rule win_nevada_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.nevada."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nevada"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 8bd9 4c8d0de5f00100 b904000000 4c8d05d1f00100 488d15c2da0100 e8???????? 8bcb }
            // n = 7, score = 100
            //   8bd9                 | mov                 ecx, dword ptr [ebp - 0x30]
            //   4c8d0de5f00100       | je                  0x13c
            //   b904000000           | mov                 esi, 0x110000
            //   4c8d05d1f00100       | inc                 ebp
            //   488d15c2da0100       | xor                 eax, eax
            //   e8????????           |                     
            //   8bcb                 | mov                 ecx, esi

        $sequence_1 = { 4885f6 488b5d28 0f8540020000 48c7431000000000 488b33 4889f1 baffffffff }
            // n = 7, score = 100
            //   4885f6               | dec                 eax
            //   488b5d28             | test                ebx, ebx
            //   0f8540020000         | je                  0x1b5
            //   48c7431000000000     | dec                 eax
            //   488b33               | lea                 ecx, [ebp - 8]
            //   4889f1               | dec                 eax
            //   baffffffff           | mov                 dword ptr [ebp + 0x198], esi

        $sequence_2 = { e8???????? 807d6000 7515 807d6101 0f84e3feffff 488d4df8 e8???????? }
            // n = 7, score = 100
            //   e8????????           |                     
            //   807d6000             | dec                 esp
            //   7515                 | lea                 eax, [0x4bcf0]
            //   807d6101             | dec                 eax
            //   0f84e3feffff         | lea                 ecx, [ebp + 0xe0]
            //   488d4df8             | dec                 eax
            //   e8????????           |                     

        $sequence_3 = { 488945c0 48c745c800000000 488d05067c0300 488945f0 48c745f801000000 48c7450000000000 488d05835a0300 }
            // n = 7, score = 100
            //   488945c0             | dec                 eax
            //   48c745c800000000     | lea                 ecx, [ebp - 0x40]
            //   488d05067c0300       | dec                 eax
            //   488945f0             | mov                 dword ptr [ebp], eax
            //   48c745f801000000     | dec                 eax
            //   48c7450000000000     | mov                 dword ptr [ebp + 8], esi
            //   488d05835a0300       | dec                 eax

        $sequence_4 = { 49896f48 488b6c2420 49896f50 488b6c2460 49896f58 488b6c2458 49896f60 }
            // n = 7, score = 100
            //   49896f48             | dec                 eax
            //   488b6c2420           | mov                 eax, dword ptr [ebp + 0x20]
            //   49896f50             | dec                 eax
            //   488b6c2460           | mov                 dword ptr [esp + 0x50], eax
            //   49896f58             | movups              xmm0, xmmword ptr [ebp]
            //   488b6c2458           | movups              xmm1, xmmword ptr [ebp + 0x10]
            //   49896f60             | dec                 ecx

        $sequence_5 = { 4c39d1 7613 4889c8 4829d0 757c e9???????? 4c8d52f0 }
            // n = 7, score = 100
            //   4c39d1               | inc                 ebp
            //   7613                 | xor                 edx, edx
            //   4889c8               | nop                 dword ptr [eax + eax]
            //   4829d0               | inc                 esi
            //   757c                 | cmp                 byte ptr [edx + edx], cl
            //   e9????????           |                     
            //   4c8d52f0             | dec                 esp

        $sequence_6 = { 0fb6473a 3c03 0f84b3010000 4138c4 0f8677feffff e9???????? 807c242700 }
            // n = 7, score = 100
            //   0fb6473a             | test                eax, eax
            //   3c03                 | je                  0x3c9
            //   0f84b3010000         | dec                 eax
            //   4138c4               | lea                 ecx, [0x28d62]
            //   0f8677feffff         | mov                 edx, 0x10
            //   e9????????           |                     
            //   807c242700           | jne                 0x87b

        $sequence_7 = { 488b8c24a0000000 488bbc2498000000 488d0439 48898424c8020000 4c8b4c2430 4b8d0431 48898424d0020000 }
            // n = 7, score = 100
            //   488b8c24a0000000     | mov                 dword ptr [ebp + 0x410], eax
            //   488bbc2498000000     | movaps              xmm0, xmmword ptr [ebp + 0x560]
            //   488d0439             | dec                 eax
            //   48898424c8020000     | mov                 ecx, dword ptr [eax + 0x328]
            //   4c8b4c2430           | dec                 eax
            //   4b8d0431             | add                 esi, -8
            //   48898424d0020000     | jne                 0x27c

        $sequence_8 = { 4901ff 488db5a0050000 660f1f840000000000 4c39ff 0f840c020000 488b95b0050000 483b95a8050000 }
            // n = 7, score = 100
            //   4901ff               | nop                 
            //   488db5a0050000       | dec                 ebx
            //   660f1f840000000000     | mov    eax, dword ptr [ebp + esi*8 + 0x328]
            //   4c39ff               | dec                 esp
            //   0f840c020000         | mov                 dword ptr [eax], ebp
            //   488b95b0050000       | dec                 ecx
            //   483b95a8050000       | add                 edx, ebx

        $sequence_9 = { bf10000000 480f45f8 488d442450 41bd20000000 4c0f45e8 80fa01 777b }
            // n = 7, score = 100
            //   bf10000000           | inc                 eax
            //   480f45f8             | setne               ch
            //   488d442450           | dec                 eax
            //   41bd20000000         | add                 eax, ebp
            //   4c0f45e8             | mov                 esi, 4
            //   80fa01               | dec                 eax
            //   777b                 | cmovae              esi, ecx

    condition:
        7 of them and filesize < 1063936
}