rule win_lightneuron_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.lightneuron."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.lightneuron"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 488b05???????? 488b15???????? 4885c0 4c8bc6 488bcf 480f45d0 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488b05????????       |                     
            //   488b15????????       |                     
            //   4885c0               | dec                 eax
            //   4c8bc6               | mov                 ecx, dword ptr [edi + 8]
            //   488bcf               | mov                 edx, 0x93
            //   480f45d0             | jmp                 0x1155

        $sequence_1 = { b920000000 e8???????? 4889442420 48837c242000 7502 eb70 488b4c2420 }
            // n = 7, score = 100
            //   b920000000           | mov                 dword ptr [esp + 0x60], esi
            //   e8????????           |                     
            //   4889442420           | mov                 ecx, dword ptr [ebx]
            //   48837c242000         | cmp                 ecx, 0xc42c
            //   7502                 | je                  0x16db
            //   eb70                 | cmp                 ecx, 0xc42d
            //   488b4c2420           | je                  0x16db

        $sequence_2 = { eb3e 488b4808 e8???????? 488b7c2460 488bcf ff15???????? 8bf0 }
            // n = 7, score = 100
            //   eb3e                 | dec                 esp
            //   488b4808             | mov                 eax, dword ptr [esp + 0x30]
            //   e8????????           |                     
            //   488b7c2460           | jmp                 0x1dc8
            //   488bcf               | dec                 eax
            //   ff15????????         |                     
            //   8bf0                 | test                ebp, ebp

        $sequence_3 = { b8b0040000 4883c420 5b c3 488b05???????? 488b15???????? 41b802000000 }
            // n = 7, score = 100
            //   b8b0040000           | inc                 esp
            //   4883c420             | mov                 eax, eax
            //   5b                   | mov                 dword ptr [esp + 0x20], edi
            //   c3                   | dec                 eax
            //   488b05????????       |                     
            //   488b15????????       |                     
            //   41b802000000         | test                eax, eax

        $sequence_4 = { 44891b eb08 488bb42450010000 488b9c2448010000 4885db 0f8498000000 488b9424e0000000 }
            // n = 7, score = 100
            //   44891b               | inc                 ecx
            //   eb08                 | cmp                 edi, 1
            //   488bb42450010000     | jne                 0x176d
            //   488b9c2448010000     | dec                 eax
            //   4885db               | mov                 ecx, eax
            //   0f8498000000         | dec                 eax
            //   488b9424e0000000     | test                eax, eax

        $sequence_5 = { 488b4808 ff15???????? 8d4801 e8???????? 4c8be8 4885c0 740d }
            // n = 7, score = 100
            //   488b4808             | mov                 dword ptr [esp + 0x70], edi
            //   ff15????????         |                     
            //   8d4801               | inc                 esp
            //   e8????????           |                     
            //   4c8be8               | mov                 dword ptr [esp + 0x68], esi
            //   4885c0               | dec                 eax
            //   740d                 | mov                 edi, eax

        $sequence_6 = { 410fb6c3 4533b48cc0ed0300 4533b48480d50300 418bc0 45337500 c1e808 }
            // n = 6, score = 100
            //   410fb6c3             | xor                 edx, edx
            //   4533b48cc0ed0300     | dec                 eax
            //   4533b48480d50300     | mov                 edi, dword ptr [esp + 0xb0]
            //   418bc0               | dec                 eax
            //   45337500             | test                edi, edi
            //   c1e808               | je                  0x60f

        $sequence_7 = { 4885c0 488bcf 480f45d8 4c89742438 ff15???????? 4863d0 488d442438 }
            // n = 7, score = 100
            //   4885c0               | mov                 eax, dword ptr [edx + 0x20]
            //   488bcf               | dec                 eax
            //   480f45d8             | mov                 dword ptr [esp + 0x20], ecx
            //   4c89742438           | dec                 eax
            //   ff15????????         |                     
            //   4863d0               | mov                 eax, dword ptr [edx + 0x10]
            //   488d442438           | dec                 eax

        $sequence_8 = { ff15???????? 8b1d???????? 488d0d8eb40300 8935???????? ff15???????? e8???????? 488d0d76b40300 }
            // n = 7, score = 100
            //   ff15????????         |                     
            //   8b1d????????         |                     
            //   488d0d8eb40300       | dec                 ecx
            //   8935????????         |                     
            //   ff15????????         |                     
            //   e8????????           |                     
            //   488d0d76b40300       | mov                 ecx, dword ptr [esp + 0xa0]

        $sequence_9 = { 0fb6442460 8801 488b442470 4883c001 4889442470 eb19 488b842480000000 }
            // n = 7, score = 100
            //   0fb6442460           | dec                 eax
            //   8801                 | mov                 ecx, dword ptr [esp + 0x68]
            //   488b442470           | dec                 esp
            //   4883c001             | arpl                word ptr [esp + 0x24], bx
            //   4889442470           | dec                 eax
            //   eb19                 | mov                 eax, dword ptr [esp + 0x68]
            //   488b842480000000     | inc                 esp

    condition:
        7 of them and filesize < 573440
}