rule win_mailto_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.mailto."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b442424 89742414 897c241c 894c2430 89542424 89442428 83ed01 }
            // n = 7, score = 400
            //   8b442424             | mov                 eax, dword ptr [esp + 0x24]
            //   89742414             | mov                 dword ptr [esp + 0x14], esi
            //   897c241c             | mov                 dword ptr [esp + 0x1c], edi
            //   894c2430             | mov                 dword ptr [esp + 0x30], ecx
            //   89542424             | mov                 dword ptr [esp + 0x24], edx
            //   89442428             | mov                 dword ptr [esp + 0x28], eax
            //   83ed01               | sub                 ebp, 1

        $sequence_1 = { 8b4500 8d4c2424 51 6a00 55 c744243000000000 }
            // n = 6, score = 400
            //   8b4500               | mov                 eax, dword ptr [ebp]
            //   8d4c2424             | lea                 ecx, [esp + 0x24]
            //   51                   | push                ecx
            //   6a00                 | push                0
            //   55                   | push                ebp
            //   c744243000000000     | mov                 dword ptr [esp + 0x30], 0

        $sequence_2 = { 0f84bd000000 3c0d 0f84b5000000 3c2c 0f84ad000000 3c7b 0f840b020000 }
            // n = 7, score = 400
            //   0f84bd000000         | je                  0xc3
            //   3c0d                 | cmp                 al, 0xd
            //   0f84b5000000         | je                  0xbb
            //   3c2c                 | cmp                 al, 0x2c
            //   0f84ad000000         | je                  0xb3
            //   3c7b                 | cmp                 al, 0x7b
            //   0f840b020000         | je                  0x211

        $sequence_3 = { 56 894140 e8???????? 8b0d???????? 68e5baf47e 56 894144 }
            // n = 7, score = 400
            //   56                   | push                esi
            //   894140               | mov                 dword ptr [ecx + 0x40], eax
            //   e8????????           |                     
            //   8b0d????????         |                     
            //   68e5baf47e           | push                0x7ef4bae5
            //   56                   | push                esi
            //   894144               | mov                 dword ptr [ecx + 0x44], eax

        $sequence_4 = { e8???????? 8bf0 83c404 85f6 744a 8b442414 8906 }
            // n = 7, score = 400
            //   e8????????           |                     
            //   8bf0                 | mov                 esi, eax
            //   83c404               | add                 esp, 4
            //   85f6                 | test                esi, esi
            //   744a                 | je                  0x4c
            //   8b442414             | mov                 eax, dword ptr [esp + 0x14]
            //   8906                 | mov                 dword ptr [esi], eax

        $sequence_5 = { 8b4610 8d7e14 8d048504000000 50 57 }
            // n = 5, score = 400
            //   8b4610               | mov                 eax, dword ptr [esi + 0x10]
            //   8d7e14               | lea                 edi, [esi + 0x14]
            //   8d048504000000       | lea                 eax, [eax*4 + 4]
            //   50                   | push                eax
            //   57                   | push                edi

        $sequence_6 = { 747d 55 8d3c73 57 e8???????? 83c404 }
            // n = 6, score = 400
            //   747d                 | je                  0x7f
            //   55                   | push                ebp
            //   8d3c73               | lea                 edi, [ebx + esi*2]
            //   57                   | push                edi
            //   e8????????           |                     
            //   83c404               | add                 esp, 4

        $sequence_7 = { ffd0 85c0 740f 03fe c744241c01000000 83d300 eb07 }
            // n = 7, score = 400
            //   ffd0                 | call                eax
            //   85c0                 | test                eax, eax
            //   740f                 | je                  0x11
            //   03fe                 | add                 edi, esi
            //   c744241c01000000     | mov                 dword ptr [esp + 0x1c], 1
            //   83d300               | adc                 ebx, 0
            //   eb07                 | jmp                 9

        $sequence_8 = { ff742410 57 8b4008 6a08 56 ffd0 5f }
            // n = 7, score = 400
            //   ff742410             | push                dword ptr [esp + 0x10]
            //   57                   | push                edi
            //   8b4008               | mov                 eax, dword ptr [eax + 8]
            //   6a08                 | push                8
            //   56                   | push                esi
            //   ffd0                 | call                eax
            //   5f                   | pop                 edi

        $sequence_9 = { 83c408 85c0 750d 46 3b7704 72d0 5f }
            // n = 7, score = 400
            //   83c408               | add                 esp, 8
            //   85c0                 | test                eax, eax
            //   750d                 | jne                 0xf
            //   46                   | inc                 esi
            //   3b7704               | cmp                 esi, dword ptr [edi + 4]
            //   72d0                 | jb                  0xffffffd2
            //   5f                   | pop                 edi

    condition:
        7 of them and filesize < 180224
}

rule win_mailto_w0 { 
    meta: 
        copyright = "(c) 2020 Crowdstrike Inc." 
        author = "Crowdstrike"
        description = "Detects the Netwalker ransomware" 
        reports = "CSIT-20081" 
        source = "https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf"
        version = "202004281747" 
        last_modified = "2020-04-28" 
        malware_family = "Netwalker" 
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
        malpedia_rule_date = "20210224"
        malpedia_hash = ""
        malpedia_version = "20210224"
        malpedia_sharing = "TLP:WHITE"
    strings: 
        $salsaconst = "expand 32-byte kexpand 16-byte k" 
        $ins_getapi = {55 8b ec a1 ?? ?? ?? ?? 5d c3} 
        $ins_crc32 = {25 20 83 b8 ed 33 d0} 
        $ins_push1137 = {68 39 05 00 00 68 69 7a 00 00} 
        $ins_rc4 = {8b 45 ( e? | f? ) 83 c0 01 33 d2 b9 00 01 00 00 f7 f1 89 55} 
        $in_c25519 = {6a 00 68 41 db 01 00} 
    condition: 
        3 of them
}

rule win_mailto_w1 { 
    meta: 
        copyright = "(c) 2020 Crowdstrike Inc." 
        author = "Crowdstrike"
        description = "Detects the Netwalker ransomware" 
        reports = "CSIT-20081" 
        source = "https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf"
        version = "202004281748" 
        last_modified = "2020-04-28" 
        malware_family = "Netwalker" 
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
        malpedia_rule_date = "20210224"
        malpedia_hash = ""
        malpedia_version = "20210224"
        malpedia_sharing = "TLP:WHITE"
    strings: 
        $ = "namesz" fullword 
        $ = "crmask" fullword 
        $ = "idsz" fullword 
        $ = "lend" fullword 
        $ = "lfile" fullword 
        $ = "mpk" fullword 
        $ = "namesz" fullword 
        $ = "pspath" fullword 
        $ = "rwsz" fullword 
        $ = "spsz" fullword 
        $ = "svcwait" fullword 
        $ = "unlocker" fullword 
        $ = "onion1" fullword 
    condition: 10 of them
}