rule win_open_carrot_auto {

    meta:
        author = "Felix Bilstein - yara-signator at cocacoding dot com"
        date = "2026-09-17"
        version = "1"
        description = "Detects win.open_carrot."
        info = "autogenerated rule brought to you by yara-signator"
        tool = "yara-signator v0.6.0"
        signator_config = "callsandjumps;datarefs;binvalue"
        malpedia_reference = "https://malpedia.caad.fkie.fraunhofer.de/details/win.open_carrot"
        malpedia_rule_date = "20260916"
        malpedia_hash = "53a643781c18e08f4a50949af60172d837a0b6f6"
        malpedia_version = "20260917"
        malpedia_license = "CC BY-SA 4.0"
        malpedia_sharing = "TLP:WHITE"

    /* DISCLAIMER
     * The strings used in this rule have been automatically selected from the
     * disassembly of memory dumps and unpacked files, using YARA-Signator.
     * The code and documentation is published here:
     * https://github.com/fxb-cocacoding/yara-signator
     * As Malpedia is used as data source, please note that for a given
     * number of families, only single samples are documented.
     * This likely impacts the degree of generalization these rules will offer.
     * Take the described generation method also into consideration when you
     * apply the rules in your use cases and assign them confidence levels.
     */


    strings:
        $sequence_0 = { b910000000 448d4289 e8???????? 41b866010000 488d159ab40b00 498bcc e8???????? }
            // n = 7, score = 100
            //   b910000000           | inc                 ecx
            //   448d4289             | push                edi
            //   e8????????           |                     
            //   41b866010000         | add                 dword ptr [esp], 0x4dfac8ca
            //   488d159ab40b00       | pop                 edx
            //   498bcc               | inc                 ecx
            //   e8????????           |                     

        $sequence_1 = { 4903d4 4c63c7 664289b445100f0000 e8???????? 6639b510170000 7427 6639b5100f0000 }
            // n = 7, score = 100
            //   4903d4               | lea                 ecx, [0x89c78]
            //   4c63c7               | mov                 edx, 0x176
            //   664289b445100f0000     | inc    esp
            //   e8????????           |                     
            //   6639b510170000       | lea                 eax, [ecx + 0x30]
            //   7427                 | jne                 0xa2b
            //   6639b5100f0000       | mov                 dword ptr [esp + 0x20], 0xa1

        $sequence_2 = { 8bd7 498bcf e8???????? 488be8 85f6 7421 4c8d0d46990f00 }
            // n = 7, score = 100
            //   8bd7                 | lea                 ecx, [0x8d059]
            //   498bcf               | mov                 edx, 0x16d
            //   e8????????           |                     
            //   488be8               | mov                 ecx, 0x14
            //   85f6                 | inc                 ecx
            //   7421                 | mov                 eax, 0x332
            //   4c8d0d46990f00       | dec                 eax

        $sequence_3 = { 8d50d9 488d0df1021a00 4883c428 e9???????? b838000000 e8???????? 482be0 }
            // n = 7, score = 100
            //   8d50d9               | inc                 ecx
            //   488d0df1021a00       | mov                 eax, 0x83
            //   4883c428             | mov                 ecx, 0x10
            //   e9????????           |                     
            //   b838000000           | mov                 edx, 0x9a
            //   e8????????           |                     
            //   482be0               | dec                 esp

        $sequence_4 = { 7525 4c8d0d5e390e00 c7442420f4000000 baa4000000 8d4806 448d407d e8???????? }
            // n = 7, score = 100
            //   7525                 | xor                 ecx, ecx
            //   4c8d0d5e390e00       | inc                 ebp
            //   c7442420f4000000     | xor                 dh, dh
            //   baa4000000           | inc                 esp
            //   8d4806               | mov                 byte ptr [esp + 0x40], dh
            //   448d407d             | mov                 dword ptr [esp + 0x48], ecx
            //   e8????????           |                     

        $sequence_5 = { 762d ba64000000 c744242059000000 4c8d0db1d21000 8d4aa3 448d42dd e8???????? }
            // n = 7, score = 100
            //   762d                 | mov                 byte ptr [edx + eax + 0x1cd220], al
            //   ba64000000           | dec                 eax
            //   c744242059000000     | add                 edx, 2
            //   4c8d0db1d21000       | dec                 eax
            //   8d4aa3               | cmp                 edx, 0x10
            //   448d42dd             | jl                  0x8a3
            //   e8????????           |                     

        $sequence_6 = { c3 4883b9e002000000 752c ba34010000 c744242005010000 4c8d0d292e0800 b914000000 }
            // n = 7, score = 100
            //   c3                   | lea                 edx, [edx*4]
            //   4883b9e002000000     | inc                 esp
            //   752c                 | xor                 edx, dword ptr [ebx + 0x1c]
            //   ba34010000           | inc                 ecx
            //   c744242005010000     | sub                 esp, 1
            //   4c8d0d292e0800       | je                  0x799
            //   b914000000           | dec                 esp

        $sequence_7 = { 7520 410fb64508 3a05???????? 7513 40b701 eb24 498bce }
            // n = 7, score = 100
            //   7520                 | mov                 ecx, eax
            //   410fb64508           | nop                 dword ptr [eax]
            //   3a05????????         |                     
            //   7513                 | movzx               eax, word ptr [esp + ecx + 0x6c]
            //   40b701               | mov                 word ptr [ebp + ecx + 0x190], ax
            //   eb24                 | dec                 eax
            //   498bce               | lea                 ecx, [ecx + 2]

        $sequence_8 = { 4d8bc8 4c89442460 4180781900 7557 498b4010 80781900 7520 }
            // n = 7, score = 100
            //   4d8bc8               | mov                 dword ptr [esp + 0x30], 0
            //   4c89442460           | mov                 dword ptr [esp + 0x28], 0x80
            //   4180781900           | dec                 eax
            //   7557                 | lea                 ecx, [ebp + 0x480]
            //   498b4010             | mov                 edx, 0x10000000
            //   80781900             | jmp                 0x15e2
            //   7520                 | dec                 eax

        $sequence_9 = { 488d15790a0a00 e8???????? 488bd8 4885c0 7528 4c8d0d650a0a00 c744242056000000 }
            // n = 7, score = 100
            //   488d15790a0a00       | dec                 eax
            //   e8????????           |                     
            //   488bd8               | mov                 dword ptr [esp + 0x40], edi
            //   4885c0               | dec                 eax
            //   7528                 | lea                 edx, [0x110780]
            //   4c8d0d650a0a00       | dec                 eax
            //   c744242056000000     | mov                 ecx, eax

    condition:
        7 of them and filesize < 8377344
}