rule win_oceansalt_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.oceansalt."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.oceansalt"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 85db 7517 56 ff15???????? }
            // n = 4, score = 300
            //   85db                 | xor                 ebp, ebp
            //   7517                 | dec                 eax
            //   56                   | mov                 dword ptr [esp + 0x30], ebp
            //   ff15????????         |                     

        $sequence_1 = { 56 c645f400 ff15???????? 6a00 6a07 8d4df4 51 }
            // n = 7, score = 300
            //   56                   | mov                 dword ptr [esp + 0x20], edi
            //   c645f400             | test                eax, eax
            //   ff15????????         |                     
            //   6a00                 | je                  0xae
            //   6a07                 | dec                 eax
            //   8d4df4               | lea                 edi, [0xceb2]
            //   51                   | mov                 ecx, 2

        $sequence_2 = { 0fb795f2fbffff 50 0fb785eefbffff 51 52 50 }
            // n = 6, score = 300
            //   0fb795f2fbffff       | dec                 eax
            //   50                   | lea                 ecx, [esp + 0x50]
            //   0fb785eefbffff       | dec                 eax
            //   51                   | mov                 dword ptr [esp + 0x28], edi
            //   52                   | mov                 dword ptr [esp + 0x1100], 1
            //   50                   | dec                 eax

        $sequence_3 = { 83bdf4f9ffff00 77a2 57 ff15???????? 6a00 6a09 }
            // n = 6, score = 300
            //   83bdf4f9ffff00       | lea                 ecx, [0xc1ea]
            //   77a2                 | inc                 ecx
            //   57                   | mov                 byte ptr [ebx - 0x48], 0x53
            //   ff15????????         |                     
            //   6a00                 | dec                 ecx
            //   6a09                 | mov                 dword ptr [ebx - 0x47], eax

        $sequence_4 = { ff15???????? 57 ff15???????? 8b3d???????? 53 }
            // n = 5, score = 300
            //   ff15????????         |                     
            //   57                   | inc                 ecx
            //   ff15????????         |                     
            //   8b3d????????         |                     
            //   53                   | mov                 dword ptr [ebx - 0x3f], eax

        $sequence_5 = { 6a00 6808010000 8d95f4feffff 52 }
            // n = 4, score = 300
            //   6a00                 | ja                  0xffffffa4
            //   6808010000           | push                edi
            //   8d95f4feffff         | push                0
            //   52                   | push                9

        $sequence_6 = { c3 8b480c 8b01 85c0 7428 6a04 }
            // n = 6, score = 300
            //   c3                   | mov                 dword ptr [esp + 0x3a0], 1
            //   8b480c               | repe cmpsb          byte ptr [esi], byte ptr es:[edi]
            //   8b01                 | je                  0x197
            //   85c0                 | dec                 eax
            //   7428                 | lea                 esi, [esp + 0x8c]
            //   6a04                 | cmp                 dword ptr [ebp - 0x60c], 0

        $sequence_7 = { 52 56 c745f800000000 ffd7 }
            // n = 4, score = 300
            //   52                   | inc                 ecx
            //   56                   | mov                 byte ptr [ebx - 0x3b], al
            //   c745f800000000       | inc                 ecx
            //   ffd7                 | mov                 byte ptr [ebx - 0x47], 0x48

        $sequence_8 = { 4053 4883ec20 488bd9 488bca ff15???????? 4533c9 488bcb }
            // n = 7, score = 100
            //   4053                 | dec                 eax
            //   4883ec20             | lea                 ecx, [esp + 0x50]
            //   488bd9               | inc                 esp
            //   488bca               | lea                 eax, [ebp + 2]
            //   ff15????????         |                     
            //   4533c9               | inc                 ebp
            //   488bcb               | xor                 ecx, ecx

        $sequence_9 = { 48897c2428 c784240011000001000000 48897c2420 ff15???????? 8b05???????? 85c0 0f8496000000 }
            // n = 7, score = 100
            //   48897c2428           | xor                 edx, edx
            //   c784240011000001000000     | dec    eax
            //   48897c2420           | mov                 ecx, ebx
            //   ff15????????         |                     
            //   8b05????????         |                     
            //   85c0                 | dec                 eax
            //   0f8496000000         | lea                 edx, [esp + 0x40]

        $sequence_10 = { 4c8d25e7900000 488b0d???????? bf01000000 897c2470 }
            // n = 4, score = 100
            //   4c8d25e7900000       | dec                 eax
            //   488b0d????????       |                     
            //   bf01000000           | mov                 ecx, edx
            //   897c2470             | inc                 ebp

        $sequence_11 = { 488d0deac10000 41c643b853 498943b9 418943c1 }
            // n = 4, score = 100
            //   488d0deac10000       | dec                 eax
            //   41c643b853           | lea                 ecx, [0xc1ea]
            //   498943b9             | inc                 ecx
            //   418943c1             | mov                 byte ptr [ebx - 0x48], 0x53

        $sequence_12 = { ff15???????? 33ed 48896c2430 488d4c2450 448d4502 4533c9 }
            // n = 6, score = 100
            //   ff15????????         |                     
            //   33ed                 | dec                 ecx
            //   48896c2430           | mov                 dword ptr [ebx - 0x47], eax
            //   488d4c2450           | inc                 ecx
            //   448d4502             | mov                 dword ptr [ebx - 0x3f], eax
            //   4533c9               | xor                 ebp, ebp

        $sequence_13 = { 33d2 488bcb ff15???????? 488d542440 }
            // n = 4, score = 100
            //   33d2                 | sub                 esp, 0x20
            //   488bcb               | dec                 eax
            //   ff15????????         |                     
            //   488d542440           | mov                 ebx, ecx

        $sequence_14 = { 4b8b84f1a0470100 8a4c303a 413ac8 741d 3bdf }
            // n = 5, score = 100
            //   4b8b84f1a0470100     | jmp                 0x5e
            //   8a4c303a             | jmp                 0x50
            //   413ac8               | inc                 eax
            //   741d                 | push                ebx
            //   3bdf                 | dec                 eax

        $sequence_15 = { eb5c 488b0d???????? e8???????? eb4e }
            // n = 4, score = 100
            //   eb5c                 | dec                 eax
            //   488b0d????????       |                     
            //   e8????????           |                     
            //   eb4e                 | mov                 dword ptr [esp + 0x30], ebp

    condition:
        7 of them and filesize < 212992
}