rule win_matryoshka_rat_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.matryoshka_rat."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matryoshka_rat"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { b06f c3 b063 c3 }
            // n = 4, score = 400
            //   b06f                 | mov                 al, 0x6f
            //   c3                   | ret                 
            //   b063                 | mov                 al, 0x63
            //   c3                   | ret                 

        $sequence_1 = { b037 c3 b073 c3 }
            // n = 4, score = 400
            //   b037                 | mov                 al, 0x37
            //   c3                   | ret                 
            //   b073                 | mov                 al, 0x73
            //   c3                   | ret                 

        $sequence_2 = { 8b55ec 730c 891e 8d7204 }
            // n = 4, score = 200
            //   8b55ec               | mov                 edx, dword ptr [ebp - 0x14]
            //   730c                 | jae                 0xe
            //   891e                 | mov                 dword ptr [esi], ebx
            //   8d7204               | lea                 esi, [edx + 4]

        $sequence_3 = { 750d 66833b2e 7407 32c0 }
            // n = 4, score = 200
            //   750d                 | xor                 eax, eax
            //   66833b2e             | inc                 esp
            //   7407                 | mov                 dword ptr [ebx], ecx
            //   32c0                 | inc                 esp

        $sequence_4 = { 8b55ec 51 50 ff762c }
            // n = 4, score = 200
            //   8b55ec               | mov                 edx, dword ptr [ebp - 0x14]
            //   51                   | push                ecx
            //   50                   | push                eax
            //   ff762c               | push                dword ptr [esi + 0x2c]

        $sequence_5 = { 750d 8b442440 c1e008 03c6 }
            // n = 4, score = 200
            //   750d                 | dec                 eax
            //   8b442440             | lea                 edx, [0x3ac40]
            //   c1e008               | jne                 0xf
            //   03c6                 | cmp                 word ptr [ebx], 0x2e

        $sequence_6 = { 8b55ec 3bcf 8b7de8 7443 }
            // n = 4, score = 200
            //   8b55ec               | mov                 edx, dword ptr [ebp - 0x14]
            //   3bcf                 | cmp                 ecx, edi
            //   8b7de8               | mov                 edi, dword ptr [ebp - 0x18]
            //   7443                 | je                  0x45

        $sequence_7 = { 750d b800000100 8905???????? eb75 }
            // n = 4, score = 200
            //   750d                 | add                 eax, ebx
            //   b800000100           | mov                 dword ptr [esi], eax
            //   8905????????         |                     
            //   eb75                 | jmp                 0x10

        $sequence_8 = { 8b55e8 8bc8 2b0a 8a55ff }
            // n = 4, score = 200
            //   8b55e8               | mov                 edx, dword ptr [ebp - 0x18]
            //   8bc8                 | mov                 ecx, eax
            //   2b0a                 | sub                 ecx, dword ptr [edx]
            //   8a55ff               | mov                 dl, byte ptr [ebp - 1]

        $sequence_9 = { 750d b9f7ff0000 6623c1 6689442444 8b5584 488bcf }
            // n = 6, score = 200
            //   750d                 | mov                 eax, 0x10000
            //   b9f7ff0000           | jmp                 0x86
            //   6623c1               | cmp                 dword ptr [ecx], 2
            //   6689442444           | je                  0x13
            //   8b5584               | jne                 0xf
            //   488bcf               | mov                 eax, 0x10000

        $sequence_10 = { 750d 4d890e 33c0 44890b e9???????? 448b13 }
            // n = 6, score = 200
            //   750d                 | jne                 0xf
            //   4d890e               | dec                 ebp
            //   33c0                 | mov                 dword ptr [esi], ecx
            //   44890b               | xor                 eax, eax
            //   e9????????           |                     
            //   448b13               | inc                 esp

        $sequence_11 = { 8b55ec 3bc8 0f42c8 8d04bb }
            // n = 4, score = 200
            //   8b55ec               | mov                 edx, dword ptr [ebp - 0x14]
            //   3bc8                 | cmp                 ecx, eax
            //   0f42c8               | cmovb               ecx, eax
            //   8d04bb               | lea                 eax, [ebx + edi*4]

        $sequence_12 = { 8b55ec 891488 eb36 8b5d0c }
            // n = 4, score = 200
            //   8b55ec               | mov                 edx, dword ptr [ebp - 0x14]
            //   891488               | mov                 dword ptr [eax + ecx*4], edx
            //   eb36                 | jmp                 0x38
            //   8b5d0c               | mov                 ebx, dword ptr [ebp + 0xc]

        $sequence_13 = { 750d 8b442440 c1e018 03c3 8906 }
            // n = 5, score = 200
            //   750d                 | add                 eax, esi
            //   8b442440             | mov                 dword ptr [ebx], eax
            //   c1e018               | jmp                 0x10
            //   03c3                 | jne                 0xf
            //   8906                 | mov                 eax, dword ptr [esp + 0x40]

    condition:
        7 of them and filesize < 843776
}

rule win_matryoshka_rat_w0 {
    meta:
        author = "Florian Roth"
        description = "Detects Matryoshka RAT used in Operation Wilted Tulip"
        reference = "http://www.clearskysec.com/tulip"
        date = "2017-07-23"
        hash = "6f208473df0d31987a4999eeea04d24b069fdb6a8245150aa91dfdc063cd64ab"
        hash = "6cc1f4ecd28b833c978c8e21a20a002459b4a6c21a4fbaad637111aa9d5b1a32"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matryoshka_rat"
        malpedia_version = "20170914"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $s1 = "%S:\\Users\\public" fullword wide
        $s2 = "ntuser.dat.swp" fullword wide
        $s3 = "Job Save / Load Config" fullword wide
        $s4 = ".?AVPSCL_CLASS_JOB_SAVE_CONFIG@@" fullword ascii
        $s5 = "winupdate64.com" fullword ascii
        $s6 = "Job Save KeyLogger" fullword wide
    condition:
    filesize < 1000KB and 5 of them
}