   48b99be0c5251ed2af8f     | arpl    word ptr [eax + 4], cx
            //   448902               | lea                 edx, [ecx - 0xb0]
            //   488bda               | mov                 dword ptr [esp + ecx + 0x5c], edx
            //   483bc1               | dec                 eax
            //   741d                 | lea                 eax, [esp + 0x70]
            //   48b90ddf7e257a11abb2     | dec    eax
            //   483bc1               | lea                 esi, [0xa422]

        $sequence_4 = { f30f7f45e7 418bc7 874358 498bce ff15???????? 488b7de7 488bd7 }
            // n = 7, score = 100
            //   f30f7f45e7           | inc                 ebp
            //   418bc7               | test                cl, cl
            //   874358               | jne                 0xe8
            //   498bce               | dec                 esp
            //   ff15????????         |                     
            //   488b7de7             | lea                 eax, [edi + ecx]
            //   488bd7               | dec                 esp

        $sequence_5 = { 33c9 48894dcf 884dd7 4d894f70 483bd6 0f84e9020000 0f1f4000 }
            // n = 7, score = 100
            //   33c9                 | cmp                 ecx, edi
            //   48894dcf             | ja                  0x25c
            //   884dd7               | dec                 eax
            //   4d894f70             | mov                 edx, ebp
            //   483bd6               | dec                 eax
            //   0f84e9020000         | mov                 eax, edi
            //   0f1f4000             | ja                  0x347

        $sequence_6 = { 41833e00 7422 0f57c0 f30f7f442468 4533e4 4c89642478 488d4c2468 }
            // n = 7, score = 100
            //   41833e00             | mov                 eax, ecx
            //   7422                 | inc                 ecx
            //   0f57c0               | movups              xmmword ptr [esi], xmm0
            //   f30f7f442468         | dec                 ebp
            //   4533e4               | mov                 dword ptr [esi + 0x10], edi
            //   4c89642478           | dec                 ecx
            //   488d4c2468           | mov                 dword ptr [esi + 0x18], 7

        $sequence_7 = { 410fb700 668901 4883c102 66418910 493bc8 75e0 c3 }
            // n = 7, score = 100
            //   410fb700             | dec                 eax
            //   668901               | mov                 ebx, ecx
            //   4883c102             | dec                 eax
            //   66418910             | mov                 dword ptr [ecx], eax
            //   493bc8               | test                dl, 1
            //   75e0                 | je                  0x37
            //   c3                   | inc                 eax

        $sequence_8 = { 81e91e270000 7411 83f916 7556 c745603c270000 e9???????? c7456026270000 }
            // n = 7, score = 100
            //   81e91e270000         | lea                 ecx, [eax + eax*4]
            //   7411                 | dec                 eax
            //   83f916               | add                 ecx, ecx
            //   7556                 | dec                 eax
            //   c745603c270000       | mov                 dword ptr [ebp + 0x17], ecx
            //   e9????????           |                     
            //   c7456026270000       | xor                 eax, eax

        $sequence_9 = { 48634804 488d0551a20000 4889443940 488b4740 48634804 8d51f0 8954393c }
            // n = 7, score = 100
            //   48634804             | dec                 eax
            //   488d0551a20000       | test                eax, eax
            //   4889443940           | je                  0x502
            //   488b4740             | nop                 
            //   48634804             | dec                 eax
            //   8d51f0               | cmp                 eax, dword ptr [esp + 0x40]
            //   8954393c             | jne                 0x530

    condition:
        7 of them and filesize < 403456
}