rule win_loup_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-03-28"
        version = "1"
        description = "Detects win.loup."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.loup"
        malpedia_rule_date = "20230328"
        malpedia_hash = "9d2d75cef573c1c2d861f5197df8f563b05a305d"
        malpedia_version = "20230407"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8d4900 8b4e04 8b45fc 8b1419 817c02fccccccccc 7512 8b441904 }
            // n = 7, score = 100
            //   8d4900               | lea                 ecx, [ecx]
            //   8b4e04               | mov                 ecx, dword ptr [esi + 4]
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   8b1419               | mov                 edx, dword ptr [ecx + ebx]
            //   817c02fccccccccc     | cmp                 dword ptr [edx + eax - 4], 0xcccccccc
            //   7512                 | jne                 0x14
            //   8b441904             | mov                 eax, dword ptr [ecx + ebx + 4]

        $sequence_1 = { 760a 3b1cc1 7205 40 3bc2 72f6 8b44c1fc }
            // n = 7, score = 100
            //   760a                 | jbe                 0xc
            //   3b1cc1               | cmp                 ebx, dword ptr [ecx + eax*8]
            //   7205                 | jb                  7
            //   40                   | inc                 eax
            //   3bc2                 | cmp                 eax, edx
            //   72f6                 | jb                  0xfffffff8
            //   8b44c1fc             | mov                 eax, dword ptr [ecx + eax*8 - 4]

        $sequence_2 = { 55 8bec 83ec0c a1???????? 8945f4 837df4ff }
            // n = 6, score = 100
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   83ec0c               | sub                 esp, 0xc
            //   a1????????           |                     
            //   8945f4               | mov                 dword ptr [ebp - 0xc], eax
            //   837df4ff             | cmp                 dword ptr [ebp - 0xc], -1

        $sequence_3 = { 7443 0fb745f4 50 e8???????? 83c404 85c0 741c }
            // n = 7, score = 100
            //   7443                 | je                  0x45
            //   0fb745f4             | movzx               eax, word ptr [ebp - 0xc]
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   85c0                 | test                eax, eax
            //   741c                 | je                  0x1e

        $sequence_4 = { 8b4804 894df8 e8???????? 8b55f8 8910 e8???????? }
            // n = 6, score = 100
            //   8b4804               | mov                 ecx, dword ptr [eax + 4]
            //   894df8               | mov                 dword ptr [ebp - 8], ecx
            //   e8????????           |                     
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]
            //   8910                 | mov                 dword ptr [eax], edx
            //   e8????????           |                     

        $sequence_5 = { 8945b4 8b45c0 50 e8???????? 837db400 }
            // n = 5, score = 100
            //   8945b4               | mov                 dword ptr [ebp - 0x4c], eax
            //   8b45c0               | mov                 eax, dword ptr [ebp - 0x40]
            //   50                   | push                eax
            //   e8????????           |                     
            //   837db400             | cmp                 dword ptr [ebp - 0x4c], 0

        $sequence_6 = { e8???????? 83c404 0fb745f4 50 e8???????? 83c404 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   0fb745f4             | movzx               eax, word ptr [ebp - 0xc]
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c404               | add                 esp, 4

        $sequence_7 = { e8???????? 83c404 eb07 c745e8ffffffff e8???????? eb07 }
            // n = 6, score = 100
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   eb07                 | jmp                 9
            //   c745e8ffffffff       | mov                 dword ptr [ebp - 0x18], 0xffffffff
            //   e8????????           |                     
            //   eb07                 | jmp                 9

        $sequence_8 = { 6802020000 e8???????? 85c0 750c c78568fcffff01000000 }
            // n = 5, score = 100
            //   6802020000           | push                0x202
            //   e8????????           |                     
            //   85c0                 | test                eax, eax
            //   750c                 | jne                 0xe
            //   c78568fcffff01000000     | mov    dword ptr [ebp - 0x398], 1

        $sequence_9 = { 8b4d10 8b0481 89049568a14100 ebda }
            // n = 4, score = 100
            //   8b4d10               | mov                 ecx, dword ptr [ebp + 0x10]
            //   8b0481               | mov                 eax, dword ptr [ecx + eax*4]
            //   89049568a14100       | mov                 dword ptr [edx*4 + 0x41a168], eax
            //   ebda                 | jmp                 0xffffffdc

    condition:
        7 of them and filesize < 257024
}

rule win_loup_w0 {
	meta:
		description = "Detects of ATM Malware Loup"
		author = "Frank Boldewin (@r3c0nst)"
		reference = "https://twitter.com/r3c0nst/status/1295275546780327936"
		source = "https://raw.githubusercontent.com/fboldewin/YARA-rules/master/ATM.Malware.Loup.yar"
		date = "2020-08-17"
		hash = "6c9e9f78963ab3e7acb43826906af22571250dc025f9e7116e0201b805dc1196"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.loup"
        malpedia_rule_date = "20200817"
        malpedia_version = "20200817"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

	strings:
		$String1 = "C:\\Users\\muham\\source\\repos\\loup\\Debug\\loup.pdb" ascii nocase
		$String2 = "CurrencyDispenser1" ascii nocase
		$Code = {50 68 C0 D4 01 00 8D 4D E8 51 68 2E 01 00 00 0F B7 55 08 52 E8} // Dispense
		
	condition:
		uint16(0) == 0x5A4D and filesize < 100KB and all of ($String*) and $Code
}