rule win_nautilus_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2021-10-07"
        version = "1"
        description = "Detects win.nautilus."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus"
        malpedia_rule_date = "20211007"
        malpedia_hash = "e5b790e0f888f252d49063a1251ca60ec2832535"
        malpedia_version = "20211008"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { e8???????? 4533c9 488bcf 458d4102 488bd0 488bd8 48894640 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   4533c9               | lea                 ecx, dword ptr [0x5e0b0]
            //   488bcf               | mov                 ebx, 3
            //   458d4102             | test                eax, eax
            //   488bd0               | je                  0x1f13
            //   488bd8               | dec                 eax
            //   48894640             | lea                 edx, dword ptr [ebp - 0x20]

        $sequence_1 = { e8???????? 85c0 79da 488d55b8 498bcd e8???????? 8bd8 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   85c0                 | mov                 dword ptr [esp + 0x20], ecx
            //   79da                 | dec                 eax
            //   488d55b8             | lea                 ecx, dword ptr [ebp - 0x11]
            //   498bcd               | dec                 ecx
            //   e8????????           |                     
            //   8bd8                 | mov                 edx, esi

        $sequence_2 = { 498bf9 488bf2 48837d0000 488bd9 7512 eb07 33c0 }
            // n = 7, score = 100
            //   498bf9               | mov                 ecx, edi
            //   488bf2               | mov                 ecx, edi
            //   48837d0000           | cmp                 dword ptr [esp + 0x70], edi
            //   488bd9               | jle                 0xe5e
            //   7512                 | dec                 esp
            //   eb07                 | mov                 eax, esi
            //   33c0                 | inc                 esp

        $sequence_3 = { ebb6 488b442450 4c8900 33c0 ebaa 488bc4 48895808 }
            // n = 7, score = 100
            //   ebb6                 | je                  0xa85
            //   488b442450           | dec                 ecx
            //   4c8900               | mov                 edx, dword ptr [ecx + eax]
            //   33c0                 | test                byte ptr [edx + 9], 3
            //   ebaa                 | je                  0xa85
            //   488bc4               | dec                 ecx
            //   48895808             | mov                 ecx, ebx

        $sequence_4 = { e8???????? 488b7c2420 85db 0f8557feffff 4d8b7630 4d85f6 75a7 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   488b7c2420           | and                 eax, 0x1f
            //   85db                 | dec                 eax
            //   0f8557feffff         | imul                ecx, eax, 0x58
            //   4d8b7630             | dec                 eax
            //   4d85f6               | add                 ecx, dword ptr [esi + ebx*8]
            //   75a7                 | dec                 eax

        $sequence_5 = { 8bd6 c1c00d c1c20f 33d0 8bc6 c1e80a 33d0 }
            // n = 7, score = 100
            //   8bd6                 | mov                 eax, ebx
            //   c1c00d               | dec                 eax
            //   c1c20f               | mov                 edx, edi
            //   33d0                 | dec                 eax
            //   8bc6                 | mov                 ecx, ebp
            //   c1e80a               | dec                 eax
            //   33d0                 | mov                 ecx, ebp

        $sequence_6 = { 4803d1 498bcf e8???????? c1eb0e 8d830200feff 4898 48c1e002 }
            // n = 7, score = 100
            //   4803d1               | lea                 eax, dword ptr [0xfffff3fe]
            //   498bcf               | test                eax, eax
            //   e8????????           |                     
            //   c1eb0e               | jne                 0x5b3
            //   8d830200feff         | dec                 dword ptr [edi + 0x254]
            //   4898                 | inc                 ebp
            //   48c1e002             | xor                 esp, esp

        $sequence_7 = { 7ed7 83f80c 7e14 83f813 7ecd 83f815 741d }
            // n = 7, score = 100
            //   7ed7                 | dec                 eax
            //   83f80c               | mov                 dword ptr [eax + 0x20], edi
            //   7e14                 | inc                 ecx
            //   83f813               | push                esi
            //   7ecd                 | dec                 eax
            //   83f815               | sub                 esp, 0x20
            //   741d                 | inc                 ecx

        $sequence_8 = { 7504 8d421f c3 488d055082fbff 488901 83c8ff c3 }
            // n = 7, score = 100
            //   7504                 | dec                 eax
            //   8d421f               | add                 esp, 0x20
            //   c3                   | dec                 eax
            //   488d055082fbff       | test                edi, edi
            //   488901               | jne                 0x198e
            //   83c8ff               | jmp                 0x19b3
            //   c3                   | xor                 ecx, ecx

        $sequence_9 = { 884b09 488b4760 483bc3 751d 488bf0 41b801000000 488bd0 }
            // n = 7, score = 100
            //   884b09               | mov                 eax, dword ptr [ebp - 0x11]
            //   488b4760             | xor                 eax, eax
            //   483bc3               | test                edi, edi
            //   751d                 | inc                 esp
            //   488bf0               | mov                 ecx, ebx
            //   41b801000000         | dec                 ecx
            //   488bd0               | mov                 ecx, esi

    condition:
        7 of them and filesize < 1302528
}

rule win_nautilus_w0 {
    meta:
        description = "Rule for detection of Nautilus based on assembly code for a modified RC4 loop"
        author = "NCSC UK"
        hash = "a415ab193f6cd832a0de4fcc48d5f53d6f0b06d5e13b3c359878c6c31f3e7ec3"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nautilus"
        malpedia_version = "20180226"
        malpedia_license = "CC BY-NC-SA 4.0"
        malpedia_sharing = "TLP:WHITE"
    strings:
        $rc4_loop = {42 0F B6 14 04 41 FF C0 03 D7 0F B6 CA 8A 14 0C 43 32 14 13 41 88 12 49 FF C2
        49 FF C9}
        $rc4_key = {31 42 31 34 34 30 44 39 30 46 43 39 42 43 42 34 36 41 39 41 43 39 36 34 33 38
        46 45 45 41 38 42}
        $string_0 = "nautilus-service.dll" ascii
        $string_1 = "oxygen.dll" ascii
        $string_2 = "config_listen.system" ascii
        $string_3 = "ctx.system" ascii
        $string_4 = "3FDA3998-BEF5-426D-82D8-1A71F29ADDC3" ascii
        $string_5 = "C:\\ProgramData\\Microsoft\\Windows\\Caches\\{%s}.2.ver0x0000000000000001.db"
    condition:
        ($rc4_loop and $rc4_key) or (all of ($string_*)) 
}