rule win_newpass_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-12-06"
        version = "1"
        description = "Detects win.newpass."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newpass"
        malpedia_rule_date = "20231130"
        malpedia_hash = "fc8a0e9f343f6d6ded9e7df1a64dac0cc68d7351"
        malpedia_version = "20230808"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4d8bc4 eb0f 4983c8ff 49ffc0 6642833c4700 75f5 488bd7 }
            // n = 7, score = 700
            //   4d8bc4               | dec                 eax
            //   eb0f                 | add                 dword ptr [ebx + 8], 0x20
            //   4983c8ff             | dec                 eax
            //   49ffc0               | cmp                 esi, dword ptr [ebp - 0x50]
            //   6642833c4700         | mov                 edi, 0
            //   75f5                 | jb                  0xfffffedf
            //   488bd7               | dec                 eax

        $sequence_1 = { 488d542470 48837d8810 480f43542470 488b5910 4883791810 7203 }
            // n = 6, score = 700
            //   488d542470           | lea                 edx, [0xd6708]
            //   48837d8810           | lea                 ecx, [eax + 0x38]
            //   480f43542470         | jne                 0xadd
            //   488b5910             | dec                 esp
            //   4883791810           | mov                 eax, dword ptr [ebp + 0xc8]
            //   7203                 | dec                 ebp

        $sequence_2 = { 85c0 792e 488b842490000000 4889442428 4c8bce 440fb6c7 488d542470 }
            // n = 7, score = 700
            //   85c0                 | dec                 eax
            //   792e                 | lea                 edx, [ebp + 0x218]
            //   488b842490000000     | nop                 
            //   4889442428           | dec                 eax
            //   4c8bce               | add                 ebx, 0x48
            //   440fb6c7             | dec                 eax
            //   488d542470           | mov                 dword ptr [ebp - 0x58], ebx

        $sequence_3 = { eb09 418bc7 493bf6 0f95c0 85c0 7906 488b7f10 }
            // n = 7, score = 700
            //   eb09                 | cmp                 byte ptr [edx + 0x19], 0
            //   418bc7               | jne                 0x448
            //   493bf6               | dec                 eax
            //   0f95c0               | mov                 eax, edx
            //   85c0                 | dec                 eax
            //   7906                 | mov                 edx, dword ptr [edx]
            //   488b7f10             | cmp                 byte ptr [edx + 0x19], 0

        $sequence_4 = { 7503 488b07 483bc8 741b 448bc2 488bd0 e8???????? }
            // n = 7, score = 700
            //   7503                 | mov                 byte ptr [ecx], dh
            //   488b07               | dec                 eax
            //   483bc8               | lea                 edx, [ebx + 0x18]
            //   741b                 | dec                 ecx
            //   448bc2               | or                  ecx, 0xffffffff
            //   488bd0               | inc                 ebp
            //   e8????????           |                     

        $sequence_5 = { c7411006160000 8b4110 0f49c2 488939 894110 b001 }
            // n = 6, score = 700
            //   c7411006160000       | dec                 eax
            //   8b4110               | mov                 dword ptr [esp + 0x50], ebx
            //   0f49c2               | mov                 byte ptr [esp + 0x40], bl
            //   488939               | cmp                 byte ptr [eax], bl
            //   894110               | jne                 0x1458
            //   b001                 | dec                 eax

        $sequence_6 = { 488bcb e8???????? 84c0 753d 488bcb e8???????? 3a4500 }
            // n = 7, score = 700
            //   488bcb               | or                  edx, 0xffffffff
            //   e8????????           |                     
            //   84c0                 | dec                 eax
            //   753d                 | mov                 ecx, ebx
            //   488bcb               | mov                 edi, dword ptr [eax + 0x80]
            //   e8????????           |                     
            //   3a4500               | dec                 eax

        $sequence_7 = { 4c0f44ca 41397920 7340 498b4110 488bd3 498bca }
            // n = 6, score = 700
            //   4c0f44ca             | inc                 edx
            //   41397920             | cmp                 byte ptr [edx + eax], 0
            //   7340                 | jne                 0x1ae3
            //   498b4110             | dec                 eax
            //   488bd3               | lea                 ecx, [ebp - 0x59]
            //   498bca               | nop                 

        $sequence_8 = { 7410 4c8bce 488bc8 e8???????? 488bd8 eb03 498bdd }
            // n = 7, score = 700
            //   7410                 | cmp                 ecx, 6
            //   4c8bce               | jb                  0x1afa
            //   488bc8               | xor                 al, 0x64
            //   e8????????           |                     
            //   488bd8               | mov                 byte ptr [ecx], al
            //   eb03                 | inc                 edx
            //   498bdd               | dec                 eax

        $sequence_9 = { 807a1900 7525 488bc2 488b12 807a1900 7539 6666660f1f840000000000 }
            // n = 7, score = 700
            //   807a1900             | cmp                 edx, 8
            //   7525                 | inc                 ebx
            //   488bc2               | movzx               eax, byte ptr [ecx + eax]
            //   488b12               | xor                 al, cl
            //   807a1900             | xor                 al, 0x5c
            //   7539                 | inc                 ecx
            //   6666660f1f840000000000     | mov    byte ptr [eax], al

    condition:
        7 of them and filesize < 2654208
}