rule win_mqsttang_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.mqsttang."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.mqsttang"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { f20f2ac0 f20f5905???????? 660f28c8 660f54ca 660f2ed9 7629 f20f58cb }
            // n = 7, score = 100
            //   f20f2ac0             | cvtsi2sd            xmm0, eax
            //   f20f5905????????     |                     
            //   660f28c8             | movapd              xmm1, xmm0
            //   660f54ca             | andpd               xmm1, xmm2
            //   660f2ed9             | ucomisd             xmm3, xmm1
            //   7629                 | jbe                 0x2b
            //   f20f58cb             | addsd               xmm1, xmm3

        $sequence_1 = { f0832801 8b85c0fdffff 0f845a010000 8b85b4fdffff 89780c 8b400c 85c0 }
            // n = 7, score = 100
            //   f0832801             | lock sub            dword ptr [eax], 1
            //   8b85c0fdffff         | mov                 eax, dword ptr [ebp - 0x240]
            //   0f845a010000         | je                  0x160
            //   8b85b4fdffff         | mov                 eax, dword ptr [ebp - 0x24c]
            //   89780c               | mov                 dword ptr [eax + 0xc], edi
            //   8b400c               | mov                 eax, dword ptr [eax + 0xc]
            //   85c0                 | test                eax, eax

        $sequence_2 = { e9???????? 89c7 89d9 89fb e8???????? 89f1 e8???????? }
            // n = 7, score = 100
            //   e9????????           |                     
            //   89c7                 | mov                 edi, eax
            //   89d9                 | mov                 ecx, ebx
            //   89fb                 | mov                 ebx, edi
            //   e8????????           |                     
            //   89f1                 | mov                 ecx, esi
            //   e8????????           |                     

        $sequence_3 = { ff5074 8b03 83ec04 89d9 8b707c ff5078 890424 }
            // n = 7, score = 100
            //   ff5074               | call                dword ptr [eax + 0x74]
            //   8b03                 | mov                 eax, dword ptr [ebx]
            //   83ec04               | sub                 esp, 4
            //   89d9                 | mov                 ecx, ebx
            //   8b707c               | mov                 esi, dword ptr [eax + 0x7c]
            //   ff5078               | call                dword ptr [eax + 0x78]
            //   890424               | mov                 dword ptr [esp], eax

        $sequence_4 = { e9???????? c74424240a030000 c744242001000000 e9???????? c74424240b030000 c744242000000000 e9???????? }
            // n = 7, score = 100
            //   e9????????           |                     
            //   c74424240a030000     | mov                 dword ptr [esp + 0x24], 0x30a
            //   c744242001000000     | mov                 dword ptr [esp + 0x20], 1
            //   e9????????           |                     
            //   c74424240b030000     | mov                 dword ptr [esp + 0x24], 0x30b
            //   c744242000000000     | mov                 dword ptr [esp + 0x20], 0
            //   e9????????           |                     

        $sequence_5 = { e8???????? e9???????? c744240405000000 c70424???????? e8???????? 8d5de4 8b4dd4 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   e9????????           |                     
            //   c744240405000000     | mov                 dword ptr [esp + 4], 5
            //   c70424????????       |                     
            //   e8????????           |                     
            //   8d5de4               | lea                 ebx, [ebp - 0x1c]
            //   8b4dd4               | mov                 ecx, dword ptr [ebp - 0x2c]

        $sequence_6 = { e8???????? 8d4c247c e8???????? 8d8c2480000000 e8???????? 8d8c2484000000 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   8d4c247c             | lea                 ecx, [esp + 0x7c]
            //   e8????????           |                     
            //   8d8c2480000000       | lea                 ecx, [esp + 0x80]
            //   e8????????           |                     
            //   8d8c2484000000       | lea                 ecx, [esp + 0x84]
            //   e8????????           |                     

        $sequence_7 = { f6040e10 7441 83c002 47 894338 39bdd8aeffff 77c7 }
            // n = 7, score = 100
            //   f6040e10             | test                byte ptr [esi + ecx], 0x10
            //   7441                 | je                  0x43
            //   83c002               | add                 eax, 2
            //   47                   | inc                 edi
            //   894338               | mov                 dword ptr [ebx + 0x38], eax
            //   39bdd8aeffff         | cmp                 dword ptr [ebp - 0x5128], edi
            //   77c7                 | ja                  0xffffffc9

        $sequence_8 = { f30f11442430 f20f115c2428 f30f11542420 f30f114c2418 e8???????? f20f106c2438 f20f105c2428 }
            // n = 7, score = 100
            //   f30f11442430         | movss               dword ptr [esp + 0x30], xmm0
            //   f20f115c2428         | movsd               qword ptr [esp + 0x28], xmm3
            //   f30f11542420         | movss               dword ptr [esp + 0x20], xmm2
            //   f30f114c2418         | movss               dword ptr [esp + 0x18], xmm1
            //   e8????????           |                     
            //   f20f106c2438         | movsd               xmm5, qword ptr [esp + 0x38]
            //   f20f105c2428         | movsd               xmm3, qword ptr [esp + 0x28]

        $sequence_9 = { e9???????? c744240cffffffff c7442408???????? 89542404 03400c 890424 e8???????? }
            // n = 7, score = 100
            //   e9????????           |                     
            //   c744240cffffffff     | mov                 dword ptr [esp + 0xc], 0xffffffff
            //   c7442408????????     |                     
            //   89542404             | mov                 dword ptr [esp + 4], edx
            //   03400c               | add                 eax, dword ptr [eax + 0xc]
            //   890424               | mov                 dword ptr [esp], eax
            //   e8????????           |                     

    condition:
        7 of them and filesize < 12651520
}