rule win_nagini_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.nagini."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nagini"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { c1f805 8945e4 8bdf 83e31f c1e306 8b0485c0914200 }
            // n = 6, score = 100
            //   c1f805               | sar                 eax, 5
            //   8945e4               | mov                 dword ptr [ebp - 0x1c], eax
            //   8bdf                 | mov                 ebx, edi
            //   83e31f               | and                 ebx, 0x1f
            //   c1e306               | shl                 ebx, 6
            //   8b0485c0914200       | mov                 eax, dword ptr [eax*4 + 0x4291c0]

        $sequence_1 = { 2c25 16 2f 27 1a30 291a 322b }
            // n = 7, score = 100
            //   2c25                 | sub                 al, 0x25
            //   16                   | push                ss
            //   2f                   | das                 
            //   27                   | daa                 
            //   1a30                 | sbb                 dh, byte ptr [eax]
            //   291a                 | sub                 dword ptr [edx], ebx
            //   322b                 | xor                 ch, byte ptr [ebx]

        $sequence_2 = { 06 0505050505 0504040404 0404 }
            // n = 4, score = 100
            //   06                   | push                es
            //   0505050505           | add                 eax, 0x5050505
            //   0504040404           | add                 eax, 0x4040404
            //   0404                 | add                 al, 4

        $sequence_3 = { 090a 1109 0a0d???????? 06 0d05060c06 07 }
            // n = 6, score = 100
            //   090a                 | or                  dword ptr [edx], ecx
            //   1109                 | adc                 dword ptr [ecx], ecx
            //   0a0d????????         |                     
            //   06                   | push                es
            //   0d05060c06           | or                  eax, 0x60c0605
            //   07                   | pop                 es

        $sequence_4 = { 2b7b08 037b04 8b0495c0914200 8b95f4efffff }
            // n = 4, score = 100
            //   2b7b08               | sub                 edi, dword ptr [ebx + 8]
            //   037b04               | add                 edi, dword ptr [ebx + 4]
            //   8b0495c0914200       | mov                 eax, dword ptr [edx*4 + 0x4291c0]
            //   8b95f4efffff         | mov                 edx, dword ptr [ebp - 0x100c]

        $sequence_5 = { 68???????? e8???????? 83c404 6a64 ffd6 68dc050000 }
            // n = 6, score = 100
            //   68????????           |                     
            //   e8????????           |                     
            //   83c404               | add                 esp, 4
            //   6a64                 | push                0x64
            //   ffd6                 | call                esi
            //   68dc050000           | push                0x5dc

        $sequence_6 = { 0405 0a04050a04050a 0405 07 }
            // n = 4, score = 100
            //   0405                 | add                 al, 5
            //   0a04050a04050a       | or                  al, byte ptr [eax + 0xa05040a]
            //   0405                 | add                 al, 5
            //   07                   | pop                 es

        $sequence_7 = { c745e40c9a4200 a1???????? eb1a c745e4089a4200 a1???????? eb0c }
            // n = 6, score = 100
            //   c745e40c9a4200       | mov                 dword ptr [ebp - 0x1c], 0x429a0c
            //   a1????????           |                     
            //   eb1a                 | jmp                 0x1c
            //   c745e4089a4200       | mov                 dword ptr [ebp - 0x1c], 0x429a08
            //   a1????????           |                     
            //   eb0c                 | jmp                 0xe

        $sequence_8 = { 8b4d08 c7410801000000 8b5108 8b04958c8b4200 }
            // n = 4, score = 100
            //   8b4d08               | mov                 ecx, dword ptr [ebp + 8]
            //   c7410801000000       | mov                 dword ptr [ecx + 8], 1
            //   8b5108               | mov                 edx, dword ptr [ecx + 8]
            //   8b04958c8b4200       | mov                 eax, dword ptr [edx*4 + 0x428b8c]

        $sequence_9 = { 6a64 6a0a 6800000050 68???????? 68???????? 6a00 ffd6 }
            // n = 7, score = 100
            //   6a64                 | push                0x64
            //   6a0a                 | push                0xa
            //   6800000050           | push                0x50000000
            //   68????????           |                     
            //   68????????           |                     
            //   6a00                 | push                0
            //   ffd6                 | call                esi

    condition:
        7 of them and filesize < 12820480
}