rule win_mailto_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2022-05-16"
        version = "1"
        description = "Detects win.mailto."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
        malpedia_rule_date = "20220513"
        malpedia_hash = "7f4b2229e6ae614d86d74917f6d5b41890e62a26"
        malpedia_version = "20220516"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 6a00 50 e8???????? 6a10 8d442454 6a00 }
            // n = 6, score = 400
            //   6a00                 | push                0
            //   50                   | push                eax
            //   e8????????           |                     
            //   6a10                 | push                0x10
            //   8d442454             | lea                 eax, [esp + 0x54]
            //   6a00                 | push                0

        $sequence_1 = { 50 e8???????? 83c440 8d84243c040000 ffb42490050000 50 }
            // n = 6, score = 400
            //   50                   | push                eax
            //   e8????????           |                     
            //   83c440               | add                 esp, 0x40
            //   8d84243c040000       | lea                 eax, [esp + 0x43c]
            //   ffb42490050000       | push                dword ptr [esp + 0x590]
            //   50                   | push                eax

        $sequence_2 = { 741b 8b4e10 8b07 5f 8b0488 8b4c240c }
            // n = 6, score = 400
            //   741b                 | je                  0x1d
            //   8b4e10               | mov                 ecx, dword ptr [esi + 0x10]
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   5f                   | pop                 edi
            //   8b0488               | mov                 eax, dword ptr [eax + ecx*4]
            //   8b4c240c             | mov                 ecx, dword ptr [esp + 0xc]

        $sequence_3 = { 0fa4ce01 89755c 03c9 894d58 8b4328 }
            // n = 5, score = 400
            //   0fa4ce01             | shld                esi, ecx, 1
            //   89755c               | mov                 dword ptr [ebp + 0x5c], esi
            //   03c9                 | add                 ecx, ecx
            //   894d58               | mov                 dword ptr [ebp + 0x58], ecx
            //   8b4328               | mov                 eax, dword ptr [ebx + 0x28]

        $sequence_4 = { 85db 0f8493000000 8b742414 85f6 0f8487000000 6a20 e8???????? }
            // n = 7, score = 400
            //   85db                 | test                ebx, ebx
            //   0f8493000000         | je                  0x99
            //   8b742414             | mov                 esi, dword ptr [esp + 0x14]
            //   85f6                 | test                esi, esi
            //   0f8487000000         | je                  0x8d
            //   6a20                 | push                0x20
            //   e8????????           |                     

        $sequence_5 = { 0f8449010000 0fb706 6685c0 0f84f7000000 0f1f840000000000 0fb74d00 0fb7d8 }
            // n = 7, score = 400
            //   0f8449010000         | je                  0x14f
            //   0fb706               | movzx               eax, word ptr [esi]
            //   6685c0               | test                ax, ax
            //   0f84f7000000         | je                  0xfd
            //   0f1f840000000000     | nop                 dword ptr [eax + eax]
            //   0fb74d00             | movzx               ecx, word ptr [ebp]
            //   0fb7d8               | movzx               ebx, ax

        $sequence_6 = { 6a50 8d842490020000 50 ffb424a4050000 e8???????? 8d842468010000 }
            // n = 6, score = 400
            //   6a50                 | push                0x50
            //   8d842490020000       | lea                 eax, [esp + 0x290]
            //   50                   | push                eax
            //   ffb424a4050000       | push                dword ptr [esp + 0x5a4]
            //   e8????????           |                     
            //   8d842468010000       | lea                 eax, [esp + 0x168]

        $sequence_7 = { 8bc1 c1e019 2be8 8b442418 }
            // n = 4, score = 400
            //   8bc1                 | mov                 eax, ecx
            //   c1e019               | shl                 eax, 0x19
            //   2be8                 | sub                 ebp, eax
            //   8b442418             | mov                 eax, dword ptr [esp + 0x18]

        $sequence_8 = { 0f10442454 0f114c2444 0f104b10 660ffec8 }
            // n = 4, score = 400
            //   0f10442454           | movups              xmm0, xmmword ptr [esp + 0x54]
            //   0f114c2444           | movups              xmmword ptr [esp + 0x44], xmm1
            //   0f104b10             | movups              xmm1, xmmword ptr [ebx + 0x10]
            //   660ffec8             | paddd               xmm1, xmm0

        $sequence_9 = { ffd0 85c0 0f8449010000 53 33db 85f6 0f843d010000 }
            // n = 7, score = 400
            //   ffd0                 | call                eax
            //   85c0                 | test                eax, eax
            //   0f8449010000         | je                  0x14f
            //   53                   | push                ebx
            //   33db                 | xor                 ebx, ebx
            //   85f6                 | test                esi, esi
            //   0f843d010000         | je                  0x143

    condition:
        7 of them and filesize < 180224
}

rule win_mailto_w0 { 
    meta: 
        copyright = "(c) 2020 Crowdstrike Inc." 
        author = "Crowdstrike"
        description = "Detects the Netwalker ransomware" 
        reports = "CSIT-20081" 
        source = "https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf"
        version = "202004281747" 
        last_modified = "2020-04-28" 
        malware_family = "Netwalker" 
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
        malpedia_rule_date = "20210224"
        malpedia_hash = ""
        malpedia_version = "20210224"
        malpedia_sharing = "TLP:WHITE"
    strings: 
        $salsaconst = "expand 32-byte kexpand 16-byte k" 
        $ins_getapi = {55 8b ec a1 ?? ?? ?? ?? 5d c3} 
        $ins_crc32 = {25 20 83 b8 ed 33 d0} 
        $ins_push1137 = {68 39 05 00 00 68 69 7a 00 00} 
        $ins_rc4 = {8b 45 ( e? | f? ) 83 c0 01 33 d2 b9 00 01 00 00 f7 f1 89 55} 
        $in_c25519 = {6a 00 68 41 db 01 00} 
    condition: 
        3 of them
}

rule win_mailto_w1 { 
    meta: 
        copyright = "(c) 2020 Crowdstrike Inc." 
        author = "Crowdstrike"
        description = "Detects the Netwalker ransomware" 
        reports = "CSIT-20081" 
        source = "https://go.crowdstrike.com/rs/281-OBQ-266/images/ReportCSIT-20081e.pdf"
        version = "202004281748" 
        last_modified = "2020-04-28" 
        malware_family = "Netwalker" 
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mailto"
        malpedia_rule_date = "20210224"
        malpedia_hash = ""
        malpedia_version = "20210224"
        malpedia_sharing = "TLP:WHITE"
    strings: 
        $ = "namesz" fullword 
        $ = "crmask" fullword 
        $ = "idsz" fullword 
        $ = "lend" fullword 
        $ = "lfile" fullword 
        $ = "mpk" fullword 
        $ = "namesz" fullword 
        $ = "pspath" fullword 
        $ = "rwsz" fullword 
        $ = "spsz" fullword 
        $ = "svcwait" fullword 
        $ = "unlocker" fullword 
        $ = "onion1" fullword 
    condition: 10 of them
}