rule win_molerat_loader_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-01-25"
        version = "1"
        description = "Detects win.molerat_loader."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.molerat_loader"
        malpedia_rule_date = "20230124"
        malpedia_hash = "2ee0eebba83dce3d019a90519f2f972c0fcf9686"
        malpedia_version = "20230125"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 68???????? 8d8d74ffffff c645fc03 e8???????? 8d8574ffffff 50 8d4d5c }
            // n = 7, score = 100
            //   68????????           |                     
            //   8d8d74ffffff         | lea                 ecx, [ebp - 0x8c]
            //   c645fc03             | mov                 byte ptr [ebp - 4], 3
            //   e8????????           |                     
            //   8d8574ffffff         | lea                 eax, [ebp - 0x8c]
            //   50                   | push                eax
            //   8d4d5c               | lea                 ecx, [ebp + 0x5c]

        $sequence_1 = { 8b4204 ffd0 eb23 6810270000 ff15???????? 51 }
            // n = 6, score = 100
            //   8b4204               | mov                 eax, dword ptr [edx + 4]
            //   ffd0                 | call                eax
            //   eb23                 | jmp                 0x25
            //   6810270000           | push                0x2710
            //   ff15????????         |                     
            //   51                   | push                ecx

        $sequence_2 = { 83c7f0 896568 8bf4 ffd0 837f0c00 8d4f0c 7c11 }
            // n = 7, score = 100
            //   83c7f0               | add                 edi, -0x10
            //   896568               | mov                 dword ptr [ebp + 0x68], esp
            //   8bf4                 | mov                 esi, esp
            //   ffd0                 | call                eax
            //   837f0c00             | cmp                 dword ptr [edi + 0xc], 0
            //   8d4f0c               | lea                 ecx, [edi + 0xc]
            //   7c11                 | jl                  0x13

        $sequence_3 = { 85c0 0f856b020000 e8???????? 84c0 0f855e020000 }
            // n = 5, score = 100
            //   85c0                 | test                eax, eax
            //   0f856b020000         | jne                 0x271
            //   e8????????           |                     
            //   84c0                 | test                al, al
            //   0f855e020000         | jne                 0x264

        $sequence_4 = { 83c414 8b45fc ff34c57c3f4400 53 57 e8???????? 83c40c }
            // n = 7, score = 100
            //   83c414               | add                 esp, 0x14
            //   8b45fc               | mov                 eax, dword ptr [ebp - 4]
            //   ff34c57c3f4400       | push                dword ptr [eax*8 + 0x443f7c]
            //   53                   | push                ebx
            //   57                   | push                edi
            //   e8????????           |                     
            //   83c40c               | add                 esp, 0xc

        $sequence_5 = { e8???????? ed 90 40 }
            // n = 4, score = 100
            //   e8????????           |                     
            //   ed                   | in                  eax, dx
            //   90                   | nop                 
            //   40                   | inc                 eax

        $sequence_6 = { ffd0 eb06 8b3d???????? 837ef400 744f 8d4d60 51 }
            // n = 7, score = 100
            //   ffd0                 | call                eax
            //   eb06                 | jmp                 8
            //   8b3d????????         |                     
            //   837ef400             | cmp                 dword ptr [esi - 0xc], 0
            //   744f                 | je                  0x51
            //   8d4d60               | lea                 ecx, [ebp + 0x60]
            //   51                   | push                ecx

        $sequence_7 = { 50 8d4c242c 51 e8???????? 8b10 8b4a04 }
            // n = 6, score = 100
            //   50                   | push                eax
            //   8d4c242c             | lea                 ecx, [esp + 0x2c]
            //   51                   | push                ecx
            //   e8????????           |                     
            //   8b10                 | mov                 edx, dword ptr [eax]
            //   8b4a04               | mov                 ecx, dword ptr [edx + 4]

        $sequence_8 = { 99 bb90010000 f7fb 85d2 7409 8b34b5784b4400 }
            // n = 6, score = 100
            //   99                   | cdq                 
            //   bb90010000           | mov                 ebx, 0x190
            //   f7fb                 | idiv                ebx
            //   85d2                 | test                edx, edx
            //   7409                 | je                  0xb
            //   8b34b5784b4400       | mov                 esi, dword ptr [esi*4 + 0x444b78]

        $sequence_9 = { 7f0a 8b08 8b11 50 8b4204 ffd0 c645fc50 }
            // n = 7, score = 100
            //   7f0a                 | jg                  0xc
            //   8b08                 | mov                 ecx, dword ptr [eax]
            //   8b11                 | mov                 edx, dword ptr [ecx]
            //   50                   | push                eax
            //   8b4204               | mov                 eax, dword ptr [edx + 4]
            //   ffd0                 | call                eax
            //   c645fc50             | mov                 byte ptr [ebp - 4], 0x50

    condition:
        7 of them and filesize < 688128
}