rule win_matryoshka_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.matryoshka_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matryoshka_rat"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { b037 c3 b073 c3 }
            // n = 4, score = 400
            //   b037                 | mov                 al, 0x37
            //   c3                   | ret                 
            //   b073                 | mov                 al, 0x73
            //   c3                   | ret                 

        $sequence_1 = { c3 b06f c3 b063 c3 }
            // n = 5, score = 400
            //   c3                   | ret                 
            //   b06f                 | mov                 al, 0x6f
            //   c3                   | ret                 
            //   b063                 | mov                 al, 0x63
            //   c3                   | ret                 

        $sequence_2 = { 8b46fc 8947fc 49 75ed 5f ff4210 }
            // n = 6, score = 200
            //   8b46fc               | mov                 eax, dword ptr [esi - 4]
            //   8947fc               | mov                 dword ptr [edi - 4], eax
            //   49                   | dec                 ecx
            //   75ed                 | jne                 0xffffffef
            //   5f                   | pop                 edi
            //   ff4210               | inc                 dword ptr [edx + 0x10]

        $sequence_3 = { 8b4704 ff4710 ff07 8b0488 }
            // n = 4, score = 200
            //   8b4704               | mov                 eax, dword ptr [edi + 4]
            //   ff4710               | inc                 dword ptr [edi + 0x10]
            //   ff07                 | inc                 dword ptr [edi]
            //   8b0488               | mov                 eax, dword ptr [eax + ecx*4]

        $sequence_4 = { 74e3 440fb603 430fbe841040d30500 85c0 }
            // n = 4, score = 200
            //   74e3                 | je                  0xffffffe4
            //   440fb603             | inc                 dword ptr [ecx + 0x470]
            //   430fbe841040d30500     | cmp    dword ptr [ecx + 0x470], 2
            //   85c0                 | je                  0x1f8

        $sequence_5 = { 8b4708 3b470c 7507 8bcf }
            // n = 4, score = 200
            //   8b4708               | mov                 eax, dword ptr [edi + 8]
            //   3b470c               | cmp                 eax, dword ptr [edi + 0xc]
            //   7507                 | jne                 9
            //   8bcf                 | mov                 ecx, edi

        $sequence_6 = { 74e2 ff8170040000 83b97004000002 0f8493010000 83cfff 488d2d572c0300 }
            // n = 6, score = 200
            //   74e2                 | nop                 
            //   ff8170040000         | dec                 eax
            //   83b97004000002       | mov                 dword ptr [esp + 0x20], edi
            //   0f8493010000         | movzx               ecx, word ptr [edi]
            //   83cfff               | je                  0xffffffe4
            //   488d2d572c0300       | inc                 dword ptr [ecx + 0x470]

        $sequence_7 = { 74e9 488d15b9450400 488bcb e8???????? }
            // n = 4, score = 200
            //   74e9                 | dec                 eax
            //   488d15b9450400       | lea                 edx, [0x3ac2f]
            //   488bcb               | dec                 eax
            //   e8????????           |                     

        $sequence_8 = { 74de 83cbff 488bca e8???????? 90 48897c2420 }
            // n = 6, score = 200
            //   74de                 | je                  0xffffffe0
            //   83cbff               | or                  ebx, 0xffffffff
            //   488bca               | dec                 eax
            //   e8????????           |                     
            //   90                   | mov                 ecx, edx
            //   48897c2420           | nop                 

        $sequence_9 = { 8b4708 b120 8b570c 8b7718 }
            // n = 4, score = 200
            //   8b4708               | mov                 eax, dword ptr [edi + 8]
            //   b120                 | mov                 cl, 0x20
            //   8b570c               | mov                 edx, dword ptr [edi + 0xc]
            //   8b7718               | mov                 esi, dword ptr [edi + 0x18]

        $sequence_10 = { 74e6 488d152fac0300 488bcb e8???????? }
            // n = 4, score = 200
            //   74e6                 | test                eax, eax
            //   488d152fac0300       | jne                 0x24
            //   488bcb               | je                  0xffffffe5
            //   e8????????           |                     

        $sequence_11 = { 8b4704 8b3491 890491 8bd6 }
            // n = 4, score = 200
            //   8b4704               | mov                 eax, dword ptr [edi + 4]
            //   8b3491               | mov                 esi, dword ptr [ecx + edx*4]
            //   890491               | mov                 dword ptr [ecx + edx*4], eax
            //   8bd6                 | mov                 edx, esi

        $sequence_12 = { 74e2 ff8170040000 83b97004000002 0f84eb010000 83cfff 4c8d3dde290300 }
            // n = 6, score = 200
            //   74e2                 | cmp                 dword ptr [ecx + 0x470], 2
            //   ff8170040000         | je                  0x1a6
            //   83b97004000002       | or                  edi, 0xffffffff
            //   0f84eb010000         | dec                 eax
            //   83cfff               | lea                 ebp, [0x32c57]
            //   4c8d3dde290300       | mov                 dword ptr [ebx + 0x50], esi

        $sequence_13 = { 8b4704 8bf1 33d1 81e6ff030000 }
            // n = 4, score = 200
            //   8b4704               | mov                 eax, dword ptr [edi + 4]
            //   8bf1                 | mov                 esi, ecx
            //   33d1                 | xor                 edx, ecx
            //   81e6ff030000         | and                 esi, 0x3ff

    condition:
        7 of them and filesize < 843776
}

rule win_matryoshka_rat_w0 {
    meta:
        author = "Florian Roth"
        description = "Detects Matryoshka RAT used in Operation Wilted Tulip"
        reference = "http://www.clearskysec.com/tulip"
        date = "2017-07-23"
        hash = "6f208473df0d31987a4999eeea04d24b069fdb6a8245150aa91dfdc063cd64ab"
        hash = "6cc1f4ecd28b833c978c8e21a20a002459b4a6c21a4fbaad637111aa9d5b1a32"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matryoshka_rat"
        malpedia_version = "20170914"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $s1 = "%S:\\Users\\public" fullword wide
        $s2 = "ntuser.dat.swp" fullword wide
        $s3 = "Job Save / Load Config" fullword wide
        $s4 = ".?AVPSCL_CLASS_JOB_SAVE_CONFIG@@" fullword ascii
        $s5 = "winupdate64.com" fullword ascii
        $s6 = "Job Save KeyLogger" fullword wide
    condition:
    filesize < 1000KB and 5 of them
}