rule win_mailto_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.mailto."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 56 e8???????? 83c40c 85c0 75e7 5f 5e }
            // n = 7, score = 400
            //   56                   | push                esi
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc
            //   85c0                 | test                eax, eax
            //   75e7                 | jne                 0xffffffe9
            //   5f                   | pop                 edi
            //   5e                   | pop                 esi

        $sequence_1 = { 68dee412a3 56 894134 e8???????? 8b0d???????? 689a8f3aca 56 }
            // n = 7, score = 400
            //   68dee412a3           | push                0xa312e4de
            //   56                   | push                esi
            //   894134               | mov                 dword ptr [ecx + 0x34], eax
            //   e8????????           |                     
            //   8b0d????????         |                     
            //   689a8f3aca           | push                0xca3a8f9a
            //   56                   | push                esi

        $sequence_2 = { 5e 85c9 890f 5b 0f95c0 5f c3 }
            // n = 7, score = 400
            //   5e                   | pop                 esi
            //   85c9                 | test                ecx, ecx
            //   890f                 | mov                 dword ptr [edi], ecx
            //   5b                   | pop                 ebx
            //   0f95c0               | setne               al
            //   5f                   | pop                 edi
            //   c3                   | ret                 

        $sequence_3 = { c744246474000000 e8???????? 8d4c2414 51 56 8b4030 ffd0 }
            // n = 7, score = 400
            //   c744246474000000     | mov                 dword ptr [esp + 0x64], 0x74
            //   e8????????           |                     
            //   8d4c2414             | lea                 ecx, [esp + 0x14]
            //   51                   | push                ecx
            //   56                   | push                esi
            //   8b4030               | mov                 eax, dword ptr [eax + 0x30]
            //   ffd0                 | call                eax

        $sequence_4 = { e8???????? 83c444 6a00 6841db0100 ffb424b0000000 ffb424b0000000 e8???????? }
            // n = 7, score = 400
            //   e8????????           |                     
            //   83c444               | add                 esp, 0x44
            //   6a00                 | push                0
            //   6841db0100           | push                0x1db41
            //   ffb424b0000000       | push                dword ptr [esp + 0xb0]
            //   ffb424b0000000       | push                dword ptr [esp + 0xb0]
            //   e8????????           |                     

        $sequence_5 = { 23c8 8bc1 c1e01a 29442420 8b442424 03c1 89442424 }
            // n = 7, score = 400
            //   23c8                 | and                 ecx, eax
            //   8bc1                 | mov                 eax, ecx
            //   c1e01a               | shl                 eax, 0x1a
            //   29442420             | sub                 dword ptr [esp + 0x20], eax
            //   8b442424             | mov                 eax, dword ptr [esp + 0x24]
            //   03c1                 | add                 eax, ecx
            //   89442424             | mov                 dword ptr [esp + 0x24], eax

        $sequence_6 = { eb08 e8???????? 8b4048 8d4c2410 51 ffd0 880437 }
            // n = 7, score = 400
            //   eb08                 | jmp                 0xa
            //   e8????????           |                     
            //   8b4048               | mov                 eax, dword ptr [eax + 0x48]
            //   8d4c2410             | lea                 ecx, [esp + 0x10]
            //   51                   | push                ecx
            //   ffd0                 | call                eax
            //   880437               | mov                 byte ptr [edi + esi], al

        $sequence_7 = { 33d0 03743c2c 8bc3 03742424 83c704 c1c802 33d0 }
            // n = 7, score = 400
            //   33d0                 | xor                 edx, eax
            //   03743c2c             | add                 esi, dword ptr [esp + edi + 0x2c]
            //   8bc3                 | mov                 eax, ebx
            //   03742424             | add                 esi, dword ptr [esp + 0x24]
            //   83c704               | add                 edi, 4
            //   c1c802               | ror                 eax, 2
            //   33d0                 | xor                 edx, eax

        $sequence_8 = { 8d2c8d00000000 23e9 8b4c2430 81f1ffffff03 f7d1 8bc1 8bdd }
            // n = 7, score = 400
            //   8d2c8d00000000       | lea                 ebp, [ecx*4]
            //   23e9                 | and                 ebp, ecx
            //   8b4c2430             | mov                 ecx, dword ptr [esp + 0x30]
            //   81f1ffffff03         | xor                 ecx, 0x3ffffff
            //   f7d1                 | not                 ecx
            //   8bc1                 | mov                 eax, ecx
            //   8bdd                 | mov                 ebx, ebp

        $sequence_9 = { ffb424d0000000 89442430 ffb424d0000000 89542438 e8???????? 6a00 6841db0100 }
            // n = 7, score = 400
            //   ffb424d0000000       | push                dword ptr [esp + 0xd0]
            //   89442430             | mov                 dword ptr [esp + 0x30], eax
            //   ffb424d0000000       | push                dword ptr [esp + 0xd0]
            //   89542438             | mov                 dword ptr [esp + 0x38], edx
            //   e8????????           |                     
            //   6a00                 | push                0
            //   6841db0100           | push                0x1db41

    condition:
        7 of them and filesize < 180224
}

rule win_mailto_w0 { 
    meta: 
        copyright = "(c) 2020 Crowdstrike Inc." 
        author = "Crowdstrike"
        description = "Detects the Netwalker ransomware" 
        reports = "CSIT-20081" 
        source = "https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf"
        version = "202004281747" 
        last_modified = "2020-04-28" 
        malware_family = "Netwalker" 
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
        malpedia_rule_date = "20210224"
        malpedia_hash = ""
        malpedia_version = "20210224"
        malpedia_sharing = "TLP:WHITE"
    strings: 
        $salsaconst = "expand 32-byte kexpand 16-byte k" 
        $ins_getapi = {55 8b ec a1 ?? ?? ?? ?? 5d c3} 
        $ins_crc32 = {25 20 83 b8 ed 33 d0} 
        $ins_push1137 = {68 39 05 00 00 68 69 7a 00 00} 
        $ins_rc4 = {8b 45 ( e? | f? ) 83 c0 01 33 d2 b9 00 01 00 00 f7 f1 89 55} 
        $in_c25519 = {6a 00 68 41 db 01 00} 
    condition: 
        3 of them
}

rule win_mailto_w1 { 
    meta: 
        copyright = "(c) 2020 Crowdstrike Inc." 
        author = "Crowdstrike"
        description = "Detects the Netwalker ransomware" 
        reports = "CSIT-20081" 
        source = "https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf"
        version = "202004281748" 
        last_modified = "2020-04-28" 
        malware_family = "Netwalker" 
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
        malpedia_rule_date = "20210224"
        malpedia_hash = ""
        malpedia_version = "20210224"
        malpedia_sharing = "TLP:WHITE"
    strings: 
        $ = "namesz" fullword 
        $ = "crmask" fullword 
        $ = "idsz" fullword 
        $ = "lend" fullword 
        $ = "lfile" fullword 
        $ = "mpk" fullword 
        $ = "namesz" fullword 
        $ = "pspath" fullword 
        $ = "rwsz" fullword 
        $ = "spsz" fullword 
        $ = "svcwait" fullword 
        $ = "unlocker" fullword 
        $ = "onion1" fullword 
    condition: 10 of them
}