rule win_meterpreter_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2020-12-22"
        version = "1"
        description = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.meterpreter"
        malpedia_rule_date = "20201222"
        malpedia_hash = "30354d830a29f0fbd3714d93d94dea941d77a130"
        malpedia_version = "20201023"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bb914f68b45 c86a0051 8b4d0c 52 8b5508 7751 52 }
            // n = 7, score = 200
            //   8bb914f68b45         | mov                 edi, dword ptr [ecx + 0x458bf614]
            //   c86a0051             | enter               0x6a, 0x51
            //   8b4d0c               | mov                 ecx, dword ptr [ebp + 0xc]
            //   52                   | push                edx
            //   8b5508               | mov                 edx, dword ptr [ebp + 8]
            //   7751                 | ja                  0x53
            //   52                   | push                edx

        $sequence_1 = { 008b35a8c19f 006860 2f 0000 }
            // n = 4, score = 200
            //   008b35a8c19f         | add                 byte ptr [ebx - 0x603e57cb], cl
            //   006860               | add                 byte ptr [eax + 0x60], ch
            //   2f                   | das                 
            //   0000                 | add                 byte ptr [eax], al

        $sequence_2 = { 55 8bec d84b08 3ddc4e0000 7d15 }
            // n = 5, score = 200
            //   55                   | push                ebp
            //   8bec                 | mov                 ebp, esp
            //   d84b08               | fmul                dword ptr [ebx + 8]
            //   3ddc4e0000           | cmp                 eax, 0x4edc
            //   7d15                 | jge                 0x17

        $sequence_3 = { 288a4b308808 8b16 40 4a 8916 7176 }
            // n = 6, score = 200
            //   288a4b308808         | sub                 byte ptr [edx + 0x888304b], cl
            //   8b16                 | mov                 edx, dword ptr [esi]
            //   40                   | inc                 eax
            //   4a                   | dec                 edx
            //   8916                 | mov                 dword ptr [esi], edx
            //   7176                 | jno                 0x78

        $sequence_4 = { 8b4526 f7d1 49 8bf9 47 }
            // n = 5, score = 200
            //   8b4526               | mov                 eax, dword ptr [ebp + 0x26]
            //   f7d1                 | not                 ecx
            //   49                   | dec                 ecx
            //   8bf9                 | mov                 edi, ecx
            //   47                   | inc                 edi

        $sequence_5 = { d3e6 8a4d10 4e 85f9 2a7405bb a8c2 40 }
            // n = 7, score = 200
            //   d3e6                 | shl                 esi, cl
            //   8a4d10               | mov                 cl, byte ptr [ebp + 0x10]
            //   4e                   | dec                 esi
            //   85f9                 | test                ecx, edi
            //   2a7405bb             | sub                 dh, byte ptr [ebp + eax - 0x45]
            //   a8c2                 | test                al, 0xc2
            //   40                   | inc                 eax

        $sequence_6 = { 8932 8b700c 83c204 4e 3bce 74ef ff9a0c8b5c03 }
            // n = 7, score = 200
            //   8932                 | mov                 dword ptr [edx], esi
            //   8b700c               | mov                 esi, dword ptr [eax + 0xc]
            //   83c204               | add                 edx, 4
            //   4e                   | dec                 esi
            //   3bce                 | cmp                 ecx, esi
            //   74ef                 | je                  0xfffffff1
            //   ff9a0c8b5c03         | lcall               [edx + 0x35c8b0c]

        $sequence_7 = { 83c410 3bf0 76e1 8bf0 }
            // n = 4, score = 200
            //   83c410               | add                 esp, 0x10
            //   3bf0                 | cmp                 esi, eax
            //   76e1                 | jbe                 0xffffffe3
            //   8bf0                 | mov                 esi, eax

        $sequence_8 = { 884000 858840008c88 91 0093534000f4 }
            // n = 4, score = 200
            //   884000               | mov                 byte ptr [eax], al
            //   858840008c88         | test                dword ptr [eax - 0x7773ffc0], ecx
            //   91                   | xchg                eax, ecx
            //   0093534000f4         | add                 byte ptr [ebx - 0xbffbfad], dl

        $sequence_9 = { 01c7 05e002a800 0000 004dfc }
            // n = 4, score = 200
            //   01c7                 | add                 edi, eax
            //   05e002a800           | add                 eax, 0xa802e0
            //   0000                 | add                 byte ptr [eax], al
            //   004dfc               | add                 byte ptr [ebp - 4], cl

    condition:
        7 of them and filesize < 188416
}