rule win_newpass_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2023-07-11"
        version = "1"
        description = "Detects win.newpass."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.newpass"
        malpedia_rule_date = "20230705"
        malpedia_hash = "42d0574f4405bd7d2b154d321d345acb18834a41"
        malpedia_version = "20230715"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { eb03 48893b c6430801 0fb64309 3a4509 0f8579030000 c60670 }
            // n = 7, score = 700
            //   eb03                 | dec                 eax
            //   48893b               | mov                 edx, eax
            //   c6430801             | dec                 eax
            //   0fb64309             | mov                 esi, dword ptr [edi]
            //   3a4509               | inc                 esp
            //   0f8579030000         | mov                 dword ptr [esp + 0x48], esp
            //   c60670               | dec                 eax

        $sequence_1 = { ba14000000 498bcf ff15???????? 85c0 0f8427ffffff eb38 488b5758 }
            // n = 7, score = 700
            //   ba14000000           | dec                 eax
            //   498bcf               | cmp                 dword ptr [ebp + 0x188], 0x10
            //   ff15????????         |                     
            //   85c0                 | jb                  0x1e5a
            //   0f8427ffffff         | dec                 eax
            //   eb38                 | mov                 ecx, dword ptr [ebp + 0x170]
            //   488b5758             | dec                 eax

        $sequence_2 = { 4154 4156 4157 4883ec40 48c7442430feffffff 48895c2470 4d8bf9 }
            // n = 7, score = 700
            //   4154                 | dec                 ecx
            //   4156                 | mov                 esi, esi
            //   4157                 | test                al, al
            //   4883ec40             | je                  0x1958
            //   48c7442430feffffff     | nop    dword ptr [eax + eax]
            //   48895c2470           | dec                 eax
            //   4d8bf9               | inc                 esi

        $sequence_3 = { 8bea 6666660f1f840000000000 488d4c2420 41b800040000 83caff e8???????? 33d2 }
            // n = 7, score = 700
            //   8bea                 | mov                 eax, ebx
            //   6666660f1f840000000000     | dec    eax
            //   488d4c2420           | lea                 edx, [ebp - 0x78]
            //   41b800040000         | dec                 eax
            //   83caff               | mov                 ecx, edi
            //   e8????????           |                     
            //   33d2                 | nop                 

        $sequence_4 = { 754d 8bd3 4d8bc2 4c8b0d???????? 4d2bca 660f1f440000 }
            // n = 6, score = 700
            //   754d                 | dec                 eax
            //   8bd3                 | mov                 dword ptr [ebp + 0x48], ebx
            //   4d8bc2               | mov                 word ptr [ebp + 0x38], bx
            //   4c8b0d????????       |                     
            //   4d2bca               | dec                 eax
            //   660f1f440000         | cmp                 dword ptr [ebp - 0x70], 8

        $sequence_5 = { 7c53 3c39 7f4f 4181fa99999919 7206 7521 3c35 }
            // n = 7, score = 700
            //   7c53                 | dec                 eax
            //   3c39                 | mov                 dword ptr [ebp + 0xe0], eax
            //   7f4f                 | inc                 ecx
            //   4181fa99999919       | mov                 eax, esp
            //   7206                 | dec                 eax
            //   7521                 | cmp                 eax, ecx
            //   3c35                 | dec                 esp

        $sequence_6 = { 770e 807c24502d 7502 f7db 41891f eb03 830e02 }
            // n = 7, score = 700
            //   770e                 | mov                 ecx, edx
            //   807c24502d           | shr                 ecx, 0x1d
            //   7502                 | shl                 edx, 3
            //   f7db                 | inc                 ecx
            //   41891f               | mov                 byte ptr [ecx + eax - 6], cl
            //   eb03                 | dec                 eax
            //   830e02               | mov                 eax, dword ptr [edi]

        $sequence_7 = { e8???????? 3a4508 740d 488bcb e8???????? }
            // n = 5, score = 700
            //   e8????????           |                     
            //   3a4508               | dec                 eax
            //   740d                 | mov                 dword ptr [ebp + 0x288], 0xf
            //   488bcb               | dec                 esp
            //   e8????????           |                     

        $sequence_8 = { 4c8d4c2430 448bc3 488b8d40100000 ff15???????? 85c0 0f8448030000 395c2430 }
            // n = 7, score = 700
            //   4c8d4c2430           | mov                 byte ptr [edx - 1], al
            //   448bc3               | cmp                 ecx, 0x12
            //   488b8d40100000       | jb                  0xaff
            //   ff15????????         |                     
            //   85c0                 | inc                 ecx
            //   0f8448030000         | xor                 al, 0x74
            //   395c2430             | mov                 byte ptr [edx - 1], al

        $sequence_9 = { 4889742418 57 4883ec20 418bf0 488bea 488bf9 c7411003000000 }
            // n = 7, score = 700
            //   4889742418           | inc                 ebx
            //   57                   | lea                 eax, [ecx + ecx*2]
            //   4883ec20             | jb                  0x138e
            //   418bf0               | dec                 esp
            //   488bea               | mov                 eax, dword ptr [edi]
            //   488bf9               | jmp                 0x1391
            //   c7411003000000       | dec                 esp

    condition:
        7 of them and filesize < 2654208
}