rule win_matsnu_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.matsnu."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.matsnu"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c745b800000000 c745bc41424344 c745c045464748 c745c4494a4b4c c745c84d4e4f50 c745cc51525354 }
            // n = 6, score = 700
            //   c745b800000000       | mov                 dword ptr [ebp - 0x48], 0
            //   c745bc41424344       | mov                 dword ptr [ebp - 0x44], 0x44434241
            //   c745c045464748       | mov                 dword ptr [ebp - 0x40], 0x48474645
            //   c745c4494a4b4c       | mov                 dword ptr [ebp - 0x3c], 0x4c4b4a49
            //   c745c84d4e4f50       | mov                 dword ptr [ebp - 0x38], 0x504f4e4d
            //   c745cc51525354       | mov                 dword ptr [ebp - 0x34], 0x54535251

        $sequence_1 = { ff45c6 8b4dc2 b801000000 d3e0 }
            // n = 4, score = 700
            //   ff45c6               | inc                 dword ptr [ebp - 0x3a]
            //   8b4dc2               | mov                 ecx, dword ptr [ebp - 0x3e]
            //   b801000000           | mov                 eax, 1
            //   d3e0                 | shl                 eax, cl

        $sequence_2 = { c1e004 8b7dfa 01c7 8b45de 8907 8b45e6 c1e004 }
            // n = 7, score = 700
            //   c1e004               | shl                 eax, 4
            //   8b7dfa               | mov                 edi, dword ptr [ebp - 6]
            //   01c7                 | add                 edi, eax
            //   8b45de               | mov                 eax, dword ptr [ebp - 0x22]
            //   8907                 | mov                 dword ptr [edi], eax
            //   8b45e6               | mov                 eax, dword ptr [ebp - 0x1a]
            //   c1e004               | shl                 eax, 4

        $sequence_3 = { c745e800000000 c745ec00000000 c645f000 c645f100 }
            // n = 4, score = 700
            //   c745e800000000       | mov                 dword ptr [ebp - 0x18], 0
            //   c745ec00000000       | mov                 dword ptr [ebp - 0x14], 0
            //   c645f000             | mov                 byte ptr [ebp - 0x10], 0
            //   c645f100             | mov                 byte ptr [ebp - 0xf], 0

        $sequence_4 = { 2945ce ebd3 c745d600000000 c745da00010000 c745e200000000 8b7dfa 817de2ff000000 }
            // n = 7, score = 700
            //   2945ce               | sub                 dword ptr [ebp - 0x32], eax
            //   ebd3                 | jmp                 0xffffffd5
            //   c745d600000000       | mov                 dword ptr [ebp - 0x2a], 0
            //   c745da00010000       | mov                 dword ptr [ebp - 0x26], 0x100
            //   c745e200000000       | mov                 dword ptr [ebp - 0x1e], 0
            //   8b7dfa               | mov                 edi, dword ptr [ebp - 6]
            //   817de2ff000000       | cmp                 dword ptr [ebp - 0x1e], 0xff

        $sequence_5 = { e2fc 3945ca 7509 837dd20c }
            // n = 4, score = 700
            //   e2fc                 | loop                0xfffffffe
            //   3945ca               | cmp                 dword ptr [ebp - 0x36], eax
            //   7509                 | jne                 0xb
            //   837dd20c             | cmp                 dword ptr [ebp - 0x2e], 0xc

        $sequence_6 = { 817dd6000f0000 7303 ff45d6 8b45f2 c1e004 8b75fa 01c6 }
            // n = 7, score = 700
            //   817dd6000f0000       | cmp                 dword ptr [ebp - 0x2a], 0xf00
            //   7303                 | jae                 5
            //   ff45d6               | inc                 dword ptr [ebp - 0x2a]
            //   8b45f2               | mov                 eax, dword ptr [ebp - 0xe]
            //   c1e004               | shl                 eax, 4
            //   8b75fa               | mov                 esi, dword ptr [ebp - 6]
            //   01c6                 | add                 esi, eax

        $sequence_7 = { 31c9 8a4e01 80e1f0 c0e904 08c8 }
            // n = 5, score = 700
            //   31c9                 | xor                 ecx, ecx
            //   8a4e01               | mov                 cl, byte ptr [esi + 1]
            //   80e1f0               | and                 cl, 0xf0
            //   c0e904               | shr                 cl, 4
            //   08c8                 | or                  al, cl

        $sequence_8 = { 7201 c3 ff837d080074 06 837d0c00 7505 e9???????? }
            // n = 7, score = 700
            //   7201                 | jb                  3
            //   c3                   | ret                 
            //   ff837d080074         | inc                 dword ptr [ebx + 0x7400087d]
            //   06                   | push                es
            //   837d0c00             | cmp                 dword ptr [ebp + 0xc], 0
            //   7505                 | jne                 7
            //   e9????????           |                     

        $sequence_9 = { 837d1800 7405 8b7d18 8907 b820000000 eb02 }
            // n = 6, score = 700
            //   837d1800             | cmp                 dword ptr [ebp + 0x18], 0
            //   7405                 | je                  7
            //   8b7d18               | mov                 edi, dword ptr [ebp + 0x18]
            //   8907                 | mov                 dword ptr [edi], eax
            //   b820000000           | mov                 eax, 0x20
            //   eb02                 | jmp                 4

    condition:
        7 of them and filesize < 606992
}