rule win_mocton_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.mocton."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mocton"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8b4db8 81e1dbb036e4 33c8 334db8 8b55b8 83c201 8955b8 }
            // n = 7, score = 100
            //   8b4db8               | mov                 ecx, dword ptr [ebp - 0x48]
            //   81e1dbb036e4         | and                 ecx, 0xe436b0db
            //   33c8                 | xor                 ecx, eax
            //   334db8               | xor                 ecx, dword ptr [ebp - 0x48]
            //   8b55b8               | mov                 edx, dword ptr [ebp - 0x48]
            //   83c201               | add                 edx, 1
            //   8955b8               | mov                 dword ptr [ebp - 0x48], edx

        $sequence_1 = { 0b55d0 8b45d0 83e801 8945d0 85d2 741e 8b4dd0 }
            // n = 7, score = 100
            //   0b55d0               | or                  edx, dword ptr [ebp - 0x30]
            //   8b45d0               | mov                 eax, dword ptr [ebp - 0x30]
            //   83e801               | sub                 eax, 1
            //   8945d0               | mov                 dword ptr [ebp - 0x30], eax
            //   85d2                 | test                edx, edx
            //   741e                 | je                  0x20
            //   8b4dd0               | mov                 ecx, dword ptr [ebp - 0x30]

        $sequence_2 = { 898584feffff e9???????? 8b8d9cfeffff 83e901 898d9cfeffff 8b959cfeffff 8b859cfeffff }
            // n = 7, score = 100
            //   898584feffff         | mov                 dword ptr [ebp - 0x17c], eax
            //   e9????????           |                     
            //   8b8d9cfeffff         | mov                 ecx, dword ptr [ebp - 0x164]
            //   83e901               | sub                 ecx, 1
            //   898d9cfeffff         | mov                 dword ptr [ebp - 0x164], ecx
            //   8b959cfeffff         | mov                 edx, dword ptr [ebp - 0x164]
            //   8b859cfeffff         | mov                 eax, dword ptr [ebp - 0x164]

        $sequence_3 = { b901000000 85c9 741d 8b955ceaffff c1e206 81ca2bb0d5ca 03955ceaffff }
            // n = 7, score = 100
            //   b901000000           | mov                 ecx, 1
            //   85c9                 | test                ecx, ecx
            //   741d                 | je                  0x1f
            //   8b955ceaffff         | mov                 edx, dword ptr [ebp - 0x15a4]
            //   c1e206               | shl                 edx, 6
            //   81ca2bb0d5ca         | or                  edx, 0xcad5b02b
            //   03955ceaffff         | add                 edx, dword ptr [ebp - 0x15a4]

        $sequence_4 = { 0b8dcce9ffff 898dcce9ffff e9???????? 8b95cce9ffff 69d237b0cb41 33c0 81fa237558e2 }
            // n = 7, score = 100
            //   0b8dcce9ffff         | or                  ecx, dword ptr [ebp - 0x1634]
            //   898dcce9ffff         | mov                 dword ptr [ebp - 0x1634], ecx
            //   e9????????           |                     
            //   8b95cce9ffff         | mov                 edx, dword ptr [ebp - 0x1634]
            //   69d237b0cb41         | imul                edx, edx, 0x41cbb037
            //   33c0                 | xor                 eax, eax
            //   81fa237558e2         | cmp                 edx, 0xe2587523

        $sequence_5 = { 7353 8bc1 c1f805 8bf1 8d3c85004d4400 8b07 83e61f }
            // n = 7, score = 100
            //   7353                 | jae                 0x55
            //   8bc1                 | mov                 eax, ecx
            //   c1f805               | sar                 eax, 5
            //   8bf1                 | mov                 esi, ecx
            //   8d3c85004d4400       | lea                 edi, [eax*4 + 0x444d00]
            //   8b07                 | mov                 eax, dword ptr [edi]
            //   83e61f               | and                 esi, 0x1f

        $sequence_6 = { 7e3e b8913b77ee 2b8508fdffff 398508fdffff 7c17 8b8d08fdffff c1e105 }
            // n = 7, score = 100
            //   7e3e                 | jle                 0x40
            //   b8913b77ee           | mov                 eax, 0xee773b91
            //   2b8508fdffff         | sub                 eax, dword ptr [ebp - 0x2f8]
            //   398508fdffff         | cmp                 dword ptr [ebp - 0x2f8], eax
            //   7c17                 | jl                  0x19
            //   8b8d08fdffff         | mov                 ecx, dword ptr [ebp - 0x2f8]
            //   c1e105               | shl                 ecx, 5

        $sequence_7 = { 0f94c1 81c9efb286ac 7412 8b956cfcffff 039560fcffff 89956cfcffff c785acfcffffeed81864 }
            // n = 7, score = 100
            //   0f94c1               | sete                cl
            //   81c9efb286ac         | or                  ecx, 0xac86b2ef
            //   7412                 | je                  0x14
            //   8b956cfcffff         | mov                 edx, dword ptr [ebp - 0x394]
            //   039560fcffff         | add                 edx, dword ptr [ebp - 0x3a0]
            //   89956cfcffff         | mov                 dword ptr [ebp - 0x394], edx
            //   c785acfcffffeed81864     | mov    dword ptr [ebp - 0x354], 0x6418d8ee

        $sequence_8 = { 894dec eb12 8b55f8 2b55ec 8955f8 8b45ec 83c001 }
            // n = 7, score = 100
            //   894dec               | mov                 dword ptr [ebp - 0x14], ecx
            //   eb12                 | jmp                 0x14
            //   8b55f8               | mov                 edx, dword ptr [ebp - 8]
            //   2b55ec               | sub                 edx, dword ptr [ebp - 0x14]
            //   8955f8               | mov                 dword ptr [ebp - 8], edx
            //   8b45ec               | mov                 eax, dword ptr [ebp - 0x14]
            //   83c001               | add                 eax, 1

        $sequence_9 = { c1e009 05335b8425 2385e4e9ffff 0b85ece9ffff 8985ece9ffff 8b8de4e9ffff }
            // n = 6, score = 100
            //   c1e009               | shl                 eax, 9
            //   05335b8425           | add                 eax, 0x25845b33
            //   2385e4e9ffff         | and                 eax, dword ptr [ebp - 0x161c]
            //   0b85ece9ffff         | or                  eax, dword ptr [ebp - 0x1614]
            //   8985ece9ffff         | mov                 dword ptr [ebp - 0x1614], eax
            //   8b8de4e9ffff         | mov                 ecx, dword ptr [ebp - 0x161c]

    condition:
        7 of them and filesize < 573440
}