rule win_mocton_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.mocton."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mocton"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 83f001 0f843f010000 8b4dcc 83c101 894dcc 8b55cc 8b45cc }
            // n = 7, score = 100
            //   83f001               | xor                 eax, 1
            //   0f843f010000         | je                  0x145
            //   8b4dcc               | mov                 ecx, dword ptr [ebp - 0x34]
            //   83c101               | add                 ecx, 1
            //   894dcc               | mov                 dword ptr [ebp - 0x34], ecx
            //   8b55cc               | mov                 edx, dword ptr [ebp - 0x34]
            //   8b45cc               | mov                 eax, dword ptr [ebp - 0x34]

        $sequence_1 = { 81c15366cc2a 33d2 3b8d24fbffff 0f95c2 81e23e6061db 81f2607c608b }
            // n = 6, score = 100
            //   81c15366cc2a         | add                 ecx, 0x2acc6653
            //   33d2                 | xor                 edx, edx
            //   3b8d24fbffff         | cmp                 ecx, dword ptr [ebp - 0x4dc]
            //   0f95c2               | setne               dl
            //   81e23e6061db         | and                 edx, 0xdb61603e
            //   81f2607c608b         | xor                 edx, 0x8b607c60

        $sequence_2 = { 3d44ee8048 7f0c c785acfdffff01000000 eb0a c785acfdffff00000000 8b95acfdffff 81e20caea439 }
            // n = 7, score = 100
            //   3d44ee8048           | cmp                 eax, 0x4880ee44
            //   7f0c                 | jg                  0xe
            //   c785acfdffff01000000     | mov    dword ptr [ebp - 0x254], 1
            //   eb0a                 | jmp                 0xc
            //   c785acfdffff00000000     | mov    dword ptr [ebp - 0x254], 0
            //   8b95acfdffff         | mov                 edx, dword ptr [ebp - 0x254]
            //   81e20caea439         | and                 edx, 0x39a4ae0c

        $sequence_3 = { 8955e8 8b45e8 83e801 8945e8 6a03 68???????? e8???????? }
            // n = 7, score = 100
            //   8955e8               | mov                 dword ptr [ebp - 0x18], edx
            //   8b45e8               | mov                 eax, dword ptr [ebp - 0x18]
            //   83e801               | sub                 eax, 1
            //   8945e8               | mov                 dword ptr [ebp - 0x18], eax
            //   6a03                 | push                3
            //   68????????           |                     
            //   e8????????           |                     

        $sequence_4 = { 0faf950cfbffff 0faf950cfbffff 89950cfbffff 8b850cfbffff 83c001 89850cfbffff 6a02 }
            // n = 7, score = 100
            //   0faf950cfbffff       | imul                edx, dword ptr [ebp - 0x4f4]
            //   0faf950cfbffff       | imul                edx, dword ptr [ebp - 0x4f4]
            //   89950cfbffff         | mov                 dword ptr [ebp - 0x4f4], edx
            //   8b850cfbffff         | mov                 eax, dword ptr [ebp - 0x4f4]
            //   83c001               | add                 eax, 1
            //   89850cfbffff         | mov                 dword ptr [ebp - 0x4f4], eax
            //   6a02                 | push                2

        $sequence_5 = { 8b8d68feffff 81e9ef3da703 0b8dd4fdffff 7422 8b9568feffff 81f2fcd0115a 81f2bfe3969a }
            // n = 7, score = 100
            //   8b8d68feffff         | mov                 ecx, dword ptr [ebp - 0x198]
            //   81e9ef3da703         | sub                 ecx, 0x3a73def
            //   0b8dd4fdffff         | or                  ecx, dword ptr [ebp - 0x22c]
            //   7422                 | je                  0x24
            //   8b9568feffff         | mov                 edx, dword ptr [ebp - 0x198]
            //   81f2fcd0115a         | xor                 edx, 0x5a11d0fc
            //   81f2bfe3969a         | xor                 edx, 0x9a96e3bf

        $sequence_6 = { 8b9590fdffff c1e209 8b8590fdffff 2bc2 898590fdffff 6800040000 e8???????? }
            // n = 7, score = 100
            //   8b9590fdffff         | mov                 edx, dword ptr [ebp - 0x270]
            //   c1e209               | shl                 edx, 9
            //   8b8590fdffff         | mov                 eax, dword ptr [ebp - 0x270]
            //   2bc2                 | sub                 eax, edx
            //   898590fdffff         | mov                 dword ptr [ebp - 0x270], eax
            //   6800040000           | push                0x400
            //   e8????????           |                     

        $sequence_7 = { 85c9 7462 b8337b9ca9 2b85d8fcffff 33c9 3b85d8fcffff 0f9dc1 }
            // n = 7, score = 100
            //   85c9                 | test                ecx, ecx
            //   7462                 | je                  0x64
            //   b8337b9ca9           | mov                 eax, 0xa99c7b33
            //   2b85d8fcffff         | sub                 eax, dword ptr [ebp - 0x328]
            //   33c9                 | xor                 ecx, ecx
            //   3b85d8fcffff         | cmp                 eax, dword ptr [ebp - 0x328]
            //   0f9dc1               | setge               cl

        $sequence_8 = { 69c972b1ac43 898dacfeffff eb79 8b95acfeffff 83ea01 8995acfeffff 8b85acfeffff }
            // n = 7, score = 100
            //   69c972b1ac43         | imul                ecx, ecx, 0x43acb172
            //   898dacfeffff         | mov                 dword ptr [ebp - 0x154], ecx
            //   eb79                 | jmp                 0x7b
            //   8b95acfeffff         | mov                 edx, dword ptr [ebp - 0x154]
            //   83ea01               | sub                 edx, 1
            //   8995acfeffff         | mov                 dword ptr [ebp - 0x154], edx
            //   8b85acfeffff         | mov                 eax, dword ptr [ebp - 0x154]

        $sequence_9 = { 0f9dc1 81c9540e540f 7455 8b9590fdffff c1e209 8b8590fdffff c1e009 }
            // n = 7, score = 100
            //   0f9dc1               | setge               cl
            //   81c9540e540f         | or                  ecx, 0xf540e54
            //   7455                 | je                  0x57
            //   8b9590fdffff         | mov                 edx, dword ptr [ebp - 0x270]
            //   c1e209               | shl                 edx, 9
            //   8b8590fdffff         | mov                 eax, dword ptr [ebp - 0x270]
            //   c1e009               | shl                 eax, 9

    condition:
        7 of them and filesize < 573440
}