rule win_nim_blackout_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.nim_blackout."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.nim_blackout"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4821d0 4889c1 e8???????? 488945d0 488b4520 483945d0 480f4d45d0 }
            // n = 7, score = 100
            //   4821d0               | mov                 byte ptr [ebp - 0x1a], al
            //   4889c1               | jmp                 0x9b
            //   e8????????           |                     
            //   488945d0             | test                al, al
            //   488b4520             | jne                 0xae
            //   483945d0             | dec                 eax
            //   480f4d45d0           | cmp                 dword ptr [ebp - 0x18], 0xdbff

        $sequence_1 = { 4889c1 e8???????? 488b45a0 488b5510 4889c1 }
            // n = 5, score = 100
            //   4889c1               | dec                 eax
            //   e8????????           |                     
            //   488b45a0             | mov                 eax, dword ptr [eax]
            //   488b5510             | dec                 eax
            //   4889c1               | test                eax, eax

        $sequence_2 = { 488945d8 488b4510 488b00 ba08000000 4889c1 e8???????? 488b5510 }
            // n = 7, score = 100
            //   488945d8             | dec                 eax
            //   488b4510             | mov                 dword ptr [ebp - 0x48], eax
            //   488b00               | dec                 eax
            //   ba08000000           | mov                 eax, dword ptr [ebp + 0x18]
            //   4889c1               | dec                 eax
            //   e8????????           |                     
            //   488b5510             | mov                 dword ptr [ebp - 8], 0

        $sequence_3 = { 488945c8 ba00000000 488b45f0 4883c002 7105 ba01000000 4889c1 }
            // n = 7, score = 100
            //   488945c8             | mov                 dword ptr [ebp - 0x30], 0xb2
            //   ba00000000           | dec                 eax
            //   488b45f0             | lea                 eax, [0x1abad]
            //   4883c002             | dec                 eax
            //   7105                 | mov                 dword ptr [ebp - 0x28], eax
            //   ba01000000           | dec                 eax
            //   4889c1               | mov                 eax, dword ptr [ebp + 0x18]

        $sequence_4 = { 84c0 7532 488b45f0 488d0cc500000000 488d159f590200 488b45f8 48890411 }
            // n = 7, score = 100
            //   84c0                 | lea                 eax, [0x2839d]
            //   7532                 | dec                 eax
            //   488b45f0             | mov                 dword ptr [ebp - 0x38], eax
            //   488d0cc500000000     | mov                 byte ptr [ebp - 0x12], 0
            //   488d159f590200       | dec                 eax
            //   488b45f8             | mov                 eax, dword ptr [ebp - 0x10]
            //   48890411             | dec                 eax

        $sequence_5 = { 4889e5 4883ec20 48894d10 488b05???????? 4885c0 750c 488b4510 }
            // n = 7, score = 100
            //   4889e5               | lea                 ecx, [0x22f20]
            //   4883ec20             | inc                 ecx
            //   48894d10             | push                esp
            //   488b05????????       |                     
            //   4885c0               | push                edi
            //   750c                 | push                esi
            //   488b4510             | push                ebx

        $sequence_6 = { 7558 48c745c01e000000 488d0508d00000 488945c8 48837df000 7506 c645ff01 }
            // n = 7, score = 100
            //   7558                 | mov                 edx, 0x10
            //   48c745c01e000000     | dec                 eax
            //   488d0508d00000       | mov                 ecx, eax
            //   488945c8             | dec                 eax
            //   48837df000           | mov                 eax, dword ptr [ebp + 0x18]
            //   7506                 | dec                 eax
            //   c645ff01             | lea                 eax, [0x29313]

        $sequence_7 = { b900000000 4883c001 4889c2 488d45e8 488910 4889c8 83e001 }
            // n = 7, score = 100
            //   b900000000           | dec                 eax
            //   4883c001             | mov                 dword ptr [ebp - 0x30], 0x11e
            //   4889c2               | dec                 eax
            //   488d45e8             | lea                 eax, [0xd8d9]
            //   488910               | dec                 eax
            //   4889c8               | mov                 dword ptr [ebp - 0x28], eax
            //   83e001               | dec                 eax

        $sequence_8 = { 888585000000 0fb68585000000 83f001 84c0 0f857d010000 488b85a0000000 488b4048 }
            // n = 7, score = 100
            //   888585000000         | mov                 eax, dword ptr [ebp + 0x18]
            //   0fb68585000000       | dec                 eax
            //   83f001               | lea                 eax, [0x123e2]
            //   84c0                 | dec                 eax
            //   0f857d010000         | mov                 dword ptr [ebp - 0x58], eax
            //   488b85a0000000       | mov                 edx, 0
            //   488b4048             | dec                 eax

        $sequence_9 = { 48c7452000000000 488b8520010000 0fb600 0fbec0 488b5550 89c1 e8???????? }
            // n = 7, score = 100
            //   48c7452000000000     | mov                 eax, dword ptr [ebp + 0xe8]
            //   488b8520010000       | dec                 eax
            //   0fb600               | add                 eax, 0x30
            //   0fbec0               | dec                 eax
            //   488b5550             | mov                 eax, dword ptr [eax]
            //   89c1                 | dec                 eax
            //   e8????????           |                     

    condition:
        7 of them and filesize < 1068032
}