rule win_open_carrot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-05-04"
        version = "1"
        description = "Detects win.open_carrot."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.open_carrot"
        malpedia_rule_date = "20260422"
        malpedia_hash = "a182e35da64e6d71cb55f125c4d4225196523f14"
        malpedia_version = "20260504"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { 4981c700000000 490fb71f 4881cf3f000000 4989ed 4981c50a000000 412b5d00 }
            // n = 6, score = 100
            //   4981c700000000       | test                eax, eax
            //   490fb71f             | je                  0x5a5
            //   4881cf3f000000       | call                edi
            //   4989ed               | inc                 ebp
            //   4981c50a000000       | xor                 eax, eax
            //   412b5d00             | test                eax, eax

        $sequence_1 = { 7f74 f6c304 756f ba76000000 c7442420ad000000 4c8d0dda0d1000 8d4a98 }
            // n = 7, score = 100
            //   7f74                 | dec                 esp
            //   f6c304               | arpl                word ptr [ebp + 0x77], sp
            //   756f                 | inc                 ecx
            //   ba76000000           | cmp                 esp, 0x3b
            //   c7442420ad000000     | ja                  0x46e
            //   4c8d0dda0d1000       | ja                  0x59a
            //   8d4a98               | dec                 eax

        $sequence_2 = { c3 488d05b24b0600 c3 488d05da4b0600 c3 488d05fa4b0600 c3 }
            // n = 7, score = 100
            //   c3                   | mov                 dword ptr [esp + 0x20], 0x2a5
            //   488d05b24b0600       | dec                 esp
            //   c3                   | lea                 ecx, [0xc2ac1]
            //   488d05da4b0600       | mov                 ecx, 0xd
            //   c3                   | inc                 esp
            //   488d05fa4b0600       | lea                 eax, [edx - 2]
            //   c3                   | inc                 ecx

        $sequence_3 = { 498bcc 488d155bf51000 e8???????? 8d4720 41b87e000000 4863c8 488d1543f51000 }
            // n = 7, score = 100
            //   498bcc               | je                  0x45d
            //   488d155bf51000       | mov                 edx, 0xbc
            //   e8????????           |                     
            //   8d4720               | mov                 dword ptr [esp + 0x20], 0x7a
            //   41b87e000000         | dec                 esp
            //   4863c8               | lea                 ecx, [0xe2802]
            //   488d1543f51000       | mov                 ecx, 0x26

        $sequence_4 = { e8???????? 85c0 7422 ba75000000 c744242055000000 4c8d0dd85f0a00 8d4ab9 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   85c0                 | mov                 eax, ebp
            //   7422                 | dec                 eax
            //   ba75000000           | mov                 dword ptr [esp + 0x28], eax
            //   c744242055000000     | inc                 esp
            //   4c8d0dd85f0a00       | mov                 eax, eax
            //   8d4ab9               | mov                 eax, 0x4ec4ec4f

        $sequence_5 = { c702ff000000 8d41fd 4883c440 5b c3 33c9 4c8d0d03d91000 }
            // n = 7, score = 100
            //   c702ff000000         | xor                 edi, edi
            //   8d41fd               | inc                 ecx
            //   4883c440             | mov                 ecx, 0x252
            //   5b                   | inc                 ecx
            //   c3                   | mov                 eax, 0x26f
            //   33c9                 | dec                 eax
            //   4c8d0d03d91000       | lea                 edx, [0xa6cbb]

        $sequence_6 = { 8bd8 488d0569660900 48c1e304 4803d8 74d7 8b4b08 e8???????? }
            // n = 7, score = 100
            //   8bd8                 | xor                 edx, dword ptr [edi + 0x15b350]
            //   488d0569660900       | inc                 ecx
            //   48c1e304             | xor                 ecx, ebp
            //   4803d8               | inc                 ecx
            //   74d7                 | xor                 ecx, ecx
            //   8b4b08               | dec                 esi
            //   e8????????           |                     

        $sequence_7 = { 66833c4300 75f6 4898 66448974432e 488d43fe 0f1f840000000000 488d4002 }
            // n = 7, score = 100
            //   66833c4300           | dec                 ecx
            //   75f6                 | mov                 eax, edi
            //   4898                 | mov                 ecx, dword ptr [esi + 4]
            //   66448974432e         | mov                 dword ptr [eax], ecx
            //   488d43fe             | dec                 ebp
            //   0f1f840000000000     | test                edx, edx
            //   488d4002             | jne                 0x1918

        $sequence_8 = { 4989eb 4c31e9 4981c327000000 41810352a65858 4d29d4 4881c900000080 4989eb }
            // n = 7, score = 100
            //   4989eb               | lea                 edx, [0xddd57]
            //   4c31e9               | lea                 ecx, [eax - 0x6a]
            //   4981c327000000       | cmp                 eax, 0x6e
            //   41810352a65858       | ja                  0x329
            //   4d29d4               | dec                 esp
            //   4881c900000080       | lea                 eax, [0xfff279ae]
            //   4989eb               | dec                 eax

        $sequence_9 = { e8???????? 85c0 0f8551010000 488d4db3 e8???????? 85c0 0f852b010000 }
            // n = 7, score = 100
            //   e8????????           |                     
            //   85c0                 | sub                 edx, edx
            //   0f8551010000         | inc                 ecx
            //   488d4db3             | movzx               eax, cl
            //   e8????????           |                     
            //   85c0                 | inc                 esp
            //   0f852b010000         | mov                 edx, dword ptr [edi + ecx*4 + 0x15ab50]

    condition:
        7 of them and filesize < 8377344
}